Privacy Policy
Effective date: November 12, 2026 · Leer en español
1. Controller
Altaros LLC, 407 Lincoln Road, Suite 12N, Miami Beach, FL 33139, USA, is the controller of your personal data. Privacy contact: support@arenapit.com.
2. What data we process, why, and on what basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email, name, player name, password (hashed), language | Create and manage your account, sign in, confirm your email, reset your password | Performance of the contract |
| Broker demo account (account number, credentials) and the trades, balance and equity of that account | Run competitions, calculate rankings, history and statistics | Performance of the contract |
| Results, XP, level, achievements, titles, cosmetics, crown and AC balances | In-game progression and your public profile | Performance of the contract |
| Purchases (product, amount, date, Stripe identifier). We never see or store your card details | Deliver crowns, invoicing, refunds, fraud prevention | Contract and legal obligation |
| Name and result on certificates | Issue the certificate and let anyone verify it with its public code | Performance of the contract (at your request) |
| IP address, technical logs | Security, preventing abuse and multiple accounts | Legitimate interest |
| Service emails (competitions, account) | Tell you what happens in your competitions | Performance of the contract |
We do not sell your data, we do not show personalised advertising and we do not make automated decisions with legal effects on you.
3. What is public
Your player name, avatar, level, title, cosmetics and results appear in rankings and on your public profile. A certificate shows your name and result to anyone who has its verification code.
4. Who we share data with
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication | EU (Frankfurt) |
| Vercel | Website hosting | USA / global |
| Stripe | Payments | USA / EU |
| Resend | Email delivery | USA |
| Our broker partner | Competition demo accounts | Outside the EU |
| Clouding.io | Server that reads the demo accounts | Spain |
We may also disclose data when the law requires it.
5. International transfers
Some providers process data outside the European Economic Area, mainly in the USA. They do so under the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
6. How long we keep data
For as long as you have an account. When you close it, we delete or anonymise your data within 30 days, except: purchase records (for the period tax law requires, up to 7 years) and results of competitions that have already ended, which are kept anonymised so other players' rankings do not change.
7. Your rights
You can ask for access, rectification, erasure, restriction or portability, or object to processing, by writing to support@arenapit.com. We answer within one month. If you are in the EU you can complain to your data protection authority (in Spain, the AEPD). California residents have the rights granted by the CCPA/CPRA; we do not sell or share personal information as defined by that law.
8. Cookies
We only use strictly necessary cookies, to keep you signed in, remember your language and keep the service secure. We do not use analytics or advertising cookies, so we do not show a cookie banner. Stripe may use its own cookies on its payment page to prevent fraud.
9. Minors
The service is not intended for anyone under 18. If we detect an account belonging to a minor, we close it and delete its data.
10. Security and changes
We apply reasonable technical and organisational measures (encryption in transit, hashed passwords, restricted access). If we change this policy materially, we will tell you by email or in the app.