Command Arena Privacy Policy
This Privacy Policy explains how MicroVerse Limited collects, uses, shares, stores and protects personal information when you use Command Arena.
1. Who controls your information
MicroVerse Limited is the organisation responsible for the personal information described in this policy. We are incorporated in New Zealand.
Privacy contact and New Zealand Privacy Officer: 
.
2. Information we collect
Depending on how you use the Service, we may collect the following categories of information:
- Account information: email address, callsign, account identifiers, password hash, verification status, settings and legal-document acceptance records.
- Gameplay information: matches, scores, rankings, teams, game actions, achievement or moderation information, and anonymised historical game records.
- Communications: support tickets and the pictures or PDFs you attach to them, posts, replies and pictures on the COMMAND POST forum (which are public), reports, appeals, and chat messages where they are stored, reported or required for moderation.
- Subscription and transaction information: Premium status, billing interval, amount, currency, Stripe customer/subscription/payment references, receipts, cancellation status and recurring-payment consent records. We do not receive your complete card number.
- Technical and security information: IP address, date and time, browser, device type, operating system, session identifiers, login history, referral URL, security events, error logs and approximate location inferred from IP where used.
- Cookie and preference information: necessary login/security cookies and, if enabled with appropriate notice or consent, analytics or advertising preferences.
- Privacy-request information: the request, verification information, correspondence, outcome and audit record.
3. How we collect information
We collect information directly from you when you create or manage an account, communicate with us, play games or purchase Premium. We also collect technical and gameplay information automatically as the Service operates.
We may receive limited information from service providers such as Stripe, hosting providers, email-delivery providers, fraud/security services and analytics providers. If we begin collecting personal information indirectly from additional sources, we will update this policy and provide any notice required by law.
4. Why we use information
We use personal information to:
- create, authenticate and manage accounts;
- operate multiplayer games, matchmaking, rankings, callsigns and gameplay records;
- provide Premium, process subscriptions, send receipts and manage cancellation;
- send verification, password-reset, email-change, deletion, billing, security and service notices;
- detect cheating, fraud, abuse, attacks, account compromise and other security risks;
- moderate chat and enforce the Terms of Service;
- debug, maintain, measure and improve the Service;
- respond to support, legal and privacy requests;
- comply with tax, accounting, consumer, privacy, law-enforcement and other legal obligations;
- send marketing only where permitted and with any consent required by law.
5. Legal bases for European users
Where the GDPR or similar European law applies, we rely on the following legal bases:
- Contract: account creation, authentication, gameplay, Premium delivery, billing and requested support.
- Legitimate interests: securing the Service, preventing fraud and cheating, moderating abuse, diagnosing faults, maintaining records and improving ordinary service performance, balanced against user rights.
- Consent: optional marketing and non-essential cookies or similar tracking where consent is required. Consent may be withdrawn without affecting earlier lawful processing.
- Legal obligation: tax, accounting, consumer, regulatory and lawful disclosure duties.
- Legal claims and vital interests where applicable in exceptional circumstances.
6. When we share information
We may disclose information only as reasonably necessary to the following recipients:
- Payment processor: Stripe, for subscription and payment processing.
- Hosting and infrastructure providers: currently intended to include DigitalOcean infrastructure in the United States, plus network, backup, monitoring and security providers.
- Email-delivery provider: Resend (United States), for account, transactional and — only with your consent — game-news emails.
- Analytics or advertising providers: only if enabled and described in the Cookie Notice. At launch, the recommended approach is no personalised behavioural advertising.
- Professional advisers: lawyers, accountants, auditors, insurers and consultants subject to confidentiality obligations.
- Authorities and affected parties: where reasonably necessary to comply with law, protect rights or safety, investigate fraud or security incidents, or respond to valid legal process.
- Corporate transactions: a buyer, investor or successor in a genuine financing, sale, merger or reorganisation, subject to appropriate confidentiality and continued legal protection.
We do not sell personal information for money. This policy assumes we do not share personal information for cross-context behavioural advertising. If that changes, we will update the policy and provide legally required opt-out controls before the change takes effect.
7. International data transfers
Command Arena is based in New Zealand and uses service providers in other countries, including the United States. Privacy protections and government-access rules may differ between countries.
We use contracts, provider due diligence and other safeguards required by applicable law. For European personal data, this may include European Commission Standard Contractual Clauses, adequacy mechanisms or another valid transfer basis. For New Zealand personal information, we assess and manage overseas disclosures and processing in accordance with the Privacy Act 2020.
8. How long we retain information
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including security, dispute, tax and legal requirements.
Account data is generally retained while the account is active. After confirmed deletion, login access is disabled and direct identifiers are removed from live systems within the operational period stated in our internal retention schedule, subject to legal exceptions. Deleted information may remain in protected backups until those backups cycle out.
Security logs may be retained for up to 12 months. Subscription-consent evidence may be retained for at least three years or one year after termination, whichever is longer. Tax and transaction records are retained for the period required by law.
Support tickets, their messages and any pictures or PDFs attached to them are kept while the ticket is open and deleted 12 months after it closes. Hidden data in pictures, such as location, is removed when they are uploaded. Deleting your account deletes your tickets.
COMMAND POST forum posts are public and stay up until you delete them or delete your account; then their text and pictures are removed and only a "post removed" marker is left so threads still read sensibly. Posts hidden by a moderator are kept for up to 12 months for review, then their text is deleted. Reports you make are private to moderators.
Match or leaderboard records may be retained indefinitely only after they have been genuinely anonymised so they no longer identify or can reasonably be linked to you.
9. Your choices and privacy rights
You may update certain account information in Account Settings and may request account deletion through the email-confirmed deletion process.
Depending on where you live and the law that applies, you may have rights to be informed, access personal information, correct it, request deletion, restrict processing, object, receive portable data, withdraw consent, opt out of sale/sharing or targeted advertising, and not be discriminated against for using privacy rights.
To make a request, email . Describe the request and the account email concerned. We may take proportionate steps to verify identity and authority. We aim to respond within one month where GDPR applies and within any other period required by local law.
Some rights have exceptions. For example, we may retain information needed for tax records, fraud prevention, security, legal claims or another legal obligation. We will explain any material refusal or limitation where required.
10. Additional notice for United States residents
US state privacy laws apply only where their scope and thresholds cover Command Arena. Where applicable, residents may exercise the rights described above.
In the preceding 12 months, we may have collected the categories described in section 2 and disclosed them to service providers for the business purposes described in sections 4 and 6. We do not knowingly sell personal information, and this draft assumes we do not share it for cross-context behavioural advertising.
We do not use sensitive personal information to infer characteristics about users. We do not offer financial incentives in exchange for personal information.
An authorised agent may submit a request where permitted by state law. We may require proof of authority and may verify the request directly with the account holder.
11. Children's privacy
Command Arena is for players aged 13 and over. It is not directed to children under 13, and we do not knowingly collect personal information from them.
Age check at sign-up. Before we ask for an email address, sign-up asks for your month and year of birth. We use the answer only to check that you are 13 or over, and we do not keep it — we record only that the check was passed. If the answer shows you are under 13, no account is created and nothing about you is sent to us. A small cookie (ca_age, one day) remembers the result in your browser so the check cannot simply be retried.
If we learn a child under 13 has an account. If a parent or guardian tells us, or we otherwise learn that an account belongs to a child under 13, we will close the account and delete the personal information we hold about the child promptly, and in any case within 7 days. This includes the email address, callsign, friends list, messages and lobby posts. Match results may be kept only once they are anonymised so they no longer identify the child.
How a parent or guardian can reach us. You do not need an account. Email our privacy contact with the account's callsign or email address. We may ask a few reasonable questions to make sure the request is genuine. We will confirm when the account has been deleted, and we will not use the information in your message for any other purpose.
Voice chat is carried live between players and is not recorded.
Where local law gives additional protections to teenagers or requires parental permission for consent-based processing, we will apply those requirements.
12. Cookies and similar technologies
We use necessary technologies for login sessions, security, fraud prevention, user preferences and core operation. These cannot always be disabled without preventing the Service from working.
If we use non-essential analytics or advertising technologies, we will describe them in the Cookie Notice and request consent where required. You can change optional choices through Cookie Settings. Browser privacy signals will be handled where legally required.
13. Security
We use reasonable administrative, technical and organisational safeguards designed for the nature of the information and risks involved. Measures may include password hashing, encryption in transit, access controls, administrator MFA, logging, rate limiting, backups, token expiry and incident response.
No online service can guarantee absolute security. You should use a unique password and contact us promptly if you suspect unauthorised access.
14. Privacy breaches
We maintain a process to assess, contain, document and respond to privacy and security incidents. We will notify affected people and regulators when required by applicable law.
15. Automated decisions
We may use automated systems to detect likely cheating, spam, fraud or security threats. We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects without safeguards required by law. Material enforcement decisions may be reviewed through support or an appeal process where appropriate.
16. Complaints
Please contact first so we can investigate.
New Zealand residents may complain to the Office of the Privacy Commissioner. European users may complain to the data protection authority where they live, work or believe an infringement occurred. US residents may contact the regulator or attorney general responsible under applicable state law.
17. Changes to this policy
We may update this policy to reflect legal, provider, security or product changes. We will post the updated version with a new effective date and provide additional notice for material changes where required.
18. Contact
MicroVerse Limited
Privacy Officer: