1. Who We Are

VirtuAce is a social casino entertainment platform operated by its founder. For privacy enquiries, contact us at: [email protected]

For the purposes of GDPR, we act as the data controller for information you provide to us directly.

2. Data We Collect

2.1 Account Data

Data	Purpose	Basis
Email address	Account creation, login, communications	Contract
Username	Display name, leaderboards	Contract
Password (hashed)	Authentication — never stored in plain text	Contract

2.2 Game & Activity Data

Data	Purpose	Basis
Game session history	Profile stats, session history display	Legitimate interest
ACE chip balance & transactions	Game economy, purchase delivery	Contract
Prestige level & badges	Progression system	Contract
Prediction market bets	Market settlement, portfolio display	Contract
Stake tier & settings	Game configuration, personalisation	Contract

2.3 Payment Data

We do not store your payment card details. All payment processing is handled by Stripe, Inc. We receive only a payment confirmation and the amount. Stripe is a PCI-DSS Level 1 certified processor.

See Stripe's Privacy Policy for how they handle your payment data.

2.4 Technical Data

Data	Purpose	Basis
IP address	Security, fraud prevention (via Firebase)	Legitimate interest
Browser / device type	Compatibility (via Firebase)	Legitimate interest
Usage timestamps	Last active, session tracking	Legitimate interest

2.5 Deletion Feedback

If you choose to delete your account, we ask for an optional reason. This is stored anonymously to help us improve the platform. Your account data is deleted immediately upon confirmation.

3. How We Use Your Data

• To provide and operate the Service (account, game, payments)
• To personalise your experience (stats, charts, leaderboard)
• To process purchases and deliver virtual items
• To enforce our Terms of Service and prevent fraud
• To communicate with you about your account when necessary
• To improve the Service through anonymised analytics

We do not use your data for advertising, profiling for third parties, or sell it in any form.

4. Third-Party Services

Service	Purpose	Privacy Policy
Firebase (Google)	Authentication, database, hosting	firebase.google.com/support/privacy
Stripe	Payment processing	stripe.com/privacy
Google Fonts	Typography (loaded from Google CDN)	policies.google.com/privacy

These services may process data outside the EU/EEA. Firebase and Stripe provide appropriate safeguards under GDPR (Standard Contractual Clauses).

5. Data Retention

• Active accounts: Data is retained for as long as your account exists.
• Deleted accounts: Account data is permanently deleted upon request within 30 days. Payment records may be retained for up to 7 years for legal and tax purposes.
• Anonymous analytics: Anonymised usage data may be retained indefinitely.

6. Your Rights (GDPR)

If you are in the EU/EEA or Switzerland, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — delete your account and data (available in Account Settings)
• Right to portability — receive your data in a portable format
• Right to object — object to processing based on legitimate interests
• Right to restrict processing — limit how we use your data

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Cookies & Local Storage

We use browser localStorage (not traditional cookies) to store:

• Age verification confirmation (to avoid re-prompting)
• Display preferences (odds format, currency)
• Authentication tokens (managed by Firebase)

We do not use third-party tracking or advertising cookies.

8. Children's Privacy

This Service is strictly for users aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us immediately and we will delete it.

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including encrypted transmission (HTTPS), hashed passwords via Firebase Authentication, and restricted database access rules. However, no system is 100% secure and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the platform. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

11. Contact & Complaints

Privacy questions: [email protected]

If you are unsatisfied with our response, you have the right to lodge a complaint with your national data protection authority. In Switzerland: Federal Data Protection and Information Commissioner (FDPIC).