Privacy Policy

Last updated: October 23, 2026

1. Data controller

The controller of the personal data processed through FlyFF Unity is the publisher identified in the Legal Notice.

Requests about privacy, access to your data, correction or account deletion can be sent to: flyffu.contact@gmail.com

2. Scope

This policy applies to the data processed through the website, the account system, the launcher and game client, the game servers, the payment features, customer support and the infrastructure that runs them. It should be read together with the Terms of Service and Sale.

Third-party platforms such as Stripe or Discord, and external websites, may also process information under their own privacy policies.

3. Legal bases

We only process personal data where there is a legal basis under Article 6 of the GDPR:

Performance of a contract (art. 6.1.b): creating and running your account, giving access to the game, delivering what you bought.
Legitimate interests (art. 6.1.f): operating and securing the Services, preventing cheating, bots and fraud, handling reports, enforcing the Terms and defending legal claims. We weigh these interests against your rights.
Legal obligation (art. 6.1.c): accounting, tax and other records we must keep.
Consent (art. 6.1.a): only where consent is required, for example optional cookies. You can withdraw it at any time.

4. Data we collect

Account

username, email address, account identifier, password (stored hashed, never in clear text);
registration date, IP address at registration and login, login history, account status and restrictions;
the game accounts and characters linked to your account.

Website and server logs

IP address, date and time, requested page, HTTP request data, browser and system information, referring page, response status;
authentication and security events, and technical error information.

Gameplay data

character name, level, experience, inventory, equipment, quests, guild, game currency and virtual items;
trades, login and logout times, and the events needed to run a persistent online game.

Security and moderation data

server-side signals used to detect cheating, automation, exploit abuse, account theft and fraud, correlated with account, IP, session and gameplay logs;
reports submitted by or about you, with their evidence (screenshots, logs, transaction history) and the resulting decisions.

Payments

amount, currency, date, status and transaction identifier, the offer bought, the account credited, and the confirmation you gave at checkout;
payment card data is handled by Stripe and is never received or stored by us.

Support

the content of your messages, attachments, account and transaction details you provide, and our replies.

5. How we use it

Purpose	Legal basis
Create and manage your account, operate the game	Contract (6.1.b)
Process purchases, credit Upoints, refund	Contract (6.1.b)
Keep accounting and tax records	Legal obligation (6.1.c)
Secure the Services, prevent cheating and fraud	Legitimate interest (6.1.f)
Handle reports, moderation and appeals	Legitimate interest (6.1.f)
Fix bugs, restore data, balance the game	Contract / legitimate interest
Answer your requests	Contract / legitimate interest
Optional analytics or marketing cookies (none today)	Consent (6.1.a)

6. Cookies and local storage

The website uses only strictly necessary cookies: the login session and the token that protects forms against cross-site request forgery. They do not require consent.

We do not use advertising or audience-measurement cookies. If we introduce them, we will tell you which provider, what data, why, for how long and on what basis, and we will ask for your consent before setting them.

7. Recipients and service providers

We use third parties where needed to run the Services:

Stripe: payment processing and fraud prevention. Stripe acts as a processor for some operations and as an independent controller for others (for example its own regulatory and anti-fraud obligations).
Support mailbox: Gmail (Google)
Authorities, where we are legally required to disclose data.

We do not sell your personal data and do not use it for advertising.

8. Transfers outside the European Union

Some providers may process data outside the EEA. Where a transfer needs safeguards under the GDPR, we rely on an adequacy decision, standard contractual clauses or another mechanism the law recognises.

9. Retention

[TO CONFIRM: proposed periods]

Account: while it is active, then for a limited period for deletion handling, fraud prevention and disputes; after 3 years of inactivity it may be deleted.
Gameplay data: kept while the account exists, because progression is part of the game.
Security records: routine data for as long as needed for security; evidence linked to cheating, fraud, sanctions or appeals for longer, as needed to document the case and prevent repeated abuse.
Payments: 10 years, the period required for accounting records.
Connection and server logs: 12 months, unless an incident requires keeping them longer.
Support: until no longer needed to answer you or document the matter, for example 3 years after the last exchange.

When there is no remaining purpose or legal basis, data is deleted or anonymised.

10. Account deletion

You can ask us to delete your account by writing to the contact address with a clear subject, for example "Account deletion request". We may ask you to verify your identity first.

Deleting an account may remove or anonymise its personal data. Some data may be kept where needed to meet legal obligations, keep payment records, investigate fraud, document serious breaches or defend legal claims. When only part of the data has to be kept, processing is limited to that purpose.

11. Your rights

Under the GDPR you may have the right to:

access your data (art. 15) and obtain a copy;
have inaccurate data corrected (art. 16);
have your data erased where the conditions are met (art. 17);
restrict processing in the cases the law provides (art. 18);
receive the data you provided in a structured, machine-readable format (art. 20);
object to processing based on legitimate interests, on grounds relating to your situation (art. 21);
withdraw your consent at any time, for the future;
give instructions about what happens to your data after your death.

You can also lodge a complaint with the CNIL (cnil.fr), or with the supervisory authority of your country of residence.

12. How to exercise your rights

Write to the contact address and give enough information for us to identify the account or data concerned. For your security we may ask for additional verification. We answer within the time limits set by data protection law.

13. Automated security checks

We may use automated technical checks on game, network and security data to spot signs of cheating, bots, exploits, account theft or fraud. They can raise alerts or risk indicators that are then combined with logs, reports and, where needed, a human review.

A sanction is not decided only by an automated system without the possibility of review: you can contest it as explained in the Terms. We do not use this data for credit scoring or unrelated advertising profiling.

14. Security of your data

We apply technical and organisational measures appropriate to the risks: access control, restricted administrative access, encryption in transit (HTTPS), password hashing, backups, security logging, updates and monitoring. No service is completely secure, so choose a unique password and tell us if you think your account is compromised.

15. Disclosure required by law

We may disclose data where a valid court order, legal obligation or competent authority requires it, and where needed to establish, exercise or defend legal claims or to protect the rights and security of the Services and their users, within the limits of the law.

16. Minors

The Services are reserved for people aged 15 or older. We do not knowingly collect data from younger children; if we learn that an account belongs to one, we may restrict or delete it and the associated data. Where the law requires a parent's or guardian's consent, we apply it.

17. Information about you provided by other players

Other players may send us information about you, such as reports, screenshots, videos or scam and exploit reports. We use it only where relevant to the report, the investigation or the security issue concerned.

18. Changes to this policy

We may update this policy when the Services, our providers, our security measures or legal requirements change. The current version is the one published on the website, and its update date appears at the top of the page. For material changes we may also notify you on the website, in the game client or by email.

19. Contact

Email: flyffu.contact@gmail.com
Website: flyff-unity.com

For privacy questions, data requests or account deletion requests, write to the address above. The identity and address of the publisher are given in the Legal Notice.