Privacy Policy
This page explains plainly what data ULTMU Online collects on this site, why, for how long, and what you can demand about it. It covers the site and the account you create here — the same one you sign into the game with.
In short
- We ask for an email and a password to create your account. It is the same pair that signs you into the site and the game.
- When you buy, card and Pix payments go straight to the payment processor — we never see that data.
- No measurement script loads before you allow it.
- We don't sell your data, don't rent it, and don't use it for advertising.
- You can access, correct or delete your data at any time.
Who is responsible for your data
The party responsible for processing the personal data collected on this site — what Brazil's LGPD calls the controller — is the ULTMU Online project.
For anything related to this policy or to your data, the channel is the email below. It is also the channel to reach the data protection officer.
- Controller
- ULTMU Online
- Contact
- [email protected]
What we collect
We collect little, and always for a stated reason:
- Email and password — when you create the account. The password is never stored as you typed it: it is kept scrambled, and not even the team can read it back.
- An account identifier — generated by us, unrelated to your name or email. It is what appears in the game, and it is why you do not pick an account name.
- Purchase data — when you buy on the site: the product, the amount and currency, the store country, the payment method (Pix or card), the order status and dates, the Ultcoin credited and the references the payment processor sends back so we can find the transaction. The order is linked to your account and your email.
- Email and language — when you leave your address in the public-launch notice form. The language travels with it so the message reaches you in the right one.
- Technical access records — IP address, browser and system, date and time, and the pages visited. These are generated automatically by the server and by infrastructure providers.
- Essential cookies — the language you pick and your decision about cookies.
- Measurement cookies — only if you allow them. We use Google Analytics and the Meta Pixel (Facebook and Instagram), which write their own identifiers and record browsing in aggregate.
- Game client technical diagnostics — when the game crashes, fails or hits an error, it automatically sends a technical diagnostic to our server: technical data about the error and the build, a hardware summary (operating system, processor, memory, graphics card and driver), your account and character identifiers, and an anonymous identifier for the machine. This does not include personal files, your hardware's network address or any component's serial number. It's used only to fix defects in the game, and it is kept for 90 days.
We do not collect first or last names, phone numbers, national ID numbers, addresses or dates of birth — sign-up has three fields, and none of them is that. We also never see or store card or bank account details: payment happens directly with the payment processor — Stripe for cards, Woovi for Pix — which handles that data under its own privacy policy.
What we use it for
- To create and maintain your account, authenticate your access to the site and the game, confirm your address and allow password recovery — the purpose of the sign-up email and password.
- To process your purchases: record the order, confirm payment, deliver what was bought, handle withdrawals, refunds and chargebacks, and meet tax and consumer-protection obligations — the purpose of purchase data.
- To tell you when the public launch gets a date — the purpose of the email left in the footer form, and only that.
- To keep the site up and secure and to investigate abuse and failures — the purpose of the technical records.
- To remember your preferences: the language and your cookie choice.
- To understand in aggregate how the site is used, so we can improve it — only with your permission.
We don't use your data for advertising, we don't build individual behaviour profiles, and we don't sell or rent your data to anyone.
On what legal basis
- Performance of a contract (Art. 7, V) — to create and maintain your account and to process your purchases: without this data we cannot deliver what you asked for.
- Consent (Art. 7, I) — for the notice-list email and for measurement cookies. You can withdraw it at any time, and withdrawing is as simple as giving it.
- Legitimate interest (Art. 7, IX) — for the technical records needed for the security and operation of the site.
- Compliance with a legal obligation (Art. 7, II) — for keeping access logs as required by Brazil's Internet Civil Framework.
- Regular exercise of rights (Art. 7, VI) — to keep purchase records even after the account is closed, as proof of the transaction in a refund, chargeback or legal proceeding.
How long we keep it
- Account data — for as long as the account exists. When you close it, the data is deleted or anonymised, except what the law requires us to keep.
- Purchase records — even after the account is closed, for as long as the transaction can still be disputed or audited: as a rule, 5 years.
- Notice-list email — until you ask for removal, or up to 12 months after the server opens, whichever comes first.
- Access logs — 6 months, the period set by Brazil's Internet Civil Framework.
- Consent cookie — 6 months, after which the question is asked again.
- Language cookie — about 1 year.
- Measurement data — for the period configured in the Google Analytics and Meta accounts.
Your rights
The LGPD (Art. 18) guarantees you, over your own data, the right to:
- confirm whether we process any data of yours, and access it;
- correct incomplete, inaccurate or outdated data;
- request anonymisation, blocking or deletion of unnecessary or unlawfully processed data;
- request portability to another provider;
- know who we share your data with;
- withdraw consent and request deletion of the data processed on that basis;
- lodge a complaint with the Brazilian data protection authority (ANPD).
To exercise any of them, write to the contact email. We answer within 15 days. We may ask for information confirming your identity — not to make it harder, but to avoid handing your data to someone else.
Security
We take reasonable technical and administrative measures to protect what we hold: restricted access, encrypted traffic, and collection kept to a minimum — data that doesn't exist is the only kind that can't leak.
No system is immune. If a security incident poses a relevant risk to your rights, we will notify you and the ANPD, as Art. 48 requires.
Minors
ULTMU Online requires you to be 13 or older to create an account and play, as set out in the Terms of Use. We do not knowingly collect data from anyone below that age, and if we identify such a record it is deleted.
Children's data — under 12, in the LGPD's definition — receives the reinforced protection of Art. 14. Between 13 and 18, processing is carried out in the teenager's best interest, and we recommend their guardians are aware of it.
Changes to this policy
If the site starts collecting something new, this policy is updated first, not afterwards.
A relevant change of purpose reopens the cookie question: your previous decision stops applying and you choose again, with the new text in front of you.
Contact
Questions, data subject requests or complaints about this policy: write to the address below. It is the same channel for reaching the data protection officer.
You may also complain directly to the Brazilian data protection authority (ANPD).