Privacy Policy
This is a translation; the German version is legally binding.
1.Controller
Jan Rehder, trading as OPLegendBot, An der Friedenskirche 15, 24941 Flensburg, email: kontakt@oplegendbot.fyi
We have not appointed a data protection officer; we are not obliged to do so.
2.Overview
We process personal data only to the extent necessary for operating the website, your customer account, the sale of licenses and the license verification of the software. We use no analytics, advertising or tracking tools. Fonts are loaded from our own server, not from third-party providers.
3.Hosting and accessing the website
The website and the license verification run on Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When the website is accessed, Cloudflare processes technically necessary data: IP address, date and time, requested address, browser and system information. We use this data to deliver the website, to fend off attacks and for troubleshooting. Troubleshooting logs are deleted after no more than 7 days. Login attempts in the protected operations area are stored by us with IP address, time and the email address entered, in order to detect and block the guessing of login credentials; we delete these entries after 30 days.
The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in a secure and functioning service). A data processing agreement has been concluded with Cloudflare.
4.Customer account
For the customer account, we process your email address, your name, your password (only as a secure hash value, never in plain text) and information about your licenses. For logged-in sessions, we additionally store the IP address and browser identifier in order to be able to detect misuse; session data is deleted when the session expires. When an account is created and when a password is reset, we protect ourselves against automated requests with Cloudflare Turnstile (as described in section 9).
The legal basis is Art. 6(1)(b) GDPR (contract). We store the data for as long as your customer account exists.
You can delete your customer account at any time within the customer account itself; for security, you confirm the deletion via a link that we send to you by email. Upon deletion, we remove your account data, sessions and login connections (Discord, PayPal). Your licenses end immediately as a result. We retain payment records only for as long as required by law (see section 11) — without any link to your deleted account. If a subscription is still running, it must be cancelled before deletion.
5.Login with Discord or PayPal
You can also log in via Discord (Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA) or PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). In doing so, we receive from the respective provider your user ID there, your name, your email address and, if applicable, your profile picture. We do not receive your password with the provider. We display your profile picture at the top of the page while you are logged in; your browser loads it directly from the provider's server, which thereby learns your IP address.
The legal basis is Art. 6(1)(b) GDPR. The processing by the provider is governed by the provider's own privacy policy.
6.Payment and cancellation
Orders and payments are handled by our online reseller Paddle (Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom (registered in England and Wales, company no. 08172165); privacy contact: privacy@paddle.com). Paddle is the seller (Merchant of Record) and processes the data necessary for ordering, payment, tax, invoicing and refunds under its own responsibility in accordance with its privacy notice. We do not receive payment details (card, bank account).
What we pass to Paddle: When you click "Buy", we open Paddle's checkout on our website (Paddle.js, loaded from Paddle only at that moment) and pass the selected product (tier, term, one-time purchase or subscription), the email address of your customer account (prefilled), the language of the page and an internal identifier of your customer account so that we can assign the purchase to your account. When Paddle.js loads, Paddle technically receives your IP address and browser information; Paddle also uses them to prevent fraud. You enter everything else (name, address, country, payment details) directly with Paddle. For refunds and cancellations you request from us, we send Paddle the transaction identifier.
For each purchase, we receive from Paddle your email address, your country, the product purchased, the amount and time, the transaction identifier and the status of a subscription (active, cancelled, refunded) — we use this to issue, extend and end your licence on refund or cancellation.
The legal basis is Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (obligations under commercial law). Paddle.js is only loaded for a purchase you start (Section 25(2) no. 2 TDDDG, strictly necessary).
If you cancel via "Cancel contracts here", we store your email address, the last four characters of your key that you provided, what is to be cancelled, an optional reason and the time of receipt. We confirm receipt to you by email. The legal basis is Art. 6(1)(b) and (c) GDPR (§ 312k BGB). We store this information for 3 years (regular limitation period) in order to be able to prove the cancellation.
7.License verification by the software
When a game account logs in, the software checks online whether your license is valid. In doing so, we process:
We do not receive your game login credentials (password, session) — the login to the game takes place directly from your device. Any other data that the software transmits for license verification is processed by us only for the duration of the request and is not stored.
We delete log entries of the license verification (with IP address) after 30 days. We store the identifiers of occupied account slots for the term of your license, together with whether each slot was last used on Windows or Android.
To ensure that the free trial can only be used once per game account per year, we additionally store, for the identifier of the game account (the hash value), only when it first used a trial and when it last ran with a purchased key — without any reference to your customer account or your email address. We delete this information 12 months after the later of these points in time. The legal basis is Art. 6(1)(f) GDPR (our interest in preventing misuse of the free trial).
The legal basis is Art. 6(1)(b) GDPR (performance of the license agreement) and Art. 6(1)(f) GDPR (protection against misuse of the license keys).
8.Emails
We send confirmation, password and order emails via Google Gmail (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). In doing so, your email address and the content of the email are processed.
The legal basis is Art. 6(1)(b) GDPR.
9.Contact form
If you write to us via the contact form, we process your email address, your name (if provided), subject and message as well as the time, in order to answer your inquiry. To protect against automated requests (spam), we use Cloudflare Turnstile; in doing so, Cloudflare processes technical data of your browser and your IP address without setting cookies.
The legal basis is Art. 6(1)(b) GDPR if your inquiry concerns a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering inquiries). We delete inquiries 6 months after they have been dealt with, unless a retention obligation applies.
The same applies to the "Ask a question" form on the "Questions" page: we process the topic, question, email address, your indication of whether the question may be published, and the time, in order to answer you. If we publish a question, we do so only with your consent and never with your address. Deletion likewise 6 months after it has been dealt with.
10.Database
We store the data from sections 4 to 9 in a database at Neon, Inc. (USA); the storage location is a data center in Frankfurt am Main. A data processing agreement has been concluded with Neon.
11.Storage periods at a glance
| Data | Period |
|---|---|
| Troubleshooting logs (hosting) | no more than 7 days |
| License verification log (with IP) | 30 days |
| Login attempts in the operations area (with IP) | 30 days |
| Session data (IP, browser identifier) | until the end of the session |
| Customer account, licenses, account slots | until the account is deleted |
| Trial per game account (identifier + points in time) | 12 months after last trial or purchase use |
| Contact inquiries and submitted questions | 6 months after they have been dealt with |
| Cancellations | 3 years from receipt |
| Orders, invoice and payment data | statutory retention period (up to 8 or 10 years) |
12.Cookies
We use only technically necessary cookies:
In addition, we store in the local storage of your browser (localStorage) what a page should keep open for you when you reload or switch pages: unfinished entries in the contact and cancellation forms (up to 7 days), the confirmation after submission (1 day) and the selected tab of the login. This information does not leave your browser; we never store passwords or license keys there. It expires automatically; you can delete it at any time via your browser settings.
No consent is required for technically necessary cookies and this storage (§ 25 Abs. 2 Nr. 2 TDDDG). We do not set any other cookies.
13.Transfers to third countries
Some service providers are based in the USA (Cloudflare, Discord, Neon, Google as parent company). Insofar as data is transferred to the USA in this context, we rely on the adequacy decision of the European Commission on the EU-US Data Privacy Framework, insofar as the provider is certified under it, and otherwise on the standard contractual clauses of the European Commission. Paddle is based in the United Kingdom; there is an adequacy decision of the European Commission for transfers there.
14.Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise these rights, please contact kontakt@oplegendbot.fyi.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the federal state of your residence or of our registered office (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel).
15.Obligation to provide data, no automated decision-making
Without an email address and the data for license verification, we cannot provide you with a license. Automated decision-making within the meaning of Art. 22 GDPR does not take place.