Privacy Policy

We care about your privacy. That is why we aim to make our data handling methods as transparent as possible so that you can feel safe and respected when using our services. We do our utmost to protect your data from malicious actors and data breaches. Our Privacy Policy will reveal key details about your data, such as how we collect it, how we store it, how long we keep it, and your rights to your data.

This privacy policy forms part of our Terms and Conditions. By accessing or using our services, you agree to both this Privacy Policy and our Terms and Conditions.

Amania: Land of Lions™ is a product by NKUBED Pty Ltd (ABN 89 699 730 044 | ACN 699 730 044) ('us', 'we', or 'our').

We operate the website amanialions.com (the 'Site'), the Amania: Land of Lions Discord bot and game (the 'Bot'), our website forms, and our staff dashboard, as well as any other related products and services that refer or link to these policies (the 'Privacy Policy', 'Policy') (collectively, the 'Services').

This policy applies to everyone who uses our services, including players, website visitors, people who contact us, buyers, and our staff and moderators. The Staff and Moderators section explains how we handle information about our staff.

We run our services from Australia for people all around the world. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). We also apply the rights and protections of the EU and UK GDPR, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other privacy laws to everyone who uses our services, wherever you live, as set out in this policy.

Who Is Responsible for Your Data

NKUBED Pty Ltd is the 'controller' (or 'business' under California law) of the personal data described in this policy. Discord, Tebex, Cloudflare, and other services we use are separate controllers of the data that they collect themselves (see the Who We Share Your Data With section).

We have not appointed a data protection officer, and we do not have an office or appointed representative in the EU or UK. You can contact us directly about anything in this policy at [email protected].

This short summary is not the full policy. Please read the sections below for the details.

• We collect the data needed to run the game: your Discord details, your game progress, what you do with our bot, and, if you buy something, a record of the purchase. That record includes your name, email address, IP address, country, and postal code.
• We never see or store your card details or billing address. Our payment provider, Tebex, handles payments.
• Our systems do not cancel subscriptions. You cancel it with Tebex, or ask us to, and we keep the game profile of anyone whose subscription is still running.
• If you log in on our website with Discord, we only ask Discord for your identity (your Discord ID, name, and picture) and your verified email address. We never see your Discord password, and we use cookies only to keep you logged in for up to 30 days. If you have never played the game, logging in creates a basic profile for you from those details, so that your profile page exists.
• Our website has a public leaderboard and player profile pages that anyone can see, with your Discord name, picture, and game progress. You can limit this with the private profile setting in the game, or ask us to hide your profile page and your place on the leaderboard completely.
• We do not sell your personal information and we do not use it for advertising.
• We keep data only for as long as we need it. For example, inactive game profiles are deleted after 12 months and logs are anonymised after 12 months.
• Some records must be kept for safety and legal reasons, such as game-wide bans, reports, and purchase records.
• You can ask to see, fix, download, or delete your data by emailing [email protected].

We collect only the data necessary to operate and improve our services while respecting your privacy.

We collect specifically:

• Discord account details: Your Discord user ID, username, display name, avatar, your email address if you choose to share it, and the server where you use our bot, to contact you, personalise your experience, provide our service, and display your identification,
• Website login: If you choose to log in on our website with Discord, Discord gives us what you allow through its 'identify' and 'email' permissions: your Discord user ID, username, display name, avatar, and your email address if Discord has verified it. We keep a login session for you, made up of a random code (we store only a scrambled form of it, not the code itself), your Discord ID, your username, display name, and avatar as they were when you logged in, and when the session was made, last used, and expires, so that the website knows who you are for up to 30 days, shows your name and picture, and can fill in forms for you. If you have never played the game, the first time you log in we also create a game profile for you from these details (your Discord ID, username, display name, and avatar, plus the starting values every new player has), so that your profile page exists,
• Game data: Your pride name, title, prestige, level, experience, in-game currency and items, world and progress, deck and strategy, achievements, assignments, friends list, clan membership, clan requests and bans, cooldowns, settings, and the time of your last command, to run the game and keep your progress,
• Bot interaction data: Commands and buttons you use, menus you select, and the text and other input you type into our bot (including pop-up forms and command options), together with the result, any errors, the server and channel you used it in, and timestamps of your interaction, in order for our service to operate successfully and correctly in a secure manner. The game's own records of what you did with items and with other players count as interaction logs too: the history of changes to your items and item stacks, trades, gifts and payments between players, raids, prestige, battles, waiting game messages, and the clan activity log,
• Timestamps: The exact time of each interaction you have with our service including our Discord bot and website,
• Content you create: Pride names, clan names, clan descriptions, clan icons, and other text or images you submit to our services (a clan's name and icon belong to the clan: see What We Cannot Delete),
• Device and network information: Your IP address, country, general location (non-precise), browser type, user agent, timestamps, and device OS as collected via Cloudflare and our service for security, diagnostics, and abuse prevention,
• Website interactions and forms: Any data submitted through forms, including Discord OAuth logins, your name, email address, Discord ID, the type of form (such as contact, report, appeal, or data request), your message, details you give about another person if you are making a report, and the IP address and time of your submission (to prevent abuse), along with metrics of your usage of our services, request headers, and any relevant metadata for the successful operation of our services and updates of our status,
• Payment information: When you buy something, we collect your name, email address, IP address, country, and postal code as Tebex gives them to us, your Discord ID, your Tebex IDs (such as the customer ID and transaction ID), and the purchase details (the product, amount and currency, any fees, any promo code or discount, the payment method type, the status, and the time of purchase). For a subscription we also keep its Tebex reference, whether it is active, and when it renews or ends. We use these to deliver your purchase, manage your subscription, handle refunds and disputes, protect our services and payments from fraud and abuse, track monetary metrics, and meet tax and audit obligations,
• Moderation and safety records: Warnings, restrictions, game-wide bans (Discord ID, reason, timestamps, the staff member who made the decision, and a flag that stops the account sending appeals if staff set one), reports and appeals about you or made by you, and notes that staff add to these records,
• Communications: Emails and messages you send us, including through our contact form,
• And uploaded content: Files, attachments, or customisations submitted to our platform, if applicable for our service to be personalised and operational.

Information About Other People

If you report another person, we collect their Discord ID and the details you give about them, so that we can look into the report. People who are reported can ask for access to their data too, but we may limit what we show them where that is needed to protect the person who reported them or other people, or where the law allows it.

What We Do Not Collect

We do not collect your passwords. We never collect or store your card number, card expiry date, CVC/CCV, or billing address. We do not collect your precise location. Our bot does not read the ordinary messages you post in Discord servers. It only receives the commands, buttons, and other interactions that you send to it.

We do not ask for sensitive information such as health, religion, politics, or government ID numbers. Please do not type private details such as passwords, bank or card details, or government ID numbers into any text box or field: pride and clan names and descriptions, messages and commands you send to the bot, the website forms, reports and appeals, and (for staff) notes, titles and chat in the staff dashboard. What you type can be stored and seen by our staff, and in some places by other players or the public. The details we do need from you, such as your email address and Discord ID, are described in this policy.

Payment Information from Tebex

As stated before already, we collect some payment information from Tebex whenever you make a purchase at our store through them. When we receive a payment, we collect and keep the following:

• Your name
• Your email address
• Your IP address
• Your country
• Your postal code
• Your Discord ID
• Your Tebex IDs, such as the Tebex customer ID and the transaction ID (and for a subscription, its Tebex reference)
• The purchase details: the product, amount, currency, any fees, any promo code or discount, the payment method type (such as card or PayPal), the status, and the date and time of purchase
• For a subscription: whether it is active, and when it renews or ends

We use these to deliver your purchase to the right account, manage your subscription, handle refunds and disputes, protect our services and payments from fraud and abuse, track our sales, and meet tax and audit obligations. We keep all of this for 5 years (see the How Long We Keep Your Data section).

We do not collect or store your card number, card expiry date, CVC/CCV, or billing address. Tebex holds those as a separate controller. Tebex may also let us look up other details about a payment in its platform, and we may use them if required by law or for legitimate business purposes such as:

• Managing a dispute
• Investigating potential fraud
• Verifying purchases

When you make a payment through Tebex, you may be asked to provide sensitive and confidential information such as your address, banking details, and other legal information. Please note that Tebex operates under their own Privacy Policies. However, we will do our best to ensure any data kept by us remains secure.

In addition, we utilise third-party services that have their own Terms and Conditions and Privacy Policy. Their terms and privacy policies may apply to you when you use them. We are not responsible for handling what data third-party services collect, and they may retain your data for longer periods than us.

Our Discord Server

If you join our community Discord Server, Discord processes your messages and activity under its own terms and privacy policy. Messages you post there can be seen by other members and by our moderators, who may keep records of moderation actions, such as warnings and bans. We use our Discord Server for announcements and community chat. It is not a support channel, so please use our contact page at amanialions.com/contact for support, privacy requests, and reports.

By using third-party services, we utilise some tools that they provide to collect your data such as Discord's API and Cloudflare's Usage Data. When you interact with our services such as but not limited to: using forms, making purchases, contacting us, or visiting our website, we may automatically collect your information.

As you use our services, you may authorise our Discord Application that uses Discord's OAuth system. When you do so, it automatically forwards the information you agree to share with us to our systems which will store that information as per our storage policy.

When you log in on our website, you are sent to Discord, where you decide whether to allow our website login application to see your identity and your verified email address. Our server receives them once, saves your Discord name, picture, and verified email address to your existing game record (if you have one), and then asks Discord to cancel the access straight away. If you do not have a game record and you are not banned, we create a basic one for you at that moment, with the same details and the starting values every new player has, so that you appear on the website like any other player. We never do this for a person whose game profile was erased or deleted, or who is banned: they can still log in, but a profile only comes back if they play the game again. We do not keep Discord's access codes, and we never receive your Discord password or any other Discord permission. The leaderboard and player profile pages on our website read from our own database and do not call Discord.

When you use our bot, Discord sends us the interaction that you made, together with your Discord details and the place you used it. We store the result of the interaction and the progress it creates in your game profile.

When you make a purchase, we create a checkout for you with Tebex that includes your Discord ID, so that we can deliver the product to the right account. Tebex then collects your payment details and sends us the details of your purchase, including your name, email address, IP address, country, and postal code. To know what data we keep, please read the Payment Information from Tebex section.

When you send us a form on our website, we receive what you type, and we automatically record your IP address and the time to prevent spam and abuse. Our forms use Cloudflare Turnstile, a bot-protection tool, to check that a person is sending them.

Your metadata such as IP address, geolocation, device information, and browser information may be collected when you visit our website through Cloudflare's Usage Data.

When you interact with our services such as but not limited to: submitting forms, making purchases, contacting us, or visiting our website, we may automatically collect certain information through tools provided by Discord and Cloudflare. We also collect your data to identify users and track progression within our game, purchases for statistics and metrics, and interaction data to ensure the safety of our services and other users. This measure is also to prevent our services from being abused by malicious actors.

To comply with legal obligations, we also collect data to ensure that all users are legally allowed to use our services. For example, we may restrict access to users who do not meet minimum age requirements, based on the information provided or observed usage of our services.

We also collect your data to improve user experience and service functionality, especially through feedback forms.

We specifically collect and use your data for the following purposes:

• To provide access to our game, services, and Discord bot features,
• To track progress, leaderboard status, rewards, and achievements, and to show them on our website's leaderboard and player profile pages,
• To let you log in on our website, create your profile there if you have never played, and fill in forms for you,
• To enable moderation, prevent abuse, and enforce our terms of service,
• To process purchases, deliver products, and handle refunds and disputes,
• To respond to your requests, reports, appeals, and messages,
• To improve our game, site, and community experience,
• And to comply with legal obligations.

Our legal bases for processing your information are:

• Your consent, where required,
• Our legitimate interest in operating and improving the Amania: Land of Lions ecosystem, keeping it safe, and defending legal claims,
• Performance of a contract with you (i.e., use of the bot or web services),
• And compliance with legal obligations.

This table shows which legal basis we rely on for each main purpose, for people who are protected by the GDPR or UK GDPR:

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object to this processing at any time (see the Your Rights section).

If you do not give us the data we need to run your account, such as your Discord ID, we cannot provide the game to you. Providing other information, such as an optional email address, is up to you.

We keep each respective data listed below for the following durations:

The rest of this section explains the details.

• Discord account data is stored until you request the removal of your data, or until your data record has been identified as inactive for over 12 continuous months (our maximum retention period for inactive accounts). While revoking OAuth access via Discord's settings will prevent us from collecting new data, we rely on the 12-month inactivity schedule to fully delete existing records to ensure that our service can operate successfully. We send you a notification before we delete your data, in case you may wish to keep it. Running any command in the game within the 3-day notice period cancels the deletion.
• If you have a subscription, it keeps billing you until it is cancelled, and our systems do not cancel it for you. You can cancel it yourself, or ask us to cancel it for you (see the Subscriptions section of our Refund Policy for how). That is why we do not flag or delete your game profile while a subscription can still bill you, or while the period you have already paid for is still running, even if you have not played for 12 months. Once the subscription has ended, the usual 12-month rule applies again. Leaving the game, or asking us to delete your data, does not cancel a subscription, so if you do not want to keep paying, please cancel it or ask us to.
• Data associated with active game-wide bans (specifically Discord user ID, ban reason, and timestamps) is exempt from both manual data deletion requests and the 12-month inactivity schedule and will not be deleted until the ban is removed for community safety reasons. This means that your Discord user ID, ban reason, and timestamps may be stored beyond the 12 months retention period. Only game-wide bans are kept like this. If staff have blocked an account from sending appeals, that block is part of the ban record: it is kept and removed with the ban and is not removed by a deletion request while the ban lasts. A block placed while the account is restricted ends when the restriction ends. A block only stops appeals: you can still contact us through the other kinds of form, and you can still ask for a copy of your data or for its deletion. A clan ban, where a clan's leader or elder stops you joining that one clan, is not a safety record: it is not exempt, and it is deleted when you ask us to delete your data. Banned user data except the data associated with the game-wide ban will still be deleted if a manual data deletion request is received or based on the 12-month inactivity schedule, meaning that all progress will be lost even if the ban is revoked after a year.
• When you are banned from the game, your listings on the player market are taken down and the items in them go back to your profile. They are not put back up for sale if the ban is lifted, and they are not kept as a separate record. This changes nothing about what we keep or delete: your profile, including those items, is kept or deleted as described above.
• The game's own records of what you did (item and item-stack history, trades, gifts and payments between players, raids, prestige, battles, waiting game messages, and the clan activity log) are interaction logs. Most are kept for much less than 12 months: waiting game messages and battle records for 3 days, raid history for 60 days, and item history, trades, gifts and payments between players, and prestige history for 90 days. The clan activity log keeps only the newest 100 entries of each clan and is deleted with the clan. When you ask us to delete your data, the ones that hold your Discord ID are deleted or have your ID removed straight away, and the clan log lines about you are cleared. Note that a trade, gift or payment is a record of two players, so when one of them is erased the record is deleted for both.
• Interaction logs may be retained for up to 12 months for abuse prevention and diagnostic purposes. Before retaining interaction logs for over 12 months or after receiving a manual data deletion request, we fully anonymise the data by removing all identifiable information such as your Discord user ID or email address. The anonymised logs are deleted 3 years after they were anonymised, unless required longer for legal compliance.
• Reports, appeals, and website form submissions are safety and legal records. For that reason they are not deleted when you ask us to delete your data. Instead, 12 months after they are made we remove the personal details in them, and we delete the remaining record 3 years after that.
• Purchase records are retained for international audit and tax obligations. Due to financial safety reasons and abuse prevention, a manual data deletion request will not delete them earlier. That includes the personal information in them, such as your name, email address, IP address, country, postal code, Discord user ID, Tebex IDs, and payment method. After 5 years, the whole record is deleted unless required longer for legal compliance. Tebex keeps its own records as a separate controller under its own policy.
• Device and network information such as IP addresses, country, browser type, and user agent is stored for a maximum of 12 months. This data is collected and stored strictly for abuse prevention, security monitoring, and investigating potential criminal activity (such as DDoS attacks or fraud). Because this information is necessary to maintain the integrity of our services and defend against legal claims, it is generally exempt from manual deletion requests under the applicable privacy laws including the GDPR and CPRA.
• Reported content, and information about who handled it, may be preserved as evidence until the matter is resolved and for as long as the law requires, even if you ask us to delete your data.
• And uploaded content is stored until you request the removal of your data, or until your data record has been identified as inactive for over 12 continuous months (our maximum retention period for inactive accounts). While revoking OAuth access via Discord's settings will prevent us from collecting new data, we rely on the 12-month inactivity schedule to fully delete existing content to ensure that our service can operate successfully.
• Website login sessions last up to 30 days from the moment you log in. After that you are logged out and the next visit asks you to log in again. Logging out ends the session straight away, and we delete the session records of any account that asks us to delete its data. We keep no more than 8 sessions for each account (the oldest are removed first), and sessions are never copied into our database backups.
• Backups: We keep encrypted backups of our database for up to 14 days so that we can recover from mistakes or attacks. When we erase someone's data, we also keep a minimal record that cannot be read as data about you (it is not the data itself) for 21 days. If a backup has to be restored in that time, we use that record to remove the erased data again before it is used, so erased data does not come back.

You may request the deletion of your data by contacting us.

Some of your game information is visible to other players by design. This may include your Discord username or display name, your avatar, your pride name, level, title, achievements, your clan, and your position on leaderboards. Clan members and leaders can see the information needed to run the clan, such as member names and join requests. If you create or lead a clan, your clan's name, description, and icon are visible to other players. Items you put up for sale on the player market are visible to other players, with your pride name or Discord name (or just "A player" if your profile is private). If you are banned from the game, your market listings are taken down and the items in them go back to your profile.

You can use the privacy settings in the game, such as private profile, private achievements, and friend request settings, to limit some of this. Staff may remove a player from public leaderboards when rules are broken.

Our website also has a public leaderboard and a player profile page for each player. Anyone can open them, including people who are not logged in and people who do not play. The leaderboard shows, for each ranked player, their place, Discord avatar, Discord username, Discord user ID, display name, coins, level, and prestige. A player's profile page also shows their pride name, title, world and world level, and, if they are a member of our staff, a line that says so with their staff role (Owner, Developer, Administrator, or the name of their role), experience, the cards in their deck (each card's name, rarity, level, health and attack, and its picture), their clan (name, level, number of members, and their role in it), where they rank, how many achievements and titles they have, how many friends and special stories they have (only the numbers, never who), the date they joined, and roughly when they were last active (today, this week, this month, or longer ago, never a time). The page never shows email addresses, items, purchases, or anything else that is not listed here.

If you switch on the private profile setting in the game, your profile page shows only your avatar, username, display name, and Discord user ID, and says that the profile is private. You still appear on the leaderboard, as you do in the game, and you can always see your own full profile when you are logged in. You can also ask us (or, where the game offers a setting for it, switch it on yourself) to hide you completely: a hidden player has no profile page that anyone else can open, even with the direct address, and is not on the leaderboard, and you can still see your own profile when you are logged in, marked as hidden. If you switch on private achievements, we hide your achievements from your profile page. A player whom staff have removed from the leaderboard has no profile page either. People who are banned, and accounts that are waiting to be deleted, are not shown to other people at all. A banned person can still log in on our website, and when they do they can see their own profile, marked as banned, and a link to appeal; nobody else can. Search engines are asked not to list player profile pages.

The public leaderboard on our website also has a page for clans. For each public clan it shows the clan's name, icon, level, XP, number of members, net worth and place. A clan's net worth is the coins and bank balances of its members added together; players who are hidden, banned, waiting to be deleted or who have not yet played are not counted. No member is named or shown there, and private clans are not listed. The in-game clan leaderboard lists all clans. The owner of a clan can remove members who have not used the game for 14 days or more; the removal is written to the clan's activity log with the member's name, and that log is kept as described under How Long We Keep Your Data.

Messages and activity in Discord servers are visible according to those servers' settings and Discord's rules, not ours.

We store your data on our private server in Australia which includes a private database system. Some data that is collected by third-party services are stored on their respective storage systems.

We take data security seriously. That is why we limit the amount of sensitive data stored on our services. We do not store sensitive personal credentials such as passwords, 2FA seeds, or payment details for our players. These are handled by external providers.

We implement necessary security measures such as firewall rules, proper network structuring, encryption, and secure protocols. We retain data for as long as your account is active or as needed to provide our services. If your account is inactive for over 12 months or you request to delete it, we will delete or anonymise your data unless required to retain it for legal or compliance reasons. Access to your data is restricted to authorised personnel only including yourself. Data is encrypted at rest and in transit wherever applicable. Backups are encrypted.

No online service can be completely secure. If something goes wrong, we will act as described in the Data Breaches section.

To see what data we store, please see the section: What Information We Collect.

Inside our organisation, only administrators may have direct access to our database files. Any staff member that is below the administration rank, determined by their permissions, does not have direct access to our backend database system. However, they may access limited user information necessary to enforce rules and maintain service integrity, through our staff dashboard. Information they may have access to are:

• Your Discord user ID,
• Your Discord username and display name,
• Your Discord profile picture,
• Your game data,
• And your interactions and usage information with our services including our Discord bot and submission data.

Staff are bound by a Code of Conduct that requires them to keep this information confidential and to use it only to do their work. What they do in the dashboard is recorded.

We do not sell the data that we collect or store to third-parties and we do not share it for advertising. We do not give your data to business partners for their own use. We use service providers that help us run our services, and they may only use your data for that purpose on our behalf. Your data may also be shared with third-party services that we use such as Cloudflare and Discord for protection and transportation.

Specifically, we may share your data with:

• Discord Inc. - We rely on Discord to deliver our bot functionality, to log you in on our website, and to fetch account-related information. Your Discord avatar is shown on our website directly from Discord's own servers, so Discord can see that your picture was requested by a visitor's browser.
• Cloudflare, Inc. - Provides CDN, DDoS protection, bot protection (including Turnstile on our forms), and domain services, and may log IP addresses and user-agent data for security purposes.
• Tebex Limited - A Merchant of Record platform we use to handle financial data such as monetary transactions. Tebex is a separate controller of the payment data it collects from you.
• Platform Staff - Our own staff may access limited information about you depending on their permissions for security and performance management purposes.
• Professional advisers, insurers, and our email and support tools - Where needed to run our business, under duties of confidentiality.
• A buyer or successor - If our business or the Amania: Land of Lions product is sold or reorganised, your data may be transferred to the new owner, who must keep to this policy. We will tell you if this happens.

Tebex also processes your payment information. We do not store your card details, but we do store the transaction details listed in the Payment Information from Tebex section. Tebex handles your data separately from us, and you are responsible for reading and acknowledging their Privacy Policy.

If required by law, we will share your data with law enforcement agencies or other legal authorities such as police or the court for official purposes. We may also report suspected serious harm, such as child exploitation, to the authorities and to specialist reporting bodies, and we may share data where needed to protect people's safety or to establish, exercise, or defend legal claims.

Our servers are located in Australia. If you live overseas, your data will be transferred internationally to reach our servers through Cloudflare, our CDN provider. By using our services, you consent to your information being disclosed to overseas recipients (like Discord, Cloudflare, or Tebex) and that Australian Privacy Principles may not apply to such disclosures once consent is given. That also means that your data may be transferred across borders. We use encrypted channels for all data transfers. Where data is transferred outside of the EEA or UK, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions to safeguard such transfers.

Our methods for ensuring that your data is securely transferred internationally are:

• Use of secure servers and encrypted channels,
• Contractual clauses with third-party providers where required,
• And compliance with international data protection standards.

If we transfer your personal data outside of the EEA or UK, we rely on legally approved mechanisms such as Standard Contractual Clauses (SCCs), adequacy decisions, or your explicit consent to ensure appropriate safeguards are in place. You can contact us to ask for more information about these safeguards.

While using our services, you retain the right to access, correct, or delete your data. You also have the right to restrict how your data is used, and to object to processing based on our legitimate interests, and you can withdraw your consent for us to use your data at any time through our contact page or by email at [email protected]. You also have the right to lodge complaints with relevant privacy regulators if you wish to do so. You can contact us about privacy issues at [email protected].

To comply with international privacy laws, we give you the following rights, wherever you live (within the limits explained below):

• Access - Request a copy of your personal data
• Correction - Ask us to fix inaccurate data
• Erasure - Request deletion of your data ("right to be forgotten")
• Objection - Object to processing based on legitimate interests
• Restriction - Ask us to limit how we use your data
• Automated decision-making - You can object to significant decisions made solely through automated processing, including profiling
• Data portability - Request your data in a structured, portable format
• Withdraw consent - Where processing is based on consent
• Lodge a complaint - With your regional data protection authority

How to Make a Request

The quickest way to ask for a copy of your data, or for your data to be deleted, is on our website: log in with Discord and open Your Data at amanialions.com/your-data. A Discord login alone is not enough for us to release or delete data, because a copy can include purchase records, email addresses and IP addresses. So we check that it is really you in a way that needs no extra data from you: every request is confirmed with a one-time code that our bot sends to you in a Discord direct message (see How We Check It Is You below). A deletion also needs a login from the last 15 minutes and you have to type DELETE, because it cannot be undone. The Your Data page shows every request you have made and where it is up to. For anything else (for example fixing something, or objecting to how we use your data), or if you cannot log in, use the form on our contact page at amanialions.com/contact and say that it is a privacy request, or email [email protected] with the subject 'Privacy Request'. Tell us your Discord ID and what you would like us to do. We may ask you to prove that you control the account, for example by sending us a message from it, and we will not ask for more than we need. You can also use an authorised agent, as long as they can show they act for you.

We will respond within 30 days (or any shorter time the law sets). If your request is complex or we have many requests, we may take longer where the law allows (for example up to two extra months under the GDPR), and we will tell you. There is no fee for your request, unless it is clearly unfounded or excessive.

When you ask for a copy of your data, we collect it into a zip file with structured, readable files. You download it from the Your Data page while you are logged in, within 14 days, after confirming with a fresh one-time code that we send by Discord message (the download link then works once, for 10 minutes). Until then it is stored encrypted on our server, and after that it is deleted. We never send the file in a Discord message or by email.

How We Check It Is You

When you ask for a copy of your data or for its deletion, our bot sends a 6 digit code to you in a Discord direct message, and you type it on the Your Data page. The code works for 15 minutes and you have 5 tries. You can ask for a new code once a minute, up to 3 times an hour. After 5 wrong tries the code is locked for 15 minutes. When your copy is ready, you need a fresh code again to download it, so that nobody else who has found your login on a shared computer can take it. We do not use security questions, ID documents or other extra data for this, because that would mean collecting more data than the request needs. We keep only a scrambled form of the code until it is used or has expired, and we never write the code itself in our logs.

We keep a log of each step of your request (when you asked, whether the Discord message was sent, a wrong or expired code, when you were verified, when the copy was prepared, and when you confirmed the download). You can read this log on the Your Data page under each request, and we keep a short record of how you were verified with the proof that we answered your request. These checks are there to protect you and are never a reason to refuse you. If we cannot send you the message (for example because your Discord settings do not allow messages from our bot), the page says so straight away in plain words, your request stays open, and the 30 days still count from the day you asked. In that case use the contact form on amanialions.com/contact and we will check it is you by hand (for example by asking you to write to us from your Discord account) and then carry on with your request. We do not limit how many times you can exercise your rights. The only limits are the code limits above and a cap on requests made in a single day, which exist to stop automated abuse, and they never stop you from reaching us by the contact form. If we ever have to refuse or charge for a request because it is clearly unfounded or excessive, we will tell you why and that you can complain to your privacy regulator.

A copy request that you have confirmed with the code is prepared automatically by our systems, one at a time, and is usually ready within minutes. A deletion request that you have confirmed is handled by a person, because it cannot be undone and because we may need to deal with a running subscription first.

How We Tell You What Is Happening

We do not hold an email address for everyone, so we tell you in two places: on the Your Data page, where every request shows its state (waiting for you to confirm it is you, waiting, being handled, ready, declined, or expired), and by a direct message on Discord from our bot when your copy is ready, when we cannot do your request (with the reason), and when your data has been deleted. The message never contains your data. If we cannot send you a direct message (for example because your Discord settings do not allow messages from our bot), the Your Data page still shows the answer, and we note that the message could not be delivered. We keep the answer to a request that we declined, and a copy that has expired, on that page for 30 days. Your deletion request is removed once it is done, because your account is gone; you will have been told by Discord message if we could reach you. If we cannot reach you at all, we still complete your request within the time above and keep the record of it described in the retention table, and you can ask us what happened through our contact page.

What We Cannot Delete

Some data has to stay for safety or legal reasons. If we cannot do all of your request, we will tell you which part we cannot do, and why. In short:

• Your deletion request itself, while a subscription can still bill you or the period you have already paid for is still running, because your game profile has to stay for the subscription to keep working. Please cancel the subscription first, or ask us to cancel it in your request. Once it has ended, contact us and we will complete your request,
• A game-wide ban record (Discord ID, reason, and timestamps, and the appeals block if staff set one) stays while the ban lasts. Clan bans are not kept: they are deleted,
• A clan's name and icon, when the clan carries on with other members after you are erased. They belong to the clan and its other members, so they are not removed. The clan's description that you wrote is removed, leadership passes to another member (the longest-standing elder, or otherwise the member who joined first), and your seat, join requests, clan bans and contributions are deleted. If you were the clan's only member, the whole clan is deleted,
• A one-way scrambled fingerprint of your Discord ID (it cannot be turned back into your ID and holds no name or other detail), with the date, stays after your game profile is deleted, so that logging in on our website does not create a new profile for you. You can ask us to remove it,
• Reports, appeals, and website forms are anonymised after 12 months instead of being deleted at once,
• Purchase records stay for 5 years for tax and audit reasons,
• Reported content kept as evidence stays until the matter is resolved,
• Backups are deleted within 14 days, and we make sure erased data is not restored from them.

Australian Residents

Under the Australian Privacy Principles, you can ask to access and correct your personal information. If you are not happy with how we handled your request or your information, please contact us first. You can then complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

California Residents

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what personal data we collect and how we use it
• The right to request deletion of personal data
• The right to correct inaccurate personal data
• The right to opt out of the "sale" or "sharing" of personal data (we do not sell data)
• The right to limit the use of sensitive personal information (we do not use it beyond what is needed to provide our services)
• The right to non-discrimination for exercising privacy rights

In the last 12 months we have collected these categories of personal information, which we use for the purposes in the Why We Collect Your Data section and keep for the times in the How Long We Keep Your Data section:

• Identifiers (such as your name, postal code, Discord ID, username, email address, IP address, and Tebex IDs),
• Commercial information (such as purchase records),
• Internet and network activity (such as interaction logs and device information),
• General location (country and postal code),
• Content you give us (such as clan names and form messages),
• Professional information about staff (see the Staff and Moderators section),
• And, for staff only, account log-in details, which are sensitive personal information. We use them only to let staff sign in securely.

We disclosed these categories to our service providers for business purposes, as described in the Who We Share Your Data With section. We have not sold or shared personal information with third parties for advertising in the last 12 months, and we do not knowingly sell or share the personal information of anyone under 16. We do not disclose personal information to third parties for their own direct marketing (California 'Shine the Light' law). We do not use your personal information to make decisions about you with automated tools in a way that has legal or similarly significant effects.

Residents of Other US States

Residents of Virginia, Colorado, Connecticut, Texas, and other US states with privacy laws have similar rights, including to access, correct, delete, and obtain a copy of their data, and to opt out of targeted advertising, sale, and profiling. We do not do those things. If we refuse a request, you may appeal by replying to our decision, or by emailing [email protected] with the subject 'Appeal'. We will answer your appeal within 45 days (60 days where your state allows). If you are still not satisfied, you may contact your state's attorney general.

EU and UK Residents

Where the GDPR or UK GDPR applies, you can complain to your local data protection authority. For the UK, this is the Information Commissioner's Office (ico.org.uk). For the EU, you can find your authority on the European Data Protection Board's website (edpb.europa.eu). We would appreciate the chance to deal with your concern first.

You can exercise these rights through our contact page or by email at [email protected]. We will respond within 30 days as required by laws. We will not treat you unfairly because you use your rights. However, where we need certain data to run your account, deleting it means we can no longer provide that account to you.

We do not make decisions that have legal or similarly significant effects on you solely by automated means. Our systems may flag unusual activity, apply temporary technical limits (such as rate limits or checks to confirm that you are a person), and keep the game fair. A person reviews flags before an account is restricted or banned for rule-breaking. You can ask for a person to review any decision about your account, as explained in our Terms.

We do not knowingly collect data from users under 13 years old.

Our services are not directed to children under the age of 13. If you are in the EU or another jurisdiction with a higher age threshold for consent (such as 16), you must meet that age requirement to use our services. If you are under 18 or the age bracket that is considered a minor in your jurisdiction, you are required to have a legal guardian agree to our Terms and Conditions in order to use our services. We strongly encourage minors to use our services with the supervision of their legal guardian.

We are trying our best to comply with Children's Online Privacy Protection Act (COPPA). If we discover that a user of our service is under 13 years old, we will terminate and delete their data from our services, and restrict their access until they are 13 years old.

You are required to report to us through our contact page or to [email protected] if you suspect or know that a user that is using our services is under 13 years old.

We treat players under 18 with extra care. We collect only the data we need to run the game, we do not use anyone's data for advertising or profiling, and we give you settings to limit what other players can see. A parent or guardian can contact us at [email protected] to see, correct, or delete a child's data. If you are under 18 and a California resident, you can ask us to remove content that you posted.

We currently only use strictly necessary cookies required for security, traffic optimisation, and service delivery primarily via Cloudflare. We do not use cookies for analytics, advertising, or cross-site tracking, and there are currently no cookies that profile our users. Signed-in staff also receive a cookie that keeps them signed in to the staff dashboard. Cloudflare collects information about you including personal data through metadata in each hyper-text transfer protocol (HTTP) request to our service, which includes but is not limited to:

• IP address,
• Device/browser metadata including user agent,
• Request headers and time,
• Traffic routing and DNS query data,
• And country and general location (non-precise).

If you log in on our website, we set the following cookies. They are strictly necessary for the login you asked for, so we do not ask for separate consent:

• A login cookie, which holds the random code of your login session. It lasts up to 30 days, or until you log out. It is only sent to our server over secure connections, and scripts on the page cannot read it.
• A short-lived cookie that exists for up to 10 minutes while you are logging in with Discord, to protect the login from forgery. It is deleted as soon as the login finishes.
• A small cookie that only says 'this browser may be logged in', and holds no information about you. It lets our website skip asking our server who you are when you have never logged in. It lasts up to 30 days, or until you log out.

If we add cookies for analytics or advertising in the future, we will implement a compliant cookie banner and provide options to opt-in or opt-out as required by law.

Our website also uses your browser's local storage, which is similar to a cookie but stays on your device and is not sent to us. We use it to remember which website notices you have dismissed, so that they do not keep coming back, and, if you log in, to remember your Discord display name and avatar address so that the top of each page can show them straight away. The second item is removed when you log out. We do not use it for analytics, advertising, or tracking, and you can clear it at any time in your browser's settings. Our contact form uses Cloudflare Turnstile to tell people from bots, which may run checks in your browser and process signals about your device, under Cloudflare's own privacy policy.

Because we do not track you across websites and do not sell or share your data, there is nothing for a 'Do Not Track' or Global Privacy Control signal to switch off, and we treat such signals as a request to not sell or share your data anyway.

For more information, you may review Cloudflare's Privacy Policy.

We currently do not feature third-party advertisements. However, our services may utilise in-house or first-party advertisement that promotes our own goods and services. No further data is collected than the information we collect shown in the What Information We Collect section. We do not send marketing emails or direct messages without your consent.

This section is for people who help us run our services as staff or moderators (including volunteers and casual helpers), and for anyone who wants to know how we handle staff information. Our staff dashboard is used only by staff. The Staff Code of Conduct sets out the rules that staff must follow.

What We Collect About Staff

• Identity and contact details: Discord user ID, username, display name, avatar, and email address, and any other messaging account that you choose to link for notifications,
• Role and access: Your role, permissions, who added you, and changes to them,
• Agreements: Which versions of our Terms, Privacy Policy, and Code of Conduct you agreed to, and when,
• Sign-in and device records: When you sign in, and the IP address, country, browser, and device type you used, so that we can protect the dashboard and your account,
• Sign-in security information: Information that proves it is you, kept in protected form. We do not store your passwords,
• Activity records: What you do in the dashboard (such as what you changed, when, and from which IP address and country),
• Staff chat: Messages, files, and replies you send in the staff chat, and the technical details recorded with them (such as the time, size, IP address, and device type),
• Settings and preferences: How you have set up your notifications and your use of the dashboard.

Why We Collect It

• To add, manage, and remove staff and give each person the right access (contract and legitimate interests),
• To keep players' data, our systems, and our community safe, and to prevent and investigate misuse (legitimate interests),
• To keep an accurate record of staff actions, so we can answer complaints and show what happened (legitimate interests and legal obligation),
• To meet legal duties, including child safety, and to respond to authorities (legal obligation),
• To send you notifications you ask for (consent, which you can withdraw).

Monitoring

Actions in the staff dashboard and in the staff chat are recorded, and our administrators may review them to keep players, staff, and our systems safe and to check that the Code of Conduct is followed. By working as staff you accept this.

How Long We Keep Staff Data

• Your staff record, while you are staff. If you have no activity for 12 months, you are removed from staff automatically, and your staff data is anonymised as described below,
• When you leave, we delete your sign-in details, sign-in security information, and linked accounts,
• Records of what you did are anonymised when you leave, or 12 months after they are made. Your name, ID, and IP address are removed. The anonymised records are deleted 3 years later,
• Device records are forgotten up to 6 months after the device was last used,
• Sign-in session records are short-lived and end automatically within days,
• Staff chat messages stay while the conversation needs them. When you leave, you can ask us to delete the messages you sent. Messages that have been reported, or that we hold as evidence, are not deleted until the matter is resolved,
• Limited technical records of staff chat messages and files (such as time, size, IP address, device type, and an integrity check value, but not the content) are kept for up to 36 months for safety and legal reasons,
• Records of which agreements you accepted stay with your staff record.

Who Sees Staff Data

Administrators, and staff who have been given permission to manage the team, can see staff details and records. Other staff can see your name, avatar, and role, and the messages you send in the staff chat. Anyone who visits our website can see the display name of the staff member who last published a guide, on that guide's page with the date, the staff members who are named on our Staff Team page, and the staff role shown on a staff member's player profile page on the website. Service providers that help us (such as Discord, Cloudflare, and the messaging service you link for notifications) process some data for us or under their own policies. We may share staff data with the authorities where the law requires, and where it is needed to protect people.

Staff Rights

You have the same rights as everyone else (see the Your Rights section). In addition, you may ask us to delete your chat messages when you leave, as explained above. Some records, such as the record of what staff did, are anonymised instead of deleted at once, because we need them for safety and legal reasons. If you are under 18, your parent or guardian can contact us about your data.

If there is a breach of security that affects your personal data and is likely to cause you serious harm (or a risk to your rights and freedoms), we will tell you and the relevant authorities as the law requires. For example, this includes notifying the OAIC under Australia's Notifiable Data Breaches scheme, and the relevant data protection authority within 72 hours where the GDPR or UK GDPR requires it. We will tell you what happened, what data was involved, and what you can do.

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or our services. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Minor Updates: For minor administrative changes (e.g., fixing typographical errors or updating contact information), the changes will be effective immediately, and we may only update the 'Last Updated' date at the top of the Policy.

Major Updates: If we make material or significant changes to how we collect, use, store, or share your personal data (such as adding new third-party tracking or advertising partners), we will provide at least thirty (30) days' prior notice of these changes and their effective date. We will endeavour to notify you through a public announcement on our Discord Server, a banner on our site, and/or via email (if you have provided your email address for such notifications). This notice will give you the opportunity to review the changes and exercise your data protection rights (e.g., opting out of new data uses) before the changes take effect.

By continuing to use our services after the effective date of any changes, you acknowledge and agree to the updated Policy.

Our main method of contact is the form on our contact page at amanialions.com/contact. Please use it first, including for privacy requests, as it reaches the right people and gives you a reference number. Our Discord Server and email are backup or alternative methods of contact: email [email protected] for normal purposes and [email protected] for legal matters and privacy requests. For urgent safety concerns, please email [email protected]. The Discord Server is mainly used for announcements and community chat, and we may ask you to send the details of a request through the contact form instead.

Amania: Land of Lions™ is a product of NKUBED Pty Ltd (ABN 89 699 730 044 | ACN 699 730 044)

Jurisdiction: Queensland, Australia