Privacy notice

Mareades (AltBay) is the controller for personal data processed via https://altbay.net.

AltBay is a shop of Mareades, established in the Netherlands.

Mareades is registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under KvK number 42050327. The establishment address is the address recorded for that KvK number in the Handelsregister.

Customer contact for AltBay: [email protected]. Website: https://altbay.net. Mareades: https://www.mareades.com.

Privacy requests: [email protected].

Account data: email address, optional name, password hash (not the password itself), and role.

Orders: email, country, order number, line items, amounts, payment status, and delivery status.

Support: the content of tickets you send us, including any order number you include.

Security and operations: IP address used at login, checkout, and webhooks (for rate limiting, fraud prevention, and audit). Staff access to decrypted inventory credentials is logged without storing the plaintext in the audit trail.

We do not ask for your payment-card number; that is handled by Stripe on their pages.

Contract (GDPR art. 6(1)(b)): creating your account, taking payment, delivering credentials, sending order and delivery email, handling support about an order.

Legal obligation (art. 6(1)(c)): tax, accounting, and responding to lawful requests.

Legitimate interests (art. 6(1)(f)): keeping the shop secure, preventing abuse, and (if enabled) privacy-respecting analytics without using the event to identify you. You may object to processing based on legitimate interests; we will stop unless we have compelling grounds or the data is still needed for a legal claim.

Stripe — payment. Their privacy notice applies to data you enter on Stripe Checkout.

Hosting and database on our infrastructure in production (application and PostgreSQL). Email may be sent through the mail server on the same host.

We do not sell personal data. We share data with others only if a processor needs it to run the shop, if the law requires it, or if you ask us to.

Login details for the game accounts we sell are encrypted at rest (AES-256-GCM). Catalogue pages never include them. They are shown to you only after payment is confirmed, on the order/delivery page. We do not put those passwords in email or in analytics events.

We use a session cookie required to keep you signed in and to complete checkout. That cookie is necessary for the service.

The default analytics mode only writes internal logs with no email addresses or credentials. If we enable Plausible, it is configured without using it to identify you personally; we will only load that script when it is turned on in production.

Account data is kept while the account exists and for a reasonable period after closure if invoices or disputes remain.

Orders, payments, and deliveries are kept for as long as needed for statutory record-keeping (typically seven years for financial records in the Netherlands) and to handle refunds or chargebacks.

Support tickets are kept for as long as needed to finish the conversation and for a limited archive afterwards.

Security logs are kept only as long as useful for security and abuse prevention.

You may request access, rectification, erasure, restriction, objection, and data portability where the GDPR gives you those rights. You may also lodge a complaint with the Autoriteit Persoonsgegevens (https://www.autoriteitpersoonsgegevens.nl/).

To exercise rights, email [email protected] from the address on the account where possible, so we can verify the request.

If a processor stores data outside the EEA (for example a payment provider), they must do so under a valid transfer mechanism such as an adequacy decision or standard contractual clauses.

We may update this notice when the shop or the law changes. The date at the top is the current version. Material changes that affect how we use your data will be reflected here before they apply to new processing.