Privacy Policy

Arcetis is operated by Arcetis LTD, a company registered in England and Wales under company number 17399569, with its registered office at Office 20428, 182-184 High Street North, East Ham, London, E6 2JA, United Kingdom("we", "us", "our").

We are the data controller for the personal data described in this policy. For any privacy question or request, contact us at arcetissupport@gmail.com.

This policy applies to the Arcetis website and services. It does not apply to third-party websites we link to, which have their own privacy policies.

Information you give us

• Account details: email address, username, and password (stored only as a secure hash).
• Google sign-in identifier, if you choose to sign in with Google. We receive your email address and basic profile information from Google; we never receive your Google password.
• Order delivery details you enter when buying a product, such as a game account ID, redemption email or platform username. Fields marked sensitive are encrypted at rest, and some are deleted automatically once your order has been processed.
• Email address if you place an order as a guest without registering.
• Content you submit for giveaways, sponsorship requests or task proofs, including any images you upload.
• Messages you send us through the contact page or by email.

Information collected automatically

• IP address. We record IP addresses to apply rate limits and to throttle repeated failed sign-in attempts. This protects accounts against brute-force and abuse.
• Activity data generated by using the service: referral relationships, giveaway entries, orders and their status.
• Analytics and performance data collected by Vercel Analytics and Vercel Speed Insights, including pages visited, referring page, approximate country, device type and page performance timings.
• Essential cookies and browser local storage, described in section 6.

We do not knowingly collect special category data (such as health, religion or biometric data), and you should not send it to us.

Under UK GDPR and EU GDPR we must have a lawful basis for each use of your data:

• To provide the service — creating your account, processing and delivering orders, operating giveaways and referrals. Basis: performance of a contract.
• To verify your email and secure your account — verification codes, password resets, two-factor codes for staff accounts. Basis: performance of a contract and legitimate interests in keeping accounts secure.
• To prevent fraud and abuse — rate limiting by IP, throttling failed logins, reviewing proof submissions, investigating manipulation of rewards. Basis: legitimate interests in protecting the platform and other users.
• To measure and improve the site — aggregate analytics and performance monitoring. Basis: legitimate interests in understanding and improving how the service performs.
• To meet legal obligations — keeping transaction records and responding to lawful requests. Basis: legal obligation.

Where we rely on legitimate interests, we have considered the impact on you and you have the right to object (see section 7).

We do not sell your personal data. We share it only with service providers who process it on our instructions, and only as needed to run Arcetis:

• MongoDB Atlas — database hosting, stores your account and order records.
• Vercel — website hosting, plus Vercel Analytics and Speed Insights.
• Cloudinary — storage and delivery of images you upload.
• Upstash — rate-limiting infrastructure, which processes IP-derived identifiers.
• Google — only if you choose Google sign-in.
• Our email provider — to send verification, password reset and order emails.

We may also disclose data where required by law, to enforce our Terms, or in connection with a sale or restructuring of our business.

Order fulfilment via Instagram. Our current process asks you to send your order code and a payment screenshot to our Instagram account. Anything you send there is also processed by Meta under its own privacy policy, and is outside our control. Do not send us more information than the order requires, and never send full payment card numbers.

We are based in the United Kingdom and serve users worldwide. Our service providers may store or process data outside the UK and the European Economic Area, including in the United States.

Where data is transferred outside the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, or on a finding of adequacy for the destination country. You can request details of these safeguards by emailing arcetissupport@gmail.com.

We use a small number of cookies and browser storage entries:

• Session cookies (arcetis_token, arcetis_backoffice_token, arcetis_backoffice_2fa) — strictly necessary to keep you signed in and to complete two-factor sign-in. These are HTTP-only.
• Local storage — remembers your language, currency and theme choice, and any guest orders placed on this device, so the site behaves as you expect.
• Analytics — Vercel Analytics and Speed Insights collect usage and performance measurements.

You can clear cookies and local storage in your browser settings, but the service will not work correctly without the strictly necessary cookies.

If you are in the UK or the European Economic Area, you have the right to: access a copy of your data; have inaccurate data corrected; have your data erased; restrict or object to processing; receive your data in a portable format; and withdraw consent where we rely on it. These rights also apply, in substance, to users elsewhere who contact us.

How to exercise them. Email arcetissupport@gmail.com from the address on your account, telling us what you want us to do. We respond within one month. We may ask you to confirm your identity before acting.

Account deletion. Deletion requests are currently handled by email at the address above. Some records must be kept after deletion where we have a legal obligation to retain them, for example transaction records for tax purposes.

If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA.

• Account data — while your account is open, and up to 12 months afterwards to handle disputes and prevent repeat abuse.
• Order and transaction records — 6 years, to meet UK tax and accounting requirements.
• Sensitive delivery details — deleted automatically once your order is processed, where the field is configured for that.
• Security records such as login throttling — a short period only, typically days.
• Verification and password reset codes — until they expire, usually within hours.

Passwords are stored as bcrypt hashes and never in readable form. Sensitive delivery fields are encrypted at rest. Sessions use HTTP-only cookies, staff accounts require a second factor, and requests are rate limited.

No online service can be completely secure. If we become aware of a breach affecting your rights we will notify the ICO, and you, where the law requires it.

Arcetis is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact arcetissupport@gmail.com and we will delete it.

We may update this policy. If a change materially affects your rights we will give notice on the site or by email before it takes effect. The "last updated" date at the top shows the current version.

Questions about this policy: arcetissupport@gmail.com. General support: arcetissupport@gmail.com.