Privacy Policy
Last updated: July 12, 2026
Draft for review — this document is a template and requires review by qualified legal counsel before launch.
This Privacy Policy explains what personal data ADYTUS collects, why, who it is shared with, how long it is kept, and the rights you have over it. It applies to adytus.com and every service we provide through it (together, the “Service”).
1. Who is responsible (controller)
Atomance LTD operates the Service and is the controller of your personal data. Contact: privacy@adytus.com. Registered office: [ADDRESS — TBD BY COUNSEL]. [EU/UK REPRESENTATIVE IF REQUIRED — TBD]
2. What we collect, and where it comes from
| Category | Examples | Source |
|---|---|---|
| Account | Email, username, phone number, date of birth (18+ check), sign-in records | You, at registration and onboarding |
| Identity verification | Verification outcome, reference ID, and status. The underlying documents and liveness data are collected by our KYC provider (Sumsub) on our behalf; we receive the outcome, not your document images. | You, via the verification flow |
| Payments | Entry-fee and prize transactions: amounts, status, provider references. Card details go directly to our payment providers (Coinflow-powered checkout); we never receive or store full card numbers. | You + payment providers |
| Gameplay | Contest entries, committed positions, arguments, chat messages, scores, ranks, results, play-credit balances, watchlist, achievements, referral connections | Your activity on the Service |
| Preferences | Notification settings, timezone, theme, responsible-play limits | You, in Settings |
| Technical | IP address, device and browser data, timestamps, security and error logs | Collected automatically |
| Support | Messages you send us and our replies | You, via email |
We do not collect more than the Service needs, and we do not buy data about you from data brokers.
3. Why we use it (purposes and legal bases)
- Running the Service — operating rounds and contests, scoring, settlement, prize payment, watchlists, notifications, referrals. Basis: performing our contract with you.
- Eligibility and compliance — age checks, identity verification, sanctions screening, anti-money-laundering controls, location checks, tax reporting where required. Basis: legal obligation; where stricter than the law requires, legitimate interest in operating lawfully.
- Fair play — detecting multi-accounting, collusion, automation, and attempts to manipulate the Oracle. Basis: legitimate interest in the integrity of contests every entrant relies on.
- Safety and security — authentication, abuse prevention, debugging, incident response. Basis: legitimate interest; legal obligation for some security measures.
- Communications — service messages (always), and product news only if you opt in under Settings. Basis: contract for service messages; consent for marketing.
- Responsible play — enforcing the limits, cool-offs, and self-exclusions you set. Basis: performing our contract; legal obligation where applicable.
4. Automated decision-making and the Oracle
Contests are scored by an automated evaluator (the “Oracle”). It scores the arguments and choices you submit in the contest under a rubric fixed before the round; it does not use your personal profile, spending, or history — every entrant is scored on the same basis. Because it runs deterministically and is replayable, a score can be re-verified rather than taken on trust. If you believe a result is wrong, you can contest it under the Official Contest Rules and reach a human at support@adytus.com.
We also use automated checks in fair-play and compliance screening (for example, duplicate-account detection and sanctions-list matching). Where such a check would lead to a significant decision about you — such as withholding a payout — a human reviews it before it is final. [CONFIRM REVIEW WORKFLOW — TBD]
5. Who we share data with
We share personal data only with:
- Processors that run the Service for us — hosting and database (Supabase), identity verification (Sumsub), payments (Coinflow-powered providers), email delivery, and AI-inference infrastructure for the Oracle. Each is bound by contract to use the data only on our instructions. [FULL SUBPROCESSOR LIST — TBD]
- Authorities — where the law requires (for example, tax reporting on prizes, AML reporting, or a valid legal demand). Where notice to you is prohibited, we may be unable to tell you.
- Professional advisers — lawyers, auditors, and insurers under confidentiality.
- A successor— if we are involved in a merger, acquisition, or asset sale, under this policy’s protections.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. What other users can see
ADYTUS is a social game. Your username, your arguments and chat messages, and your contest results (rank and score) are visible to other users, and leaderboards show usernames. Your email, real name, balances, payments, and verification details are never public. Choose a username you are comfortable competing under.
7. International transfers
Our providers may process data in countries other than yours, including the United States. Where data protected by GDPR-style laws is transferred to such countries, we rely on recognised safeguards — adequacy decisions or standard contractual clauses with the relevant provider. [TRANSFER MECHANISM PER PROCESSOR — TBD BY COUNSEL]
8. How long we keep data (retention)
| Data | Kept for |
|---|---|
| Account and gameplay records | While your account exists, then deleted or anonymised within [PERIOD — TBD] |
| Financial records (entry fees, prizes, refunds) | The period required by tax and accounting law [PERIOD — TBD BY COUNSEL] |
| Identity-verification and AML records | The period required by AML law after the relationship ends [PERIOD — TBD BY COUNSEL] |
| Self-exclusion records | Kept even after account closure, so an exclusion cannot be evaded by re-registering |
| Security logs | [PERIOD — TBD], longer if part of an investigation |
| Chat and arguments in settled rounds | Retained as part of the round record; moderated content may be removed earlier |
9. Security
Traffic is encrypted in transit (TLS); passwords are stored only as hashes by our authentication provider; access to personal and financial data is restricted on a least-privilege basis and money records sit behind server-enforced access controls; two-factor authentication is available on every account. No system is perfectly secure — if a breach affects you, we will notify you and the relevant authority as the law requires. More detail: Security.
10. Your rights
Depending on where you live, you may have the right to:
- Access — get a copy of the personal data we hold about you;
- Correction — fix inaccurate or incomplete data;
- Deletion — ask us to delete data (subject to the retention duties above — for example, AML law may require keeping verification records);
- Portability — receive data you provided in a machine-readable format;
- Objection / restriction — object to or restrict processing based on legitimate interests;
- Withdraw consent — for anything based on consent (like marketing), at any time, without affecting prior processing;
- No discrimination — we will not penalise you for exercising rights.
To exercise any right, email privacy@adytus.com from your account email (or provide equivalent proof of identity — we must not hand your data to someone impersonating you). We respond within the statutory period for your jurisdiction.
11. US state privacy rights
Residents of California and other US states with comprehensive privacy laws have rights to know, access, correct, and delete personal information, and to opt out of “sale” or “sharing.” We do not sell or share personal information as those laws define it, and we do not use sensitive personal information beyond what those laws permit for providing the Service. Authorized agents may submit requests with proof of authorization. [STATE-SPECIFIC DISCLOSURES / METRICS — TBD BY COUNSEL]
12. Complaints
We would rather fix a problem than have you escalate it — write to privacy@adytus.com first. You also have the right to complain to your data-protection authority [LEAD SUPERVISORY AUTHORITY — TBD].
13. Children
The Service is strictly 18+. We do not knowingly collect data from anyone under 18, and the date-of-birth check at registration exists to prevent it. If you believe a minor has created an account, contact support@adytus.com and we will close the account and delete the data.
14. Cookies
We use strictly necessary cookies for sign-in and light device storage for preferences — and currently no analytics or advertising cookies at all. The full inventory lives in the Cookie Policy.
15. Marketing choices
Product news is off by default and only sent if you opt in under Settings. Service messages — entry confirmations, results, security notices, legally required notices — are part of operating your account and are sent regardless.
16. Changes to this policy
We may update this policy as the Service or the law changes. Material changes will be notified in-product or by email before they take effect; the date at the top always reflects the latest revision.
17. Contact
Privacy: privacy@adytus.com · Support: support@adytus.com · Legal: legal@adytus.com