Privacy notice

01Who is responsible

Agentyx, in the Netherlands, is responsible for the personal data processed in Dynasty Grounds. AGENTYX is a Dutch sole proprietorship registered with KVK number 42028156 and VAT ID NL005440933B89 at Sophialaan 7, 3344 HB Hendrik-Ido-Ambacht, the Netherlands. Our public telephone number is +31 6 49658225. Contact: rrojas@agentyxai.com. This address is monitored by a person.

02What we collect

• Account: email address, manager name (visible to other managers), password (stored only as a salted hash), preferred language, account status and role. When you create your account, we also record that you confirmed you are 18 or older, the versions of the terms and privacy policy you accepted, and when you accepted them.
• Sign-in and security: a session identifier stored in a cookie, the IP address and a hashed browser identifier linked to the session, session times, and a counter of failed sign-ins keyed on a hash of your email and IP address.
• Your game: your club, its name and the decisions you make (lineups, tactics, training, transfers). Your club and results are visible to other managers.
• Messages: messages you send to other managers, stored so the recipient can read them.
• Creative Studio: the product you choose, your written instructions (up to 600 characters), the images and animations created for you, and their review and activation history.
• Purchases: pack, amount, status and payment identifiers from Stripe. Card details are handled by Stripe; we do not receive or store them.
• Invitations: if someone was invited by email, that email address and the invitation status.
• Support: what you send us when you contact support.
• Technical logs: Sessions expire after 30 days and failed-sign-in counters after about 24 hours. Other operational records are kept only while needed to run the account, deliver the service, investigate security or establish legal claims, and are then deleted or anonymised.

We do not ask for ID documents. Managers cannot upload images or files.

03Why we use it and on what legal basis

• To create your account, run the game and deliver what you buy (performance of our contract with you).
• To keep accounts and the game secure, prevent abuse and limit repeated failed sign-ins (our legitimate interest in a safe service).
• To keep payment and tax records (legal obligation) and to handle refunds (contract and legal obligation).
• To answer support requests (contract, or our legitimate interest in helping you).
• We do not use your email address for news or marketing: registration has no option to sign up for those emails.

The legal bases listed above are the bases we currently rely on. Where we ask for consent, withdrawing it does not affect processing that was lawful before withdrawal. We use only the session cookie and local browser storage needed for sign-in, language and interface preferences. We do not use advertising trackers or third-party analytics.

04Who else receives data

• Stripe (payments and tax calculation): your account email and order details, including your manager id, when you start a purchase. Stripe processes the payment on our behalf and also acts on its own account to prevent fraud and meet its legal obligations. For customers in the EEA, the applicable Stripe contracting entities are Stripe Payments Europe, Limited and, where applicable, Stripe Technology Europe, Limited.
• Google (Gemini API) (image and animation generation): your Creative Studio instructions, your club name and colours, crest and kit images and portraits of the fictional in-game players involved. We use the paid Gemini API under our Google Cloud EMEA Limited account. Google processes prompts and outputs under its data-processing terms and may process them in countries where it or its subprocessors operate.
• Hosting provider that runs the game servers. The game is hosted by Hetzner Online GmbH on infrastructure in the European Economic Area.
• Email provider for account emails. Account email is delivered by Resend (Plus Five Five, Inc.). Resend primarily processes this data in the United States and uses contractual safeguards for EEA transfers.
• Agentyx’s own media computer: some images are produced on a computer operated by Agentyx; the jobs it receives contain club details and instructions, not your email or manager name.
• Discord (optional community): the game posts announcements and information about computer-controlled clubs’ players. It does not post your personal data. Discord’s own terms apply if you join.

We do not sell personal data and we do not use advertising trackers.

05International transfers

If a provider processes your data outside the European Economic Area, we will say which one and which safeguard applies. The game is hosted by Hetzner Online GmbH on infrastructure in the European Economic Area. We use the paid Gemini API under our Google Cloud EMEA Limited account. Google processes prompts and outputs under its data-processing terms and may process them in countries where it or its subprocessors operate.

06How long we keep it

• Database backups are made daily and deleted after 14 days. Routine database backups expire after 14 days. Release or incident backups are kept only while needed for recovery or an investigation and are reviewed for deletion within 30 days.
• Payment and tax records are kept for the period the law requires. We keep Dutch tax and payment administration for seven years, or longer only where a specific legal duty or active dispute requires it.
• Sessions, failed sign-in counters, server logs, invitations, messages and Creative Studio records. Sessions expire after 30 days and failed-sign-in counters after about 24 hours. Other operational records are kept only while needed to run the account, deliver the service, investigate security or establish legal claims, and are then deleted or anonymised.
• When you delete a creation, its files are removed; the record of the request and your written instructions are kept.

07Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time. Write to rrojas@agentyxai.com. A person monitors it. We may need to confirm the request comes from the account owner.

You can also complain to a data protection authority, such as the Autoriteit Persoonsgegevens in the Netherlands or the authority where you live, for example the AEPD in Spain.

08Deleting your account

You can ask us to delete your account at any time by writing to rrojas@agentyxai.com. A password-confirmed closure request disables public access, revokes sessions and tokens, and starts the final deletion and club-handback process. We aim to complete deletion or anonymisation within 30 days, except for records we must retain by law; routine backup copies expire within 14 days. Some records, such as payment records the law requires us to keep, stay for the legal period. We keep Dutch tax and payment administration for seven years, or longer only where a specific legal duty or active dispute requires it.

09Cookies and storage on your device

• dynasty_session: a necessary cookie that keeps you signed in (up to 30 days).
• Local storage in your browser for the game to work and remember your choices: a sign-in cache (including your manager name and email), your language, and interface preferences such as selected squad, help panels and guide progress.
• This website’s own storage and any analytics. We use only the session cookie and local browser storage needed for sign-in, language and interface preferences. We do not use advertising trackers or third-party analytics.

10Age

Dynasty Grounds is for people aged 18 and over. We do not knowingly create accounts for anyone under 18. We use an 18-or-over declaration and do not collect identity documents. If we receive credible information that an account belongs to a minor, we may pause it while we investigate and close it if the age requirement is not met.

11Security

Passwords are stored only as salted hashes, and the game is served over an encrypted connection. Links to verify your email and reset your password expire and can be used only once, and we limit repeated sign-in attempts.

12Changes

We will update this notice when our processing changes and show the new version date. Material changes will be announced before they apply.