Privacy Policy

1. Information You Provide

We collect the following directly from you when you create an account, subscribe, or contact us.

• Account details such as email address, display name, and authentication identifiers from Google sign in where used.
• Billing details such as plan selection, billing address, and the transaction reference returned by our payment processor.
• Support and application content you submit through tickets, waitlists, partner listings, or engineering requests.
• Customer Data your community uploads, including rosters, incident records, configuration, and broadcast media.

2. Information Collected Automatically

When you use the Services we record technical information needed for security, reliability, and abuse prevention. This includes IP address, browser and device type, timestamps, pages requested, and error diagnostics. Administrative actions inside a portal are written to an append only audit trail so community leadership can review who changed what.

3. How We Use Your Information

We process personal data for the following purposes and no others.

• Providing, maintaining, and supporting the Services you or your community subscribe to.
• Processing payments, renewals, refunds, and tax calculation through our payment processor.
• Securing accounts, detecting fraud or abuse, and investigating incidents.
• Sending service communications such as receipts, renewal notices, security alerts, and material policy changes.
• Improving product reliability and performance using aggregated, non identifying usage patterns.

4. Legal Bases For Processing

Where data protection law such as the GDPR applies, we rely on contractual necessity to deliver the Services you purchased, legitimate interests to secure and improve the platform, legal obligation to retain financial records, and consent where required for optional marketing. Consent may be withdrawn at any time without affecting processing already carried out.

5. Payments And Card Data

Card, wallet, and Cash App payment details are captured directly by Square and are never transmitted to or stored on Elysian servers. We retain only a payment reference, the last known status, the amount, and the saved payment method identifier needed to process renewals you have authorised.

6. Sharing And Sub Processors

We do not sell personal data or share it for advertising. We share only what is necessary with vetted providers acting on our instructions.

• Square for payment processing, saved payment methods, and renewals.
• Our cloud database and hosting providers for application hosting, storage, and backups.
• Discord where you choose to link an account, submit a ticket, or receive automated notifications.
• Legal or regulatory authorities where we are required by valid legal process to disclose information.

7. Roleplay Records And Real World Data

Elysian products store in character roleplay records. Communities must not upload real world identity documents, real criminal records, medical records, or other sensitive personal information about third parties. Community administrators are responsible for the content their members submit and act as controllers of that data within their own portal.

8. Data Retention

Account and Customer Data are retained while the subscription is active. Cancelled portals retain setup and roster data for sixty days so the community can return or export, after which the workspace may be permanently deleted.

Financial records are retained for the period required by applicable tax and accounting law. Security logs and audit trails are retained for a limited operational window and then rotated. Broadcast media follows the retention filter configured on your plan, with a default of thirty days.

9. Security

The platform runs on a hardened database with row level security applied to every table holding customer records, so a signed in account can reach only the rows it owns. Privileged operations run server side behind role checks, administrative actions are written to tamper resistant audit trails, and secrets are stored encrypted and never exposed to the browser.

No system is perfectly secure. If a breach affecting your personal data occurs we will notify affected customers and, where required, the relevant supervisory authority without undue delay.

10. Your Rights

Subject to your jurisdiction, you may request the following.

• Access to the personal data we hold about you and a copy in a portable format.
• Correction of inaccurate or incomplete information.
• Deletion of your account and associated personal data, subject to records we must keep by law.
• Restriction of or objection to certain processing, including withdrawal of consent.
• To lodge a complaint with your local data protection authority.

11. Children

The Services are not directed to children under 13, and accounts may not be created by them. Where a community permits younger members under local law, the community administrator is responsible for obtaining any required parental consent. If we learn we hold data from a child under 13 without a lawful basis we will delete it.

12. International Transfers And Cookies

Our infrastructure and providers may process data in jurisdictions other than your own, including the United States. Where required, transfers rely on approved safeguards such as standard contractual clauses.

We use only essential cookies and browser storage needed to keep you signed in, protect the session, and remember interface preferences. We do not run third party advertising or cross site tracking cookies.

13. Changes And Contact

We update this policy when our practices or legal obligations change, and the revision date at the top always reflects the current version. Privacy requests may be submitted through the official Elysian Discord support channel and are actioned within thirty days.