Privacy Policy
Effective date: July 18, 2026
Welcome to Beyond the Black Sea (the “Platform”), the official website and community for the game Tales of Zar’Grim (the “Game”), operated by Epiphany Entertainment Limited, 736 Makara Road, Makara, Karori, New Zealand (“we,” “us,” “our”). This policy explains what we collect, why, who we share it with, and the rights you have over your data. If anything’s unclear, email privacy@beyondtheblacksea.com.
1. Who this applies to
This policy covers development.beyondtheblacksea.com and related services. The Platform is login-gated: you must sign in to access most of it. By creating an account, you agree to this policy.
2. Information we collect
Account & identity (when you sign in or link a provider):
- The OAuth provider you used (Google, Discord, or Steam) and your provider account ID.
- Your email address (from Google/Discord; verified emails are treated as verified).
- A display name and, where available, your provider avatar/username.
- Your Discord user ID (to grant community roles) and Steam ID (to deliver game keys), if linked.
Purchases: order records — item, amount, currency, and status. We do not collect or store your card or banking details; payments are processed by Xsolla (see §4).
Activity: your Renown points, referrals, titles, and reward grants; server-rental subscriptions; game-key claims; any content you submit; and your account role/approval status.
Technical data: essential session cookies, and standard server logs (IP address, browser type, timestamps) generated automatically for security and reliability. We do not use third-party advertising trackers or sell your data.
3. How we use your information
- To authenticate you and keep one secure account across multiple sign-in methods.
- To fulfil purchases — deliver pre-orders, Steam keys, and server rentals.
- To run Renown — calculate points, referrals, titles, and deliver Discord roles.
- To communicate essential service emails (via Resend).
- To operate, secure, and improve the Platform, prevent fraud/abuse, and comply with law.
4. Who we share it with
We share the minimum necessary with service providers who help run the Platform:
| Provider | Purpose | Data shared |
|---|---|---|
| Google / Discord / Steam | Sign-in (OAuth / OpenID) | Auth handshake; we receive your provider ID + (Google/Discord) email |
| Xsolla | Payment processing (merchant of record) | Purchase + billing data you enter with them; we receive order status, not card data |
| Nitrado | Player-hosted game servers | Data needed to provision / manage a server you rent |
| Discord | Community roles (bot) | Your Discord user ID, to assign a Renown role |
| DigitalOcean | Hosting, database, file storage | All Platform data, at rest |
| Resend | Transactional email | Your email + message content |
| Mod.io | Mod features (where used) | Data needed for mod functionality |
We may also disclose information if required by law or to protect the rights, safety, and security of our users or the Platform. If we’re ever part of a merger or asset sale, data may transfer to the successor under this policy.
5. Cookies
We use strictly necessary cookies for login sessions, security, and preferences. We do not use advertising or cross-site tracking cookies. Because they’re essential to a gated service, blocking them prevents sign-in.
6. Data retention
We keep your account data while your account is active. Order and transaction records are retained as long as needed for legal, tax, and accounting obligations. When you delete your account, we remove or anonymize your personal data within a reasonable period, except records we must retain by law or to resolve disputes.
7. Security
We use encryption in transit (HTTPS), access controls, and reputable infrastructure providers, and we never store payment card details. No system is perfectly secure, but we take reasonable, industry-standard measures to protect your data.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict the use of your data, and to object to certain processing or withdraw consent.
- New Zealand (Privacy Act 2020): you may access and correct your data and complain to the Office of the Privacy Commissioner (OPC).
- EU/UK (GDPR): our legal bases are performance of a contract, legitimate interests, consent (where asked), and legal obligation. You may complain to your local data protection authority.
- California (CCPA/CPRA): you may request access/deletion with no discrimination for doing so. We do not sell or “share” personal information as those terms are defined.
To exercise any right, email privacy@beyondtheblacksea.com. We’ll verify your request and respond within the timeframe required by applicable law.
9. International transfers
We’re operated from New Zealand and use providers in various countries. Where data crosses borders, we rely on appropriate safeguards where required.
10. Children
The Platform is intended for users 13 and older. Users under 18 must have verifiable parental or guardian consent to create an account or make purchases. We do not knowingly collect data from children under 13; if we learn we have, we will delete it. Parents/guardians may contact us to review or delete a minor’s data.
11. Changes
We may update this policy as the Platform evolves. Material changes will be posted here with a new effective date and, where appropriate, notified by email.
12. Contact
Epiphany Entertainment Limited — 736 Makara Road, Makara, Karori, New Zealand. Questions or requests: privacy@beyondtheblacksea.com.