How PLO handles account and website data.
This policy describes the personal information used to operate accounts, security, downloads and staff-controlled services.
1. Controller and contact
The PLO project operator acts as controller for personal information processed through PLO-operated website and account services. Privacy and data-protection enquiries may be sent to legal@pokemonlegacyonline.com. Before broad public launch, operator identity/contact particulars should be reviewed for any additional disclosure required by applicable law.
2. Information you provide
Depending on the service, PLO may process account username, email address, character name, password-derived authentication data, support communications, policy acceptances and information you voluntarily provide to staff. Passwords should be stored as secure password hashes by the account backend; staff should never need your plaintext password.
3. Information collected automatically
PLO infrastructure may process IP address, timestamps, request paths, browser/device information, authentication events, security events, server/game connection data and similar technical logs needed to deliver and protect the service. PLO may also store account role, permissions, character identifiers and authoritative gameplay state linked to an account.
4. Why information is used
Information may be used to create and authenticate accounts, maintain sessions, provide game/download services, restore authoritative state, prevent fraud and abuse, enforce rules, investigate security incidents, provide support, maintain audit records, comply with legal obligations and improve reliability.
5. Legal bases
Where UK GDPR, EU GDPR or similar law applies, processing may rely on performance of the user agreement, legitimate interests in operating and securing the service, compliance with legal obligations, consent where specifically requested, or another lawful basis appropriate to the processing.
6. Cookies and local browser storage
The website uses strictly necessary authentication/session functionality to keep users signed in and protect account access. Optional analytics or marketing storage should not be enabled without an appropriate consent mechanism and an update to this policy.
7. Legal-policy acceptance records
The website may record account ID, username, acceptance timestamp, policy version and acceptance source when a user accepts the current policy suite or download acknowledgement. These records help demonstrate which version was accepted and support compliance/audit needs.
8. Staff access and moderation
Authorised staff may access account, moderation, security and gameplay information only to the extent needed for their role, support, rule enforcement, fraud/security investigation or recovery. Staff permissions should be limited and sensitive administrative activity should be auditable.
9. Sharing and processors
PLO may use hosting, infrastructure, email, security, payment or other service providers that process information on PLO's behalf. Personal information is not sold as a product to advertisers. Information may be disclosed where required by law, to protect users/services, or in connection with professional legal/security advice.
10. International transfers
Online infrastructure and service providers may process data in different countries. Where data-protection law requires safeguards for an international transfer, PLO should use an appropriate lawful transfer mechanism.
11. Retention
PLO retains personal information only for as long as reasonably necessary for the account/service purpose, security, dispute handling, audit, legal obligations and legitimate operational requirements. Different categories may require different retention periods. Deleted or banned account data may be retained where reasonably necessary to prevent abuse or meet legal obligations.
12. Security
PLO uses technical and organisational measures intended to protect account information, including password hashing, authenticated sessions, access controls, encrypted transport where deployed, audit logging and rate limiting. No internet service can guarantee absolute security.
13. Your rights
Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability, or objection to certain processing, and to withdraw consent where processing relies on consent. Some requests may be limited where retention is required for security, legal claims or other lawful reasons. You may also have a right to complain to your relevant data-protection authority.
14. Children and guardians
Users who are not legally able to agree to PLO's terms on their own must obtain any required parent or guardian permission. PLO should not knowingly collect more information from children than is necessary to operate the service and should implement any age/parental-consent mechanism required before a broad public launch.
15. Policy changes
Material privacy changes will be published and, where required, users will be notified or asked for renewed consent.