Privacy Policy

1. Controller

Cayan Oyman
Ramsenerstrasse 43
78239 Rielasingen, Germany
Email: [email protected]

(Responsible party within the meaning of Art. 4(7) GDPR)

2. What we collect

When you register an account, we store:

• Email address — for account verification, login, and service-related communications
• Username — publicly visible display name
• Password — stored exclusively as a cryptographic hash; we never have access to your plaintext password

When you use the service, we additionally store:

• Watchlist entries and Price Alerts — the items, thresholds, and preferences you configure
• Session data — a session cookie to keep you logged in (see Section 6)

Our server automatically collects access logs containing your IP address, browser type, referring page, and timestamp. These logs are used solely for security and error diagnosis and are deleted after 14 days.

3. Purpose and legal basis

Data	Purpose	Legal basis (GDPR)
Email, username, password hash	Account creation and authentication	Art. 6(1)(b) — performance of contract
Watchlist, Price Alerts	Providing core service functionality	Art. 6(1)(b) — performance of contract
Session cookie	Maintaining your logged-in state	Art. 6(1)(b) — performance of contract
Server access logs	Security, abuse prevention, error diagnosis	Art. 6(1)(f) — legitimate interest
Email address	Service notifications (e.g. Price Alerts)	Art. 6(1)(b) — performance of contract

We do not use your data for profiling, automated decision-making, or advertising.

4. Third-party processors

We use the following services to operate Umbral Market. Each processes data on our behalf under a Data Processing Agreement (Art. 28 GDPR):

Cloudflare, Inc. (USA)
DNS, CDN, and DDoS protection. Cloudflare may process your IP address and request metadata when you access our site. Transfer to the USA is covered by Cloudflare’s participation in the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
Cloudflare Privacy Policy

Resend, Inc. (USA)
Transactional email delivery (account verification, Price Alert notifications). Your email address is shared with Resend solely for the purpose of delivering these messages. Transfer to the USA is covered by Standard Contractual Clauses.
Resend Privacy Policy

Blizzard Entertainment (USA)
We retrieve publicly available auction house data through the official Blizzard API. No personal data from your Umbral Market account is transmitted to Blizzard.
Blizzard Privacy Policy

5. Data transfers outside the EU

Our server is located in Germany. However, Cloudflare and Resend are US-based companies. Transfers to the United States are safeguarded by:

• The EU-U.S. Data Privacy Framework (where applicable)
• Standard Contractual Clauses (Art. 46(2)(c) GDPR)

6. Cookies

Umbral Market uses a single session cookie to maintain your login state. This cookie is strictly necessary for the service to function and does not require consent under Art. 5(3) of the ePrivacy Directive.

We do not use analytics cookies, tracking cookies, or any third-party cookies.

7. Data retention

• Account data (email, username, password hash, Watchlist, Alerts) — retained as long as your account exists. Deleted within 30 days of account deletion.
• Server access logs — automatically deleted after 14 days.
• Session cookies — expire when you log out or after 30 days.

8. Your rights

Under the GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data / delete your account (Art. 17)
• Restrict processing (Art. 18)
• Data portability — receive your data in a machine-readable format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)

To exercise any of these rights, email us at [email protected].

You also have the right to lodge a complaint with a supervisory authority. The competent authority for Baden-Württemberg is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

9. Security

All data is transmitted over TLS encryption. Passwords are stored as cryptographic hashes. Access to our server infrastructure is restricted and protected by key-based authentication.

10. Children

Umbral Market is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised date. Continued use of the service after changes constitutes acceptance.