Privacy

Data controller

The controller of your data is GALNIR (SASU), the site publisher, whose full details appear in the legal notice.

Contact for any question about your personal data: [email protected].

Data we collect

We collect your email address, your Discord handle if you provide one, your order history, and your League of Legends credentials when you send them for a boost.

These credentials are encrypted (AES-256-GCM) and read only by your booster for the duration of the service, then erased once the order ends.

We also keep the messages exchanged in your order's chat, the campaign parameters (utm) present in the page address at the time of your order, saved with the order to measure where our sales come from, without any cookie or tracker, and session cookies needed to keep you signed in.

Purposes

This data is used to process your order, let you track its progress, exchange messages with your booster, and measure where our visitors come from to improve our campaigns.

Legal bases

Processing your order, your League of Legends credentials and the chat messages is based on the performance of the contract between us (article 6.1.b GDPR).

Keeping orders and payments for accounting purposes is based on our legal obligations (article 6.1.c GDPR).

Site security and fraud prevention are based on our legitimate interest (article 6.1.f GDPR).

Saving the campaign parameters (utm) with your order is based on our legitimate interest (article 6.1.f GDPR), to measure where our sales come from.

Retention period

Your League of Legends credentials are erased as soon as the order ends. The credentials of an account bought from our catalogue remain viewable from your order page for 30 days after delivery, which happens at payment, then are erased from our servers.

Orders and payments are kept for ten years under our accounting obligations.

If you delete your account from "My account", your orders are kept but anonymized for accounting purposes.

Chat messages are kept for twelve months after the order ends, then deleted. If you delete your account, the text of your messages is erased right away.

Your rights

You have a right of access, rectification, erasure, objection and portability regarding your data. To exercise them, write to the contact shown in the "Data controller" section.

You can also delete your account at any time from "My account". This deletion is irreversible.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Subprocessors

We rely on the following providers to run the site: Supabase for data hosting, Vercel for site hosting, Resend for transactional emails, PayPal and Stripe for payment processing, and Cloudflare (Cloudflare Inc., United States) as the proxy and DNS in front of the site, which sees every request and your IP address.

Audience measurement

We measure site traffic with Vercel Web Analytics and Speed Insights, without cookies and without any persistent identifier. We only get aggregated statistics (pages viewed, country, device type, performance), which cannot be used to follow you from one visit to the next. For that reason, no consent banner is required for this measurement.

Ad measurement (Google Ads)

When we run Google ads, we use Google Ads to learn whether an ad led to an order. The data involved is the ad click identifier, the pages viewed on the site, and the order amount and number.

This processing is based on your consent (article 6.1.a GDPR and article 82 of the French Data Protection Act). A banner asks for it on your first visit, with two buttons of equal weight, "Accept" and "Decline". Google's script is only loaded once you accept: without your consent, no advertising cookie is set and no data is sent to Google.

Your choice is remembered for six months in a cookie named dl_consent, which contains nothing but that choice. You can change it or withdraw your consent at any time with the "Cookies" link in the footer. Cookies set by Google after you accept last for the period set by Google, described at policies.google.com/technologies/cookies.

The recipient of this data is Google Ireland Limited. As Google may process it in the United States, this transfer outside the European Union is covered by the European Commission's standard contractual clauses.

Customer reviews

If you submit a review, we collect the nickname you choose, your rating, the text of your review, your rank journey if you provide one, and the date of submission. For a review linked to an order, we also keep the link to that order. For a review submitted through an invitation, we keep the label of that invitation internally.

This data is used to publish your review on the site after moderation by Duo Leveling. The legal basis is your consent, given by submitting the review form.

Your nickname, rating, text, journey and the date, shown as a relative date, are published. Neither your email address nor your order number is ever published.

Your review is kept as long as it is published. You can ask for it to be removed or modified at [email protected], and it is then removed or modified within 30 days.

No review is published without a manual check. We never edit the substance of your review, and we hide it if it contains personal data or insults.

Transfers outside the European Union

Some of these providers (Vercel, Cloudflare, Resend, Stripe, PayPal, Google) may process data outside the European Union, notably in the United States. These transfers are covered by the safeguards provided by the GDPR: a European Commission adequacy decision or standard contractual clauses.