Skip to content

Privacy Policy

Last updated 2026-11-02

We collect only what running a marketplace needs, we never sell your data, and you stay in control of it.

Who we are

The data controller is the operator of HanseRoad. For anything about your data, write to support@hanseroad.com.

What we collect

AccountEmail address, username, password (stored only as a hash), Discord account id if you sign in with Discord.
Sessions and securityIP address and browser user agent of each session, sign-in and sign-up attempts, actions recorded in our audit log. Comparing addresses between accounts is how we detect multi-accounting.
TradingYour shops, stock, carts, offers, trades, ISO posts, messages, and the gold ledger of your account.
Who is on a shopWhile you look at a shop, your username is shown there to other visitors, for as long as you stay. It is not stored. Choose “Appear away” in your account menu and you only count as a guest.
Private messagesThe messages you exchange with other players. Our staff do not browse them. They see a message refused by our real-money filter, and a message reported by a player together with the few messages before it.
Meeting pointsThe game name and password, or Steam trade URL, you give for a trade. Only you and your trade partner see them.
PaymentsAmount, gold credited and Stripe payment identifiers, and the card fingerprint Stripe gives (a code that recognises the same card, never its number). Card details go to Stripe directly: we never see or store them.
PresenceWhen your browser was last active on the site, to show sellers as online (kept for a day at most), and the time of your last visit, kept on your account.
ProfileThe profile picture you choose to upload, and the stars, rank and badges computed from your purchases, trades and posts. The picture and the stars and rank are public; the amount of gold you bought is not.
Sign-up originThe country you signed up from, and the site or campaign link that brought you to HanseRoad on your first visit. Staff use it for statistics only.
ModerationWarnings, suspensions, bans and internal staff notes about your account, and the posts our real-money filter refused.

Why we use it

To provide the ServiceAccounts, shops, trades, escrow and payouts (performance of our contract with you).
To keep it safeRate limits, bot protection, fraud and scam prevention, dispute resolution (our legitimate interest).
To meet legal dutiesAccounting and payment records, answers to lawful requests (legal obligation).
To contact youAccount security and service notices. We send no marketing without your consent.

What is public

Your username, shops and their stock, ISO posts, topic messages and your trading record (completed trades, cancellation rate, delivery time) are public. Prices of negotiations, meeting points, your email and your balance are not.

Who we share it with

We never sell, rent or trade your personal data. We share it only with the providers that run the Service:

StripePayment processing for gold purchases.
Cloudflare (Turnstile)Bot protection on sign-up and sign-in; processes your IP address.
DiscordOnly if you choose to sign in with Discord.
ResendSends our emails, such as password reset links; processes your email address.
IPinfoTurns the IP address you sign up from into a country, when our network provider does not.
HostingOVH SAS, 2 rue Kellermann, 59100 Roubaix, France. Servers that store and run the Service.

Some providers may process data outside the European Union; they do so under the safeguards the GDPR requires (adequacy decisions or standard contractual clauses). We disclose data to authorities only when the law requires it.

How long we keep it

Account data is kept while your account is open, then deleted or anonymised within 30 days of its closure. Sessions expire after 30 days. The gold ledger, trades and payment records are kept as long as accounting and fraud-prevention duties require, after which they are anonymised. Security logs are kept up to 12 months.

Cookies and storage

We use three cookies. The session cookie keeps you signed in; it is strictly necessary. A browser cookie holds a random id, so we can see when several accounts use the same browser: it protects the marketplace against multi-accounting and fraud. A first-visit cookie remembers, for 30 days, the site or campaign link you came from, so we know which communities bring players; it is read once if you sign up and never shared. Your browser also stores a few preferences (last market, region, Steam trade URL) on your device; they never leave it unless you send them with an order. We use no advertising or tracking cookies.

Your rights

You can ask to access, correct, delete or export your data, to restrict or object to its use, by writing to support@hanseroad.com. We answer within one month. Some records (ledger, payments) must be kept for legal reasons even after deletion of your account. You can also complain to your data protection authority — in France, the CNIL (cnil.fr).

Children

The Service is open from 13. Where your country sets a higher age of digital consent, a parent or guardian must consent for you. If we learn we hold data of someone under the minimum age, we delete it.

Security

Passwords are hashed, traffic is encrypted, sessions use secure cookies, and access to data is limited to what each part of the Service needs. No system is perfectly secure: if a breach affects you, we will tell you as the law requires.

Changes

We publish any change on this page with its date, and tell you before material changes apply.