Il Mister · Legal
Privacy Policy
What personal data Il Mister handles, why, for how long, who else sees it and the rights you have under the GDPR.
On this page
1. Who is responsible for your data
The controller of your personal data is Veritor Group SRL, Trade Register no. J2026033628006, CUI 54746469, registered office in Bucharest, Romania. For any question about your data, write to . We have not appointed a data protection officer, as the law does not require one for our activity.
We collect as little as the Game needs. We do not ask for your real name, postal address or phone number, we show no advertising, and we do not sell or rent personal data.
2. What we process, and why
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address and password. The password is stored only as an Argon2id hash; we cannot read it. | Creating and securing your account, confirming your email, sending service messages about your account. | Contract (1)(b) |
| Acceptance of the Terms. The version you accepted and when. | Proof of the contract between us. | Contract (1)(b); legitimate interest (1)(f) |
| Manager name and game activity. Your clubs, tactics, transfers, results, crests and press articles. | Running the Game. Your manager name and the sporting record of your clubs are visible to other signed-in managers, because their competitions depend on them. | Contract (1)(b) |
| Messages and notes. Messages you exchange with other managers; your private notebook and bookmarks. | Delivering messages to the people you write to and keeping your notes for you. | Contract (1)(b) |
| Daily streak. The last day you opened the Game and how many days in a row you have done so. | Awarding the free VIP days of the daily streak. | Contract (1)(b) |
| Session records. IP address, browser type and the time of your last activity, for each device where you are signed in. | Keeping you signed in and protecting your account. | Contract (1)(b); legitimate interest in security (1)(f) |
| Security log. Registration, login, failed login (with the email that was tried), logout, email confirmation and account deletion, and the main actions taken from your account in the Game (for example saving a tactic or placing a bid), each with the IP address. | Detecting and investigating misuse, and defending legal claims. | Legitimate interest (1)(f) |
| Fair-play network history. When this check is switched on: the IP addresses from which a signed-in account uses the Game, in 15-minute intervals. | Detecting one person running several accounts to move value between clubs (Terms, Section 9). A match between accounts is only a signal; a person reviews it before any measure is taken. | Legitimate interest in fair competition (1)(f) |
| Technical logs. IP address, requested address and time, written by our servers. | Operating and securing the service, finding faults. | Legitimate interest (1)(f) |
| Launch waitlist. Your email, if you asked to be told when the Game opens. | Sending you that notice. | Consent (1)(a), which you can withdraw at any time |
Payments. VIP is not on sale yet, so we process no payment data. When sales open, payments will be handled by Stripe; we will receive the status of the payment, not your full card details, and this policy will be updated first.
Automated decisions. Match results are produced by the game engine and concern your club, not you. We take no decision with legal or similarly significant effect on you by automated means alone.
3. Who receives your data
Other managers see your manager name and the public record of your clubs, and the people you write to see your messages. Beyond that, your data is handled only by the providers we need to run the service, under contracts that bind them to our instructions:
| Provider | Role |
|---|---|
| Railway Corporation (USA) | Hosting of the application and the database. |
| Cloudflare, Inc. (USA) | Network delivery and protection of the site; storage of images attached to press articles. |
| Resend (USA) | Sending account emails, such as the confirmation link. |
| Stripe Payments Europe, Limited (Ireland) | Payments, from the day VIP sales open. Not in use today. |
We disclose data to public authorities only where the law obliges us to.
Transfers outside the EEA. Some of these providers are established in the United States. Where data is transferred there, it is protected by the EU–US Data Privacy Framework for certified providers, or by the standard contractual clauses approved by the European Commission.
4. How long we keep it
| Data | Kept for |
|---|---|
| Account (email, password hash, manager name) | Until you delete your account. |
| Daily streak count | Until you delete your account. |
| Session records | 30 days after your last activity on that device; removed at logout. |
| Fair-play network history | 90 days, then deleted automatically; deleted earlier if you delete your account. |
| Security log | 12 months, then deleted automatically. Entries about your account are kept for this period also after you delete it. |
| Launch waitlist | Until you withdraw your consent. |
When you delete your account (Account settings), your email, password and manager name are erased at once and replaced by an anonymous marker, your sessions are removed and your clubs return to computer management. What your clubs did stays in the history of the Game World (results, transfers, published press articles, crests), and messages you sent remain with the people who received them, no longer linked to a name. Your private notebook, club notes, bookmarks and notifications are erased at the same moment, together with the private notes, nicknames and portrait statements you kept on your players. Security log entries stay until their 12-month limit, linked to the anonymous marker; an entry for a failed login keeps the email that was typed.
5. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy;
- correct data that is wrong;
- erase your data — deleting your account does most of this at once;
- restrict processing or object to processing based on our legitimate interest, including the fair-play check;
- receive your data in a portable format;
- withdraw consent where processing is based on it.
Write to from the email of your account. We answer within one month, free of charge. You may also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority of the country where you live.
6. Security
Connections to the site are encrypted. Passwords are stored as Argon2id hashes. The session cookie holds a random token that scripts cannot read, and only its hash is stored on our side. Access to administration tools is limited to the operator, and every administrative view of personal data is itself recorded.
7. Age
The Game is for people aged 16 and over. We do not knowingly keep data of younger users; if you believe a younger person has registered, tell us and we will delete the account.
Version history
- v1.02 October 2026First version in force.