Privacy Policy

01Data controller and contact

The data controller for the personal data described in this policy is HAIYUE INTERACTIVE, the publisher of Destan Game (the “Service Provider”). The data controller's name and the e-mail address for all your privacy questions and requests are given below.

Data controller

HAIYUE INTERACTIVE

Contact e-mail

haiyueinteractive@proton.me

This policy covers the Destan Game website and your web account. The game, the DESTAN ONLINE Launcher, the rankings, the Store and the Support Center are not open yet; the parts of this policy about those services apply once they open. The terms it uses are defined in the Terms of Use.

02What data is processed

Which data is processed depends on the parts of the Services you use. The categories below describe the records the system keeps.

Account details

Username, e-mail address and when it was verified, display name, preferred language, your communication preferences (including whether you agreed to news and offer e-mails), account status, and when you registered and last signed in.

Authentication data

An irreversible hash of your password made with Argon2id (your password itself is never stored), the two-step verification method you chose, whether you turned on new-device confirmation, the key needed to generate codes if you use an authenticator app (TOTP), which is stored encrypted, and hashes of your recovery codes and of one-time codes.

Session and device records

Your open sessions; a device name derived from your browser's identification string (user agent), e.g. “Chrome · Windows” (the string itself is not stored); IP address; when a device was first and last seen; whether it is marked as trusted. The full IP address is kept on the session record only while the session is open, for security and rate limiting, and is deleted when the session ends; everywhere else IP addresses are kept only in masked or irreversibly hashed form.

Account activity

The time, outcome, device and IP address of actions and security events such as sign-ins, failed sign-in attempts, new-device confirmations, account lockouts, password and e-mail changes, two-step verification settings and sign-outs. You can see these records under Account Activity, with the IP address masked.

Game data

Character name, class, level, experience percentage, guild, PK and death counts, and when the character was created and last played. This data comes from the game service; the website does not create or change characters. Because the game account integration is not open yet, this data is not processed at present.

Payment records

The Cash package chosen, amount and currency, any coupon used, the type of payment method, the order status, the Payment Service Provider's payment reference, the times of processing and of any refund, and any refund request with its reason and the decision on it. Because payments are not open yet, no payment records are kept at present.

Cash and Store records

The top-up, spending and refund entries that make up your Cash balance; your Store purchases, the character chosen for delivery and the delivery status; the codes you redeemed. Because the Store and purchases with real money are not open yet, no purchase, spending or refund records are kept at present.

Support conversations

Your support tickets and their categories, your messages, the files you attach (images, PDF or text), your live support conversations, the rating you give at the end of a conversation, and the internal notes the support team adds to your case. Because the Support Center and live support are not open yet, only the e-mails you send to the contact e-mail address and the replies to them are processed at present.

Notifications

The notifications sent to your account, whether they were read or hidden, and your notification preferences.

Account administration records

Changes that the Service Provider's staff make to your account's status, such as a suspension or lifting it, with the date and the reason they recorded, and the log of staff actions concerning your account.

Legal acceptance records

The name and version of the legal texts you accepted at registration, the time of acceptance and your language preference at registration.

E-mail delivery records

The type, time and delivery result of the transactional e-mails sent to your account. The recipient and content of an e-mail are kept encrypted until delivery is complete, and are deleted from the delivery record once delivery is complete.

Your password, verification codes and recovery codes are never stored in plain text. Once payments open, your card number, expiry date and security code will never reach the Service Provider's systems at any stage either: you will enter them only on the Payment Service Provider's page.

03Where the data comes from

• Directly from you: the registration form, account settings and the e-mails you send to the contact e-mail address; once the Support Center opens, support tickets and live support.
• From your use of the Services: sign-ins, sessions, devices and the actions you take on your account.
• From the game service, once the game account integration opens: characters, levels, guilds and ranking values.
• From the Payment Service Provider, once payments open: the result of a payment (confirmed, declined, refunded) and the payment reference.

04What the data is used for

• Creating your account, verifying your e-mail address and keeping you signed in.
• Recording the version of the legal texts you accepted and the time of acceptance.
• Protecting your account and preventing abuse: two-step verification, new-device confirmation, limits on sign-in attempts, detection of suspicious activity and security alerts.
• Once payments open: processing Cash purchases, crediting Cash once and to the right account, and settling refund requests.
• Once the Store opens: passing Store purchases to the game service and showing their delivery status.
• Once the rankings open: calculating and publishing the rankings.
• Answering your requests: the e-mails you send to the contact e-mail address and, once the Support Center opens, your support tickets and live support conversations.
• Applying the rules of the Services: reviewing reports of rule violations and appeals, and suspending accounts or lifting suspensions.
• Keeping a log of the actions staff take in the operator console, so that their access to accounts can be checked afterwards.
• Answering your requests about your data and fulfilling the legal obligations that the Service Provider must comply with.
• Sending the transactional e-mails of your account (the e-mail verification link, password reset, verification codes and security alerts); informing you about maintenance and significant changes; and, if you have agreed, sending news and offer e-mails.

The Services show no advertising, and your personal data is not used to build advertising profiles.

05Rankings and the Baron ranking

The rankings are not open yet, and no information about your account is published in any ranking at present. This section explains what will be published once the rankings open.

Once the rankings open, the Level, PK, Deaths and Guilds rankings on the Rankings page will be public. They show character and guild names and the values each ranking measures (level, class, PK or death count, guild score). Your username, e-mail address and other account details do not appear in any table.

The Baron ranking

The Baron ranking shows the players who added the most Cash in the selected period (monthly, seasonal or all time). It is calculated from the records of completed payments: refunded payments are deducted, and Cash that was granted, redeemed from a code or spent in the Store does not count. No form on the site can influence the ranking.

The Baron ranking publishes only the following:

• The rank and the ranking period.
• The name of your account's main character.
• The Baron title that goes with your rank.

Your e-mail address, username, account ID, payment method, card details and order or transaction numbers are never published in the Baron ranking. The amount of Cash added is not shown either: the ranking data contains no amount field at all.

06Who the data is shared with

Your personal data is not sold. It is shared only to the extent needed to provide the Services, and only with the following recipients:

• Hosting: the Services are hosted on a virtual server (VDS) in Turkey, provided by Eva Bilişim on behalf of the Service Provider.
• E-mail delivery: e-mail verification links, password resets, verification codes and security e-mails are sent on behalf of the Service Provider through Resend, a US-based service. For this, your e-mail address and the content of the e-mail are passed on to Resend. This is a transfer of data abroad made only to deliver the e-mails, and it is subject to the conditions that Law No. 6698 sets for transfers abroad.
• The Payment Service Provider, once payments open: when you buy Cash, the order reference and amount are passed on; you enter your payment details directly on the payment institution's page.
• The game service, once the Store opens: for the delivery of Store purchases, the purchase and the character it is to be delivered to are passed on.
• Competent authorities: only when there is a request that the Service Provider is obliged to comply with.

07Staff access to your data

Staff of the Service Provider work with player data in the operator console, an internal tool that is not open to players. Each staff member signs in with a personal staff account and works under a role, such as support, payments or content, which determines what they can see and do. Because the Support Center and payments are not open yet, what follows about support cases, internal notes and refunds applies once they open; account status changes and the log of staff actions already apply.

Support cases

To answer a support ticket or a live support conversation, the support team sees a short summary of your account: display name, username, account status, registration date, language, your characters' names, classes and levels, and your earlier support requests in the categories that team member handles. For a payment question, it also sees the reference numbers and statuses of your orders.

Internal notes

A support case can be passed on to another team member, and the team can add internal notes to it. Internal notes are not shown to you.

Payments and refunds

Staff with payment permissions can see your orders and decide on refund requests. The decision, and any internal note on it, is kept with the order, and you receive a notification of the outcome.

Account status

Staff with the necessary permission can suspend an account and lift a suspension. The reason they give is kept in the account's history and is not shown to you. A suspension ends every open session and deletes no data; once the game services open, it also removes the account's characters from the rankings, without touching the Cash balance or items.

Log of staff actions

Opening an account's record, viewing an account summary for a support case, refund decisions, status changes and the other actions taken in the operator console are logged together with the staff member and the time, so that staff access to accounts can be checked afterwards.

The operator console never shows your password, your verification codes, your authenticator key, your recovery codes or your card details, and it shows your e-mail address only in masked form.

08E-mail notifications

Transactional e-mails about your account (the e-mail verification link, password resets, verification codes and security alerts) are sent to your registered e-mail address on behalf of the Service Provider through the Resend service. These e-mails are needed for the account to work and to stay protected, and cannot be turned off.

News and offer e-mails are sent only if you have separately agreed to them. This permission is not a condition of membership and can be withdrawn at any time in Account Settings.

Your password never appears in e-mails. Verification links and codes can be used only once and expire after a short time.

09How the data is protected

On the Destan Game platform, the technical and organizational measures necessary for the security of your personal data are taken. The main measures are:

• Passwords are stored only as an irreversible hash made with Argon2id; authenticator app keys are stored encrypted.
• Session cookies are set so that page scripts cannot read them, and protection is in place against requests sent from other websites.
• Sign-in attempts, verification codes and sensitive actions are protected by request limits; after repeated failed attempts the account is locked temporarily.
• Sensitive actions such as changing your password require extra verification and are recorded in your account activity.
• Staff access to player data is limited by roles and logged.
• Once payments open, they are made on the Payment Service Provider's page; card details are never entered on this site.

No online service can guarantee complete security. We recommend using a unique password for your account and turning on two-step verification in the Security Center.

10Sharing of responsibilities

The data controller's obligations relating to the lawful processing and protection of personal data are fulfilled by Destan Game. Users, for their part, must take the necessary care for the security of their own accounts and devices. A user's responsibility for the security of their account does not remove the data controller's statutory obligations.

No provision of this policy may be interpreted as removing the Service Provider's responsibility for players' personal data. Your part in protecting your account is explained in the Account Security and Player Responsibilities document.

11Security incidents

When a security incident affecting your personal data is detected, the Service Provider investigates it, takes the measures needed to limit its effects, and makes the notifications required by law to the persons concerned and to the competent authority.

• The sessions of affected accounts may be ended, and their owners may be asked to change their passwords.
• Affected users are informed about the nature of the incident and the measures they can take.
• The incident and the measures taken are recorded.

What to do when you notice suspicious activity on your account is explained in the Account Security and Player Responsibilities document.

12How long data is kept

Data is kept for as long as the purpose for which it was collected requires. For some records, the lifetime follows from how the system works:

• One-time verification codes expire after a short time and can be used only once.
• Registrations whose e-mail address has not been verified are deleted after a short time.
• Sessions end on the server when they are not used or when their maximum lifetime is reached; however a session ends, the full IP address on its record is deleted at that moment.
• The lifetimes of the cookies in your browser are listed in a table in the Cookie Policy.

Account activity, your correspondence and, once payments open, payment and Cash records may be kept after your account is closed for as long as is necessary for legal obligations, disputes and fraud investigations.

13Your choices and requests

• You can change your display name, preferred language and communication preferences in Account Settings.
• You can choose under Notifications which notifications you receive on the site and by e-mail; security notifications cannot be turned off.
• You can see and end your open sessions and devices in the Security Center, and you can also turn on extra confirmation for sign-ins from a new device (new-device confirmation) there.
• You can see your account activity under Account Activity.

To get a copy of your data, ask for it to be corrected or deleted, or ask for your account to be closed, write to the e-mail address in the “Data controller and contact” section. These requests are not handled automatically by the site: the Service Provider completes your request after confirming that the account is yours.

The data protection law that applies where you live may give you further rights; you can exercise them in the same way.

Your rights under Article 11 of Law No. 6698 on the Protection of Personal Data (KVKK) and how to apply are explained in detail in the KVKK Information Notice.

14Closing your account

You can ask for your account to be closed at any time: you write from the e-mail address registered to your account to the e-mail address in the “Data controller and contact” section, and the Service Provider carries out the closure after confirming that the account is yours.

A closed account cannot be used to sign in, and its open sessions end. After closure, some records may be kept, as explained in the “How long data is kept” section, for as long as they are needed for legal obligations and disputes. The effects of closure on your account are explained in the User Agreement.

15Cookies

The site uses only the cookies it strictly needs to work; no analytics, advertising or third-party cookies are used. The full list of cookies, their purposes and their lifetimes is in the Cookie Policy.

The session cookie carries only a random session key and recognizes that you are signed in; the device cookie recognizes your browser as one of your account's devices; and the security cookie stops actions on your account from being sent on your behalf by another website.

16Changes to this policy

This policy is updated when the Services or the data processed change. The current text is published on this page with its version number and date; changes that extend the data processed or the purposes of use are also announced on the site.

17Contact

You can send privacy questions and requests to the e-mail address below.

Data controller

HAIYUE INTERACTIVE

Contact e-mail

haiyueinteractive@proton.me