Privacy policy

This policy explains what personal data HCIA.io handles, why, who it is shared with, how long it is kept, and your rights. It covers people who use HCIA.io, and players on the game servers that communities manage with it. HCIA.io is run by Sigilbase Ltd, trading as HCIA.

Who we are

• Run by: Sigilbase Ltd, trading as HCIA
• Company: registered in England and Wales, company number 17332548
• Registered office: 66 Paul Street, London, EC2A 4NA, United Kingdom
• Email: [email protected]

Two kinds of data

• About you, as someone who uses HCIA.io: your account, your sign-ins, what you do in communities, and your community’s payments. We decide how this is used: we are its controller.
• About players on a community’s game servers: what the community records through HCIA.io. The community decides what it records and why: it is the controller, and we process the data for it under our data processing terms. If you play on a server that uses HCIA.io, ask that community about your data first; we will help it answer you. If you can’t reach it, contact us.

Data about people who use HCIA.io

Your account

Your name, email address, password (stored hashed, so nobody can read it), two-factor secret and recovery codes (encrypted), time zone, and the communities and groups you belong to.

Why

To give you an account and sign you in (to perform our contract with you).

Kept

Until you delete your account.

Sign-ins

The IP address and browser of each signed-in session, and the time and IP address of your last sign-in.

Why

To keep accounts secure and spot misuse (our legitimate interests).

Kept

Sessions: 2 hours after you last use them. Your last sign-in: until the next one.

What you do in communities

The activity log: what you did in a community (a ban you issued, a setting you changed), with your name, IP address and browser; and the commands sent to game servers, with who sent them.

Why

So communities can see who did what, and so misuse can be looked into (the community’s and our legitimate interests).

Kept

Activity: 730 days. Commands: 365 days. Both for that long after you delete your account, too.

Payments

For a community’s plan: the amount, date, method and status of each payment, which member made it, and Stripe’s or NOWPayments’ references for it. We never see or store card numbers: Stripe handles them.

Why

To provide paid plans (our contract), and to keep accounts as tax law requires (a legal obligation).

Kept

While the community uses HCIA.io, and at least 6 years after the financial year they belong to.

WARDOGS pass-through keys

The IP address that last used each key.

Why

So the community can spot a key being misused (legitimate interests).

Kept

Until the key is deleted.

Emails you send us

What you write, and your email address.

Why

To answer you (legitimate interests).

Kept

As long as needed to deal with them, and no more than 2 years.

Visits

Visits to the home page, the sign-in and sign-up pages, and communities’ public statistics, counted by Umami without cookies. It does not store your IP address or anything that identifies you; we see only totals (pages viewed, the sites visitors came from, countries, browsers and devices).

Why

To learn how people find and use HCIA.io (legitimate interests).

Kept

Totals only.

HCIA.io also counts how long its pages and background jobs take, per page and per community, to keep it running well. Those figures are not about people.

Data communities record about players

When a community adds a game server to HCIA.io, HCIA.io records, for that community, what the game server reports and what the community does:

• The names players use in the game, and their game and platform IDs (SteamIDs, Epic, Xbox or PlayStation IDs, and BattlEye GUIDs on Arma).
• When they join and leave each server, and how long they play.
• Chat messages, and what happens in the game: kills (with weapon and distance), team changes, matches and scores.
• Moderation: warnings, kicks and bans with their reasons, watchlist entries, VIP status, and notes admins write about players.
• From Steam, for players with a SteamID: their public profile name and picture, and whether their account has VAC or game bans.
• IP addresses only when an admin bans a player from an Arma 3 server by IP address. HCIA.io does not otherwise keep players’ IP addresses.

If a community turns on public statistics, its players’ names, playtime, kills, matches and leaderboard places are public on the web. Notes, bans, kicks and what moderators did are never public.

Who we share it with

We don’t sell personal data, and we don’t use it for advertising. We share it only with the companies that help us run HCIA.io, each bound to protect it, and when the law requires it:

• Our hosting provider: runs the servers HCIA.io is on, in the United Kingdom.
• Google Workspace: sends the emails HCIA.io sends, such as password resets.
• NOWPayments: takes crypto payments. It receives each invoice: the amount, and the community’s name and plan.
• Valve (Steam): receives players’ SteamIDs, to look up their public Steam profiles and ban status.
• Umami: counts visits, as described above.
• Where a community sends data: webhooks (to Discord, for example) and the tools a community connects through the WARDOGS pass-through receive what the community sets them up to receive. The community chooses them and is responsible for them.
• Authorities: when the law requires it, or to protect someone’s safety or our rights.

Where it is kept

HCIA.io’s servers are in the United Kingdom. Some of the companies above handle data in other countries (Stripe and Valve in the United States, for example). Where they do, the transfer is protected as UK data protection law requires: by UK adequacy regulations, or by the UK’s International Data Transfer Agreement or Addendum.

Cookies and browser storage

These are needed for HCIA.io to work, or remember a choice you made, so we don’t ask for consent to them. HCIA.io uses no advertising or tracking cookies, and its visitor counting uses none.

Security

• HCIA.io is served over HTTPS. Account passwords are hashed; RCON passwords and two-factor secrets are encrypted.
• Every page and background job is limited to its own community’s data, and within a community to what the member’s groups allow.
• Data is backed up. What is deleted goes from HCIA.io straight away, and from backups within 30 days.
• No system is perfectly secure. If a breach puts you at risk, we will tell you, and the Information Commissioner’s Office as the law requires.

Your rights

Under UK data protection law you can ask us for a copy of your personal data, and to correct it, delete it, restrict or object to how we use it, or give it to you in a form you can take elsewhere. You can delete your own account under Settings → Profile; your name then stays in communities’ activity logs only until those entries expire (730 days).

To use your rights, write to [email protected]. We reply within a month. If you play on a community’s servers, ask that community first, as it decides what is recorded about you; we will help it, and you can contact us if it doesn’t respond.

If you are unhappy with how your data is handled, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.

Children

HCIA.io is not for children under 13, and we don’t knowingly give them accounts. If you think a child under 13 has an account, tell us and we will delete it. Games set their own age limits; communities should take extra care with data about young players.

Changes to this policy

We may update this policy; the date at the top says when it last changed. If a change matters, we will tell account holders by email or on HCIA.io before it applies.

Questions about privacy: [email protected].