1. Introduction

Welcome to Ashes Trade Market (the "Service"), a community-driven trading platform for Ashes of Creation players. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what we collect, how we use it, your rights, and how to contact us.

This Policy is designed to comply with applicable laws including the EU/UK GDPR, California CCPA/CPRA, and Ukraine’s Law on Personal Data Protection.

2. Who We Are (Data Controller)

The data controller is the operator of Ashes Trade Market located in Ukraine. For any privacy questions or requests, email:

3. Information We Collect

4. How We Use Your Information

• Provide core features (accounts, listings, posts, messaging)
• Moderate content and protect users (anti-abuse, anti-fraud, security)
• Operate, maintain, and improve the Service (aggregated analytics)
• Communicate essential notices (verification, password reset, updates)
• Comply with legal obligations and enforce our Terms

GDPR legal bases: contractual necessity (running your account), legitimate interests (security, improvement), consent (optional cookies/emails), and legal obligation (compliance).

5. How We Share Information

We do not sell your personal information. We share data only:

• With service providers (hosting, email delivery, security) under confidentiality agreements
• For legal reasons (to comply with law, enforce Terms, protect users)
• With consent (e.g., optional integrations you enable)
• In business changes (transfer to a successor with equivalent safeguards)

If we introduce ads later, we will update this Policy, implement required consent/opt-out controls (GDPR/CCPA), and avoid sharing email/login with ad partners.

6. Cookies & Tracking

We use essential first-party cookies for login sessions and preferences. You can block cookies in your browser, but the Service may not work properly.

We do not currently use analytics or advertising cookies. If we add them, we’ll present a consent banner (where required) and provide controls to manage preferences, including “Do Not Sell/Share” options for California residents.

7. Data Location & International Transfers

The Service is operated from Ukraine; data is stored on servers in Ukraine. By using the Service, you consent to international transfer and processing in Ukraine.

Where we use third parties in other countries, we will apply appropriate safeguards (e.g., Standard Contractual Clauses) to protect your information.

8. Data Retention

• Account data — kept while your account is active; deleted/anonymized upon request
• Posts/listings — generally retained for community history; may remain attributed to “Deleted User” if you delete your account
• Logs — security logs typically retained ~90 days (longer if investigating abuse)
• Backups — encrypted backups retained for a limited rolling period (e.g., <=30 days)

9. Your Rights & Choices

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. You can also withdraw consent for optional processing at any time.

• EU/UK: GDPR rights apply. You may also lodge a complaint with your Data Protection Authority.
• California: CCPA/CPRA rights to know, delete, correct, and opt-out of “sale/sharing”. We do not sell data; if this changes, we will provide a “Do Not Sell/Share” control.
• Ukraine: Rights under the Law on Personal Data Protection (access, correction, deletion).

To exercise rights, contact aocmerchant@proton.me from the email tied to your account. We may need to verify your identity before processing your request.

10. Children’s Privacy

The Service is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided personal data, contact us and we will delete the account and associated data.

If commercial features are introduced, we may further restrict under-13 access or implement parental-consent mechanisms to comply with COPPA.

11. Security

• HTTPS encryption in transit
• Hashed passwords; least-privilege admin access
• Server hardening and updates; monitoring for abuse
• Breach response procedures and user/regulatory notifications where required

No system is 100% secure. Protect your account with a strong, unique password and don’t share it.

12. Third-Party Links

Our site may link to third-party sites/services. Their privacy practices are their own. Review their policies before providing them with personal data.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be posted here and may be announced on-site or via email. Continued use after the effective date means you accept the updated Policy.

14. Contact Us