Privacy Policy
This document is a template and must be reviewed by a qualified lawyer before launch.
Effective date: 24 October 2026
This Privacy Policy explains how PvPScout collects, uses, shares and protects personal data when you use pvpscout.com and related services (the "Service"). It also serves as our information notice under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), and covers the rights you have under the EU and UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the CPRA ("CCPA").
1. Who we are (data controller)
The data controller is:
- [ŞİRKET UNVANI / COMPANY NAME]
- Address: [ADRES / ADDRESS]
- Tax office and number: [VERGİ DAİRESİ VE NO / TAX ID]
- MERSIS no.: [MERSİS NO]
- Privacy and data protection requests: privacy@pvpscout.com
PvPScout is a directory. Listed game servers are run by independent third parties who are separate data controllers for any data they collect on their own sites, games, launchers or Discord servers. This policy does not cover them.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, username, password (stored hashed by our authentication provider), optional avatar and bio; if you use Google or Discord sign-in, the profile name, avatar and email address shared by that provider | You, Google, Discord |
| Content and activity | Votes, reviews, star ratings, reports, server listings you submit, XP, levels, badges, challenges, streaks, leaderboard positions | You, generated by the Service |
| Referral data | Who invited whom, and whether the invited user has cast a first vote | Generated by the Service |
| Technical data | IP address, device and browser type, operating system, language, pages viewed, timestamps, server and security logs | Your device, our providers |
| Payment metadata | Stripe customer ID, products purchased, subscription status, order and invoice history, billing country, and (where needed for invoicing) name and address | You, Stripe |
| Communications | Messages you send to our support, privacy, legal, ads or abuse addresses | You |
| Consent records | Your cookie and advertising consent choices | You |
We do not store your full card number or CVC. Card details are entered on Stripe's systems and processed by Stripe.
We do not intentionally collect special categories of personal data (such as health, religion or ethnic origin). Please do not include such information in reviews, bios or messages.
3. Why we use your data and our legal bases
| Purpose | KVKK basis (Art. 5) | GDPR basis (Art. 6) |
|---|---|---|
| Creating and managing your account, signing you in, showing your profile | Necessary for the establishment or performance of a contract | Performance of a contract |
| Recording votes, reviews, ratings, reports and listings, and operating rankings, XP, badges, challenges, leaderboards and referrals | Necessary for the performance of a contract | Performance of a contract |
| Processing payments, managing subscriptions and issuing invoices | Necessary for the performance of a contract; compliance with a legal obligation (tax law) | Performance of a contract; legal obligation |
| Detecting and preventing fraud, vote manipulation, multi-accounts, bots, spam and security incidents | Legitimate interests (provided they do not harm your fundamental rights); compliance with legal obligations | Legitimate interests |
| Moderating content, handling reports and rights-holder notices | Legitimate interests; compliance with legal obligations; establishment, exercise or defence of a right | Legitimate interests; legal obligation |
| Answering your questions and requests | Legitimate interests; performance of a contract | Legitimate interests; performance of a contract |
| Aggregate, privacy-friendly analytics to improve the Service | Legitimate interests | Legitimate interests |
| Showing personalised ads via Google AdSense, and setting non-essential cookies | Explicit consent | Consent |
| Sending marketing emails or newsletters | Explicit consent (and, in Turkey, commercial electronic message consent under Law No. 6563) | Consent |
| Publishing public listing information on our social media and Telegram channel | Performance of a contract (listing service); data made public by the data subject | Performance of a contract; legitimate interests |
| Keeping records required by law and responding to authorities | Compliance with a legal obligation; explicitly provided for by law | Legal obligation |
You can withdraw consent at any time (for example, through the cookie settings link on the site or by emailing privacy@pvpscout.com). Withdrawal does not affect processing carried out before it.
Under the KVKK, we collect personal data by automated means (through the website, forms, cookies and our providers' systems) and partly by non-automated means (for example, emails you send us).
4. What is public
Some information is public by design:
- your username, avatar, bio, level, badges and leaderboard position;
- your reviews and ratings, with your username;
- server listings and their content.
Votes are counted publicly as totals; we do not publish a list of who voted for which server. Please think before you post: public content can be seen, copied and indexed by search engines.
5. Who we share data with
We do not sell your personal data. We share it only as described below.
Service providers (data processors) who process data on our behalf under contract:
| Provider | Purpose |
|---|---|
| Vercel | Website hosting, content delivery network (CDN), privacy-friendly aggregate web analytics |
| Supabase | Database, file storage and user authentication |
| Stripe | Payment processing, subscription management, fraud prevention |
| Google sign-in (if you choose it); Google AdSense advertising | |
| Discord | Discord sign-in (if you choose it) |
Some of these providers, such as Stripe and Google, may also act as independent controllers for certain processing (for example, Stripe's fraud prevention or Google's advertising). Their own privacy policies apply to that processing.
Telegram and social media: when a server listing is published, we may post its public information (name, game, short description, link and image) to our public Telegram channel (t.me/pvpscout) and our social media accounts. We do not share players' personal data there.
Other recipients:
- public authorities, courts and law enforcement, where required by law or to protect rights and safety;
- professional advisers (lawyers, accountants, auditors) under confidentiality;
- a buyer or successor if PvPScout is involved in a merger, acquisition or sale of assets, who will be bound by this policy.
6. International transfers
Our providers operate servers and teams in several countries, including the United States and EU member states. This means your personal data may be transferred outside Turkey and outside the EEA or UK.
- Turkey (KVKK Art. 9, as amended in 2024): transfers abroad are made on the basis of an adequacy decision where one exists; otherwise, on the basis of appropriate safeguards such as standard contracts in the form published by the Personal Data Protection Board (and notified to the Board as required); or, for occasional transfers where these are not available, on the exceptional grounds set out in the law, including your explicit consent after being informed of the possible risks.
- EEA and UK (GDPR): transfers are based on adequacy decisions (such as the EU-US Data Privacy Framework, where the recipient is certified), the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or other safeguards permitted by law.
You can ask for more information about the safeguards we use by emailing privacy@pvpscout.com.
7. How long we keep data
| Data | Retention |
|---|---|
| Account data and profile | While your account is active. When you delete your account or ask us to, we delete or anonymise it within 30 days, unless we must keep some of it for a legal reason |
| Reviews, ratings, votes | While your account is active; on deletion, removed or anonymised (aggregate vote counts and statistics may remain in anonymous form) |
| Server listings | While the listing is active and for a reasonable period after removal to handle disputes and abuse |
| Technical and security logs | Short term, generally no longer than 90 days, unless needed to investigate a specific incident |
| Invoices and accounting records | 10 years, as required by the Turkish Tax Procedure Law (VUK) and related legislation |
| Records of abuse, bans and takedown notices | As long as necessary to enforce bans and handle legal claims, within statutory limitation periods |
| Consent records | For as long as the consent is valid and for a period afterwards to demonstrate compliance |
When retention periods end, data is deleted, destroyed or anonymised in line with our data retention and destruction practices.
8. Security
We use measures such as encrypted connections (HTTPS), hashed passwords, access controls, row-level security on our database, and limited staff access. No online service can be completely secure, so please use a strong, unique password and keep your login details safe. If a personal data breach occurs, we will notify the competent authority and affected users where the law requires.
9. Your rights under the KVKK (Turkey)
Under Article 11 of the KVKK, you have the right to:
- learn whether your personal data is processed;
- request information about the processing if it is;
- learn the purpose of processing and whether data is used in line with that purpose;
- know the third parties to whom your data is transferred, in Turkey or abroad;
- request correction of incomplete or inaccurate data;
- request deletion or destruction of your data under the conditions in Article 7 of the KVKK;
- request that corrections, deletions or destructions be notified to third parties to whom the data was transferred;
- object to a result against you that arises from analysis of your data exclusively through automated systems;
- claim compensation for damage caused by unlawful processing.
How to apply: you can send your request to us in writing or by another method determined by the Personal Data Protection Board, for example by email to privacy@pvpscout.com from the email address registered in our systems, or with a secure electronic signature, or by post to [ADRES / ADDRESS]. Please include your name, contact details, your username or account email, and a clear description of your request. We will respond as soon as possible and within 30 days at the latest, free of charge unless the request requires additional cost, in which case we may charge the fee set by the Board.
If your request is rejected, the answer is unsatisfactory or we do not respond in time, you can lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of our response, and in any case within 60 days of your application.
10. Your rights under the GDPR (EEA and UK)
If the GDPR applies to you, you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate data;
- erase your data ("right to be forgotten") in certain cases;
- restrict processing in certain cases;
- data portability for data you provided, where processing is based on consent or contract and carried out by automated means;
- object to processing based on legitimate interests, and to object at any time to direct marketing;
- withdraw consent at any time;
- lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work, or with the Information Commissioner's Office (ICO) in the UK.
To exercise your rights, email privacy@pvpscout.com. We will reply within one month, which can be extended by two further months for complex requests. We may ask you to verify your identity.
[If required: EU representative under Article 27 GDPR: [NAME AND ADDRESS]. UK representative: [NAME AND ADDRESS].]
11. Your rights under the CCPA (California)
If you are a California resident, you have the right to:
- know what personal information we collect, use and disclose, and to access it;
- request deletion of your personal information;
- correct inaccurate personal information;
- opt out of the "sale" or "sharing" of personal information;
- limit the use of sensitive personal information (we do not use sensitive personal information for purposes that would trigger this right);
- not be discriminated against for exercising your rights.
We do not sell personal information in exchange for money. Where personalised advertising cookies (for example, Google AdSense) may count as "sharing" for cross-context behavioural advertising under the CCPA, they are only enabled after you consent, and you can turn them off at any time in the cookie settings. We honour Global Privacy Control (GPC) signals as an opt-out where technically supported. Categories of personal information we collect are listed in section 2, sources in section 2, purposes in section 3 and recipients in section 5.
To make a request, email privacy@pvpscout.com. You may use an authorised agent. We will verify your request before acting on it.
12. Children
The Service is not intended for children under 13. In the EEA, users must be at least 16, or the lower age set by their country (not below 13), unless a parent or guardian has consented. Users under 18 need parental permission to make purchases. If you believe a child has given us personal data in breach of these rules, contact privacy@pvpscout.com and we will delete it.
13. Cookies
We use essential cookies, preference cookies and, only with your consent, advertising cookies. Details are in our Cookie Policy.
14. Automated decisions
We use automated tools to detect vote manipulation, bots, spam and abuse (for example, to block suspicious votes or flag accounts for review). These tools help us protect fair rankings. Decisions with significant effects, such as permanent bans, are reviewed by a person. You can contest any decision by contacting abuse@pvpscout.com.
15. Changes to this policy
We may update this policy. We will post the new version with a new effective date and, for significant changes, notify you on the site or by email.
16. Contact
Privacy requests: privacy@pvpscout.com Postal address: [ŞİRKET UNVANI / COMPANY NAME], [ADRES / ADDRESS]