Privacy Notice — Mantum11
Version of 26/09/2026 · published at https://mantum11.com/en/privacy
This notice explains which personal data we collect when you create an account and play Mantum11, why we collect it, how long we keep it and what rights you have. It is written in accordance with Regulation (EU) 2016/679 (the "GDPR").
Mantum11 is currently in a closed testing phase: access is granted individually by the controller to people he has invited.
1. Data controller
The data controller is Antonio Papa, independent developer, whom you can contact at privacy@mantum11.com for any request concerning your data.
2. What data we collect and why
| Data | Why we collect it | Legal basis |
|---|---|---|
| Email address | To create and identify your account, let you log in and, in the future, send you service messages (for example password recovery). | Performance of a contract (Art. 6(1)(b) GDPR) |
| Password | To protect your account. We store it only as a hash: we cannot read or recover it. | Performance of a contract (Art. 6(1)(b) GDPR) |
| Game data — squads, decks, collection, credits, match history (result, opponent, moves) | To make the game work: online matches are refereed by our server, which must keep their state; the history lets you see your results and makes every match verifiable. | Performance of a contract (Art. 6(1)(b) GDPR) |
| Technical session data — access tokens, time of last contact, game version in use | To keep you logged in and recognise your device between requests. | Performance of a contract (Art. 6(1)(b) GDPR) |
| Game telemetry — abandoned matches, cancelled matches, response times, errors | To detect malfunctions and abuse (for example players who systematically abandon matches) and to improve the game. | Legitimate interest (Art. 6(1)(f) GDPR) |
| IP address and connection data | To limit the number of requests per user and protect the service from abuse; they also appear in the technical logs of the hosting infrastructure. | Legitimate interest (Art. 6(1)(f) GDPR) |
We do not collect payment data (there are no real-money purchases in this phase), location data, or special categories of data.
The "I have read the privacy notice" checkbox at registration documents that you have read this text and records its version; it is not a separate consent, because the processing listed above is necessary for the service or based on our legitimate interest.
3. Local storage and cookies
The game does not use profiling cookies or third-party tracking tools. To keep you logged in, it stores a session token in your browser (or in the application), strictly necessary for the service to work: you can delete it at any time by logging out ("Log out") or by clearing the site data in your browser.
4. Who processes data on our behalf
We use external providers that process data exclusively on our instructions, as data processors:
- Render Services, Inc. — hosting of the game server and database. Data is stored in Frankfurt, European Union.
- Cloudflare, Inc. — domain management and network protection.
- Brevo (Sendinblue SAS, France) — sending of service emails, once the service is activated.
We do not sell or transfer your data to third parties. We may disclose it to the competent authorities only where required by law.
5. How long we keep data
- Account and game data: as long as your account exists. You can request its deletion at any time (see §6); deletion becomes final after a 30-day suspension period.
- After deletion: email and password are removed immediately. Matches already played are anonymised, not deleted: they remain in your opponents' history and in the game statistics, but with no reference to you.
- Telemetry: kept in aggregated or anonymised form; data attributable to your account follows the life of the account.
- Technical infrastructure logs (IP, request times): kept by the hosting provider for the period set out in its terms, typically a few weeks.
6. Your rights
You have the right, at any time and free of charge, to:
- Access and export your data: from within the game, using the export function, you receive a complete copy in readable format of everything we hold about you.
- Delete your account and the associated personal data, from within the game. To protect you from accidental deletion, the account remains suspended for 30 days: during that period you only need to log in again to cancel the request; after 30 days the deletion is final and matches are anonymised as described in §5. If you purchased the game on an external platform (for example Steam), your purchase is not affected: you only lose the collection, credits and progress tied to the account.
- Rectify inaccurate data, by writing to the address in §1.
- Object to processing based on legitimate interest, or request its restriction, by writing to the address in §1.
- Lodge a complaint with the data protection supervisory authority of the EU member state where you live, if you believe the processing infringes the law.
We answer requests within thirty days.
7. Minimum age
Mantum11 is reserved for people aged 14 or over. We do not knowingly collect data from anyone below this age; if we become aware of an account created by someone younger, we will delete it.
8. Security
Passwords are stored exclusively as hashes using a dedicated algorithm. Communication between the game and the server takes place over an encrypted connection (HTTPS). Session tokens have a limited lifetime and are automatically rotated and revoked in case of anomalous use.
9. Changes to this notice
If this notice changes substantially, you will be asked to read it the next time you open the game. The version in force is always the one published at https://mantum11.com/en/privacy, with the date shown at the top. In case of discrepancies between the English and the Italian version, the Italian version prevails.