Privacy Policy

1. Data Controller

RustMates.com is operated by NamelyDigital, based in Spain. For any privacy-related inquiries, please contact us at contact@namelydigital.com or through our contact page.

2. Data We Collect

We collect only what running the site requires:

• Form submissions — When you send a ban appeal, staff application or contact form, we collect what you enter (Steam profile, Discord name, email and your answers). It is delivered to an internal Discord channel for handling.
• Technical checkout events — When you start a purchase we log the time, the package identifier, a coarse browser class (such as “chrome/desktop”) and the last eight characters of your Tebex basket identifier, so we can trace abandoned checkouts.
• Click counting, only with your consent — Which button was clicked, plus language, mobile or desktop, and the page path. No cookie, no identifier, no recognition between visits. Your IP is held only briefly in memory for rate limiting and is not stored.
• Server logs — As with any web server, our infrastructure provider Cloudflare necessarily processes your IP address and browser details to serve the page and block attacks.

3. Legal Basis for Processing (GDPR Article 6)

We process your data on these grounds:

• Consent (Art. 6(1)(a) GDPR) — For the optional click counting only. You can withdraw it at any time at the top of this page.
• Legitimate interest (Art. 6(1)(f) GDPR) — Handling your form enquiries, running the community, spam protection and secure operation of the site.
• Contract initiation and performance (Art. 6(1)(b) GDPR) — When you purchase through Tebex.
• Legal obligation (Art. 6(1)(c) GDPR) — Handling requests about your data subject rights.

4. International Data Transfers

NamelyDigital is based in Spain; our game servers are located in Germany. Data is additionally transferred to the following recipients outside the EEA: Cloudflare (United States) as host and for the Turnstile spam check, which receives your IP address; Discord (United States) for form submissions, data subject requests and technical error reports carrying a shortened IP address; and Tebex Limited (United Kingdom) for payment processing, which receives your IP address when the basket is created. Our database runs on Supabase; the location of the region in use is being confirmed and will be stated here. An adequacy decision of the European Commission covers the United Kingdom. For the transfers to the United States we rely on the recipients' certification under the EU-US Data Privacy Framework or on Standard Contractual Clauses; we are currently confirming which mechanism applies to each and will name it here.

5. Your Rights Under GDPR

As an EU/EEA resident, you have the following rights:

• Right of Access — Request a copy of your personal data.
• Right to Rectification — Request correction of inaccurate data.
• Right to Erasure — Request deletion of your personal data (“right to be forgotten”).
• Right to Restriction of Processing — Ask us to hold your data without processing it further, for instance while its accuracy is being checked.
• Right to Data Portability — Receive your data in a structured, machine-readable format.
• Right to Object — Object to processing based on legitimate interests.
• Right to Withdraw Consent — Withdraw consent at any time for consent-based processing.

To exercise these rights, please use our contact page or email us at contact@namelydigital.com. We will respond within 30 days as required by GDPR.

6. Cookie Policy

Our application sets exactly one cookie. In addition, our infrastructure provider Cloudflare sets a technically necessary cookie (__cf_bm) for bot defence when the page is loaded. Alongside that, we store up to five items locally in your browser. We use no advertising or tracking cookies.

• Language cookie (rustmates_lang): Remembers the display language you picked so the site does not switch back on your next visit. Lifetime one year. It is written only when you pick a language in the switcher — not on your first visit, and not from your browser setting.
• Local storage (not a cookie): Your click-counting choice is kept as a localStorage entry so we do not ask again. During a purchase the identifier of your Tebex basket additionally sits in sessionStorage and is discarded when the tab closes.
• Analytics cookies: There are none. The optional click counting works without a cookie and without an identifier; it merely sends an event to our server.
• Further local items: your chosen timezone for the wipe display, and during a purchase the identifier of your Tebex basket and the selected package. The latter two are discarded when the tab closes.

You can change your click-counting choice at any time at the top of this page. Cookies and local storage can also be cleared in your browser settings.

7. Third-Party Services

We use the following service providers. No other recipients receive your data; in particular, no Google services are embedded, no fonts are loaded from external servers, and no third party measures reach.

• Cloudflare — This site is delivered through Cloudflare's infrastructure. Every request necessarily passes through Cloudflare, which processes your IP address, the requested address and technical details of your browser in order to serve the page and block attacks. On our form pages we additionally use Cloudflare Turnstile as spam protection: a script is loaded from challenges.cloudflare.com and your IP address is sent to Cloudflare to check whether the submission came from a human. The legal basis is our legitimate interest in secure, abuse-free operation (Art. 6(1)(f) GDPR).
• Supabase — Our database runs on Supabase. It holds the site's content and technical event logs of the checkout process, plus the anonymous click counts if you have consented. The location of the database region in use is currently being confirmed and will be stated here once it is. The legal basis is our legitimate interest in a working service (Art. 6(1)(f) GDPR), and your consent for the click counts (Art. 6(1)(a) GDPR).
• Tebex Limited (United Kingdom) — All purchases are handled by Tebex as the contracting party (Merchant of Record); Tebex is independently responsible for payment processing, invoicing, support and refunds. When you start a purchase we create a basket for you at Tebex and transmit your IP address and the selected package identifier; Tebex needs the IP address for fraud prevention and tax attribution. Tebex's own privacy policy applies in addition. The legal basis is contract initiation and performance (Art. 6(1)(b) GDPR); an adequacy decision of the European Commission covers the United Kingdom.
• Discord — We run a community on Discord and use Discord webhooks as an inbox. When you submit a ban appeal, a staff application, a contact request or a data subject request, your entries are delivered to an internal, non-public Discord channel and handled there. On technical errors we additionally transmit a shortened IP address with the last block removed. Discord also processes data in the United States. The legal basis is our legitimate interest in handling your request and running our community (Art. 6(1)(f) GDPR).
• Steam Web API (Valve) — We additionally query the Steam Web API for technical details of our game servers, such as player count and map. This also happens exclusively from our server and without any data about you.

8. Data Retention

Form submissions are kept in our Discord server for community administration. In our database we store technical event logs of the checkout process (timestamp, package identifier, browser class and the last eight characters of the Tebex basket identifier) and, if you have consented, anonymous click counts without any identifier. Automatic deletion of these logs is not yet in place; we are working on it and delete on request in the meantime. You can request deletion of your data at any time.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (HTTPS), rate limiting, input validation, and secure third-party integrations. However, no internet transmission is 100% secure.

10. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

12. Supervisory Authority

As we are based in Spain, the Agencia Española de Protección de Datos (AEPD) is our lead supervisory authority; you can reach it at www.aepd.es. Independently of that, Art. 77 GDPR lets you also lodge a complaint with the supervisory authority where you habitually live or work.

13. Contact

For privacy inquiries or to exercise your rights, contact us at: contact@namelydigital.com or use our contact page.