Privacy Policy — Pokémon MMO 3D
Last updated: July 12, 2026
This Privacy Policy is the document referred to as the "Privacy Policy" in the EULA (definition 1(t) and Sections 16, 20 and 21). It accompanies the End User License Agreement (EULA) and applies to the personal data processed in connection with the Game and its launcher.
1. Who is responsible for your data (data controller)
The data controller responsible for the processing of your personal data in connection with the game Pokémon MMO 3D (the "Game") is:
Samuel Guizani, natural person operating the Game as an unofficial, non-commercial fan project (France). This is the same identity as in Section 19 of the EULA.
Contact for any privacy question or to exercise your rights: pokemonmmo3d@gmail.com
Note. Pokémon MMO 3D is an unofficial, non-commercial fan project. It is not affiliated with, sponsored by or endorsed by Nintendo, Game Freak, Creatures Inc. or The Pokémon Company.
We have not appointed a Data Protection Officer. For any privacy matter, including the exercise of your rights, use the contact address above.
2. What data we process, why, and on what legal basis
We only process the data we need to run the Game and keep it fair and secure. The table below sets out, for each category, the purpose and the legal basis under Article 6 GDPR.
| Data | Examples | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|---|
| Account data | login/username, password (stored hashed), e-mail address (if collected) | create and manage your Account, authenticate you, support | Performance of the contract (the EULA) — Art. 6(1)(b) |
| Character & gameplay data | Character IDs, progression, in-Game Items, Teams | provide the Game and its features | Performance of the contract — Art. 6(1)(b) |
| Communications | messages on Message Boards, chat, reports | enable social features; handle reports and moderation | Contract — Art. 6(1)(b); legitimate interest in a safe community — Art. 6(1)(f) |
| Technical & connection data | IP address, device/session logs, timestamps | operate and secure the service, prevent abuse, diagnose issues | Legitimate interest in security and stability — Art. 6(1)(f) |
| Anti-Cheat Information | names of running processes/applications, process identifiers, and (optionally) the executable path — see EULA Section 6 | detect and investigate cheating following a report; collected only on a one-off, on-demand basis during an investigation | Legitimate interest in preventing cheating/fraud and ensuring fair play — Art. 6(1)(f) |
| Sanctions / moderation data | mutes, bans, violation records | enforce the Rules of Conduct; handle appeals | Legitimate interest — Art. 6(1)(f); legal obligation where applicable — Art. 6(1)(c) |
| Payment & transaction data | purchase history, amounts, billing details (card payments are handled by our payment provider — we do not store full card numbers) | process and record purchases of paid content; comply with accounting and tax obligations | Performance of the contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
Anti-Cheat Information — what we do NOT collect. We do not collect the content of your files, documents, keystrokes, screenshots or browsing activity. Anti-Cheat Information is accessed only by authorised administrators/moderators, is used only for the anti-cheat purpose above, and is never sold or used for advertising.
No advertising / no sale. We do not sell your personal data and do not use it for behavioural advertising.
Is providing your data required? Providing account and authentication data is necessary to create and use an Account; if you do not provide it, we cannot give you access to the Game. The other data listed above is processed as part of operating the Game as described in this policy.
Where your data comes from. Most of the personal data we hold is collected directly from you (when you create an Account, play the Game, or communicate in the Game). Some data about you is obtained from other people — in particular the content of reports submitted by other players about your Account (for example a cheating or misconduct report), and the moderation and sanction records our moderators/administrators create about you. We disclose this source to you in accordance with Article 14 GDPR.
Where we ever rely on your consent (Art. 6(1)(a)) — for example an optional feature — we tell you at the point of collection and you can withdraw it at any time.
3. Who has access to your data (recipients)
- Authorised members of the development team and moderators/administrators, on a need-to-know basis.
- Our technical service providers acting as processors under Article 28 GDPR, bound by
a data-processing agreement:
- Scaleway SAS (France) — game servers, APIs and databases;
- OVHcloud (France) — distribution of the launcher and game files;
- Vercel Inc. — hosting of the public website;
- Cloudflare, Inc. — DNS and network proxy services.
- Our payment service providers, which process your payment to complete a purchase of paid content: Stripe (purchases made on the website) and PayPal (purchases made in the Game).
- Public authorities where we are legally required to disclose.
We do not otherwise share your data with third parties.
4. International transfers
The game servers, APIs and databases are hosted in France (Scaleway), and the launcher files are distributed from Paris, France (OVHcloud) — both within the European Economic Area (EEA).
Some providers may process limited data outside the EEA: the public website is served by Vercel and proxied by Cloudflare, and payments are processed by Stripe and PayPal (United States). Where personal data is transferred outside the EEA, we rely on an appropriate safeguard under Chapter V GDPR — the European Commission's Standard Contractual Clauses and/or the provider's certification under the EU-U.S. Data Privacy Framework — or an adequacy decision.
5. How long we keep your data (retention)
We keep personal data only as long as necessary for the purposes above:
- Account & gameplay data: for the life of the Account, then deleted or anonymised within 12 months after account closure.
- Technical/connection logs: 12 months.
- Anti-Cheat Information: only for the duration of the relevant investigation and any resulting sanction or appeal, then deleted.
- Sanctions/moderation records: 3 years, as needed to enforce repeat-offence rules and handle appeals.
- Invoicing & accounting records: 10 years, as required by French accounting and tax law (this legal obligation overrides shorter retention for that specific data).
6. Your rights
To the extent applicable data protection law applies, you have the right to:
- access your data and obtain a copy;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict or object to processing based on legitimate interest (including the anti-cheat and moderation processing — note we may continue where we have compelling legitimate grounds, e.g. fraud/cheat prevention);
- data portability for data you provided, where applicable;
- withdraw consent at any time where processing is based on consent.
To exercise any right, contact us at the address in Section 1. We will respond within one month (extendable by two months for complex requests). You also have the right to lodge a complaint with your supervisory authority — in France, the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr.
Automated decisions. We do not take decisions producing legal or similarly significant effects on you (such as bans) solely by automated means; sanction and moderation decisions involve human review. If this ever changes, we will inform you, explain the logic involved, and tell you your rights.
7. Children
- The Game is not intended for children under 13, who may not create an Account. We do not knowingly collect personal data from anyone under 13; if we become aware that we have, we delete the Account and related data.
- Users aged 13–17 may use the Game only with the authorisation and consent of a parent or legal guardian, as set out in Section 9 of the EULA. In France, the digital age of consent is 15; below that age, processing based on consent requires the consent of the holder of parental responsibility.
- A parent/guardian may contact us at any time to review, or request deletion of, their child's data and to withdraw authorisation.
8. How we protect your data (security)
We use reasonable technical and organisational measures to protect your data (for example, passwords are stored hashed, access is restricted to authorised staff, and transport is secured). No system is perfectly secure; if a personal-data breach is likely to result in a risk to your rights, we will notify the CNIL and, where required, you, in accordance with Articles 33–34 GDPR.
9. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in the Game, the law, or our operations. Where a change is material, we will inform you by a durable means (for example within the Game or the launcher) before it takes effect, and update the "Last updated" date above.
10. Relationship with the EULA
This Privacy Policy forms part of, and should be read together with, the EULA. Defined terms (Account, Game, Character ID, Anti-Cheat Information, Rules of Conduct, etc.) have the meaning given in the EULA. If you need help exercising a right, use the Notice Contact in the EULA.