Privacy notice

Who is responsible for your data?

Lorn eSport is the data controller for the account information described here. To ask a question or exercise your rights, use our contact form.

What we collect and why

• Name and email address: required to create and manage your account, contact you about account or order matters, and link orders to your account.
• Phone number: required to create and manage your account and keep your contact details in your profile.
• Password: used to authenticate you. We store a salted password hash, not your readable password.
• Date of birth: optional. If you provide it, it is saved as profile information; it is not required to create an account.
• Authentication session: a random session token is placed in a strictly necessary cookie to keep you signed in. The server stores a hash of that token.
• Discord link: if you choose to link your account, we store your Discord user ID to synchronize your active Lornights membership role. We do not request or store your Discord password or bot credentials.
• Public membership thanks: if you opt in, we store the display name you choose and your consent preference. That name may be posted in the configured public Discord channel after Stripe confirms your membership payment. You can withdraw consent at any time by unticking the option in your account profile; this also clears the saved public display name.

Required fields are needed to create an account. If you do not provide them, you cannot register. The date of birth, Discord link, display name and public-thanks consent are optional.

Legal bases

We process account information, including a date of birth or Discord link you choose to add, to provide the account and membership services you request (performance of a contract, Article 6(1)(b) GDPR). Public membership thanks are based on your consent (Article 6(1)(a) GDPR); you can withdraw it in your profile without affecting your membership.

Who receives the data?

Access is limited to people who need the information to operate the shop and provide support. Our service providers process data on our behalf:

• Supabase: stores account and session records.
• Cloudflare: hosts the site and processes requests to its server functions.
• Resend: receives your name and email address to send the account welcome email.
• Discord: receives your chosen public display name only when you have opted in to a membership thank-you. The Discord bot host processes your Discord user ID for membership-role synchronization and delivers private order/contact notices to the configured staff channels.

These providers may process data in locations outside the European Economic Area. Where applicable, transfers are made under a GDPR-recognised transfer mechanism, such as an adequacy decision or Standard Contractual Clauses.

How long we keep the data

We keep account information while your account remains open. You may request account deletion or unlinking through our contact form. We will delete the account information unless we must retain specific information to comply with a legal obligation or establish, exercise or defend legal claims. Authentication tokens become invalid after 14 days; expired session records may remain in the database until they are removed. Discord link codes expire after 10 minutes and are stored only as keyed hashes.

Cookies and local storage

The authentication cookie is strictly necessary to keep you signed in. It is HttpOnly, uses SameSite=Strict, and is marked Secure over HTTPS. It expires after 14 days. No consent is requested for this cookie because it is required for the account service you request. This site also stores your theme and shopping cart in your browser's local storage; these are not cookies.

Your rights

Subject to the conditions in data-protection law, you can request access to, correction or deletion of your data, restriction of processing, or object to processing. You may also request data portability where applicable. To make a request, use our contact form. You can complain to your local data-protection authority; in France, this is the CNIL.

Automated decisions

We do not use account information for automated decisions or profiling that produce legal or similarly significant effects.