Endoria
Endoria

Política de Privacidade

Last updated 19 de out. de 2026

Privacy Notice

Effective: 19 October 2026. We announce material changes on the website at least 15 days before they take effect; you will be asked to acknowledge the amended notice when you sign in on the website, before you can make a purchase again.

This is an English translation of the Hungarian „Adatkezelési tájékoztató”. In case of any discrepancy, the Hungarian version prevails.

1. The controller

  • Name: Muszil Ágnes, sole trader (egyéni vállalkozó)
  • Registered office and postal address: Kossuth Lajos utca 1., 8991 Búcsúszentlászló, Hungary
  • Registration number: 62955452
  • Tax number: 92473346-1-40
  • E-mail (including data protection matters): [email protected]
  • Service: the Endoria online game, the endoria.global website and its subpages, the game client and the launcher (together: the „Service”)

We are not required to designate a data protection officer (GDPR Article 37) and have not designated one.

2. Purposes and legal bases of processing

The legal bases refer to the points of GDPR Article 6(1).

Creating and maintaining your account, providing the game

  • Data: username, e-mail address, password (hash), character deletion code, time of registration and last login, client language, character and game data
  • Legal basis: (b) performance of a contract

In-game communication (private messages, mail, shout)

  • Data: sender, recipient, message text, time
  • Legal basis: (b) performance of a contract

Dragon Coin purchases, Item Shop, invoicing

  • Data: order ID, package, amount, currency, status, Stripe customer and payment IDs, card brand and last 4 digits, refund/chargeback data; for the invoice: name, billing address, e-mail address
  • Legal basis: (b) performance of a contract; (c) legal obligation (issuing invoices under Hungarian Act CXXVII of 2007 on VAT, retention of accounting records)

Transactional e-mails (e-mail confirmation, password reset, purchase confirmation)

  • Data: e-mail address, username, token (hash), language
  • Legal basis: (b) performance of a contract

Protecting the integrity of the game

Detecting cheating, bots and multi-account abuse, enforcing bans and preventing their circumvention.

  • Data: IP address, device identifier (HWID hash, see section 3), login log, input device statistics, anti-cheat events, captcha results, game logs (trade, item, currency and upgrade logs), ban and mute data
  • Legal basis: (f) legitimate interest: fair play and the protection of other players. We will provide the legitimate interest assessment on request.

Daily and per-device in-game limits

For example daily quest and dungeon limits, reward limits for multiple clients.

  • Data: HWID hash, account and character ID
  • Legal basis: (f) legitimate interest: applying the game rules equally

Proving acceptance of the terms, handling chargeback disputes

  • Data: time of acceptance, IP address, browser identifier (User-Agent), language, document versions
  • Legal basis: (f) legitimate interest: establishing, exercising and defending legal claims

Debugging, crash reports

  • Data: crash memory dump (minidump), client error log; if you provide them: e-mail address and description
  • Legal basis: (f) legitimate interest: client stability; providing the e-mail address and description is voluntary ((a) consent)

Logging of administrator actions

  • Data: staff member's ID and IP address, the affected account
  • Legal basis: (f) legitimate interest: preventing internal abuse, accountability

Promoter programme

  • Data: promoter code, the account using the code, the account IDs needed to settle commissions
  • Legal basis: (b) performance of a contract

Handling data subject requests

  • Data: content of the request, related correspondence
  • Legal basis: (c) legal obligation (GDPR Articles 12–22)

We do not send newsletters or marketing e-mails. Should we introduce them in the future, we would do so only with your separate, prior consent.

3. Anti-cheat and bot prevention in detail

Device identifier (HWID). The Windows client creates a one-way, salted hash (SHA-256) from the machine ID (MachineGuid), the system drive serial number, the computer name, the processor model and the MAC address of the first network adapter. Only this hash is sent to the server; the original values never leave your computer.

Input devices. The client checks whether mouse and keyboard input comes from a physical device or is generated by software, and sends aggregate counts about this roughly every 30 seconds. We do not record or send your keystrokes or the text you type. While you solve a captcha, mouse movement patterns are also sent.

Easy Anti-Cheat (Epic Games). The game uses Epic Games' Easy Anti-Cheat service. When you log in, Epic receives your account ID, username, IP address and character name. The anti-cheat module built into the client also collects technical data from your computer to detect cheating software. Epic's own privacy policy gives details: https://legal.epicgames.com/epicgames/privacy-policy

Automated measures. Some measures are taken without human involvement:

  • on an anti-cheat authentication failure or detected cheating, the system disconnects you;
  • on suspicious behaviour, captchas appear more often;
  • above the per-device limit, the reward is withheld.

Long-term or permanent bans are always decided by a staff member. You may request human review of any automated decision, express your point of view and contest the decision at [email protected].

We do not publish the specific detection methods, as that would let cheaters circumvent them. This limits the right of access only within this narrow scope (GDPR Article 15(4) and Article 23).

4. Recipients of your data

  • OVH Hébergement Inc. (1801 McGill College Ave., Suite 800, Montréal, Québec H3A 2N4, Canada; a member of the OVHcloud group) – processor: server hosting, all of the data above. Location: the server runs in France (EU).
  • Cloudflare, Inc. – processor: serving the website and downloads (CDN), attack mitigation, storing backups (R2, EU); IP address, request data, database contents in the backups. Location: EU / USA.
  • Stripe Payments Europe, Ltd. (Ireland) – payment provider: username, e-mail address, order ID, amount. Stripe collects your billing address and payment details directly from you and also processes them as an independent controller for its own fraud-prevention and legal obligations. Location: Ireland / USA.
  • Emergence Engineering Kft. (SzámlaBridge; Nagyenyed u. 5., 1123 Budapest, Hungary; tax number: 29043424-2-43) – processor: automatically generates invoices from Stripe payments; name, billing address, e-mail address, purchased package and amount. Location: Hungary.
  • KBOSS.hu Kft. (Számlázz.hu; Záhony utca 7., 1031 Budapest, Hungary; company registration number: 01-09-303201) – processor: issuing and storing invoices and reporting them to the Hungarian Tax Authority (NAV); name, billing address, e-mail address, purchased package and amount. Location: Hungary.
  • Mailgun Technologies, Inc. – processor: delivering transactional e-mails; e-mail address, username, e-mail content. Location: EU (Frankfurt, Germany).
  • Epic Games Commerce GmbH (Platz 10, 6039 Root D4, Switzerland) and Epic Games, Inc. (620 Crossroads Boulevard, Cary, NC 27518, USA) – Easy Anti-Cheat and Epic Online Services, see section 3. Location: Switzerland / USA.
  • BugSplat LLC (1023 Walnut St, Boulder, CO 80302, USA) – processor: client crash reports (minidump, error log, voluntarily provided e-mail address). Location: USA.
  • Discord Inc. – internal notification channel for staff: character name and account ID when a bot is suspected. Location: USA.
  • Authorities, courts – only on the basis of a legal obligation, to the extent necessary. Location: Hungary.

Internally, only those Endoria staff members who need the data for their tasks have access, according to their permission level. Staff access to account data is logged.

Our Discord server and the communication taking place there are Discord's own service, governed by Discord's privacy policy.

5. Transfers outside the EU

We store your data on a server operating in the EU, in France. The contracting party of our hosting provider is the Canadian OVH Hébergement Inc.; data may reach Canada on the basis of the European Commission's adequacy decision 2002/2/EC.

We transfer data to Switzerland (Epic Games Commerce GmbH) on the basis of the European Commission's adequacy decision 2000/518/EC.

We transfer data to the United States on the basis of the European Commission's adequacy decision (EU) 2023/1795 (EU–US Data Privacy Framework, DPF) to recipients certified under the framework: Cloudflare, Inc., Stripe, Inc., Mailgun Technologies, Inc. and Discord Inc. Certification can be checked at dataprivacyframework.gov.

For Epic Games, Inc. and BugSplat LLC, the basis is the standard contractual clauses (SCC) adopted by the European Commission.

Mailgun processes e-mails in its EU region (Frankfurt). We do not transfer data to any other third country.

6. How long we keep your data

  • Account data (username, e-mail address, password hash, character deletion code): until the account is deleted
  • Private messages and shout log: until the account is deleted
  • In-game mail (mailbox): 30 days (system messages: 7 days)
  • Detailed identification log (IP address, HWID hash, time): 30 days
  • Login log and per-account IP/HWID summary (for multi-account and ban-evasion investigations): until the account is deleted
  • Anti-cheat and captcha logs: until the account is deleted
  • Ban and mute records: until the account is deleted
  • Reports about other players: until the account is deleted
  • E-mail confirmation and password reset tokens: until the account is deleted (the confirmation link is valid for 7 days, the password reset link for 60 minutes)
  • Staff action log: until the affected account is deleted
  • Purchase and payment records, issued invoices: 8 years (Hungarian Act C of 2000, section 169)
  • Proof of acceptance of the terms: 5 years from the termination of the account (general limitation period, Hungarian Civil Code section 6:22)
  • Crash reports: 1 month
  • Server log files: 3 days
  • Data subject requests and our replies: 5 years
  • Backups: 30 days: deleted data remains in backups for at most this long and can only resurface from them when restoring after data loss

7. Your rights

  • Access: you may request information about and a copy of the data we process about you.
  • Rectification: you may request correction of inaccurate data. You can also change your password yourself in the account settings.
  • Erasure: you may request deletion of your account and data. Erasure does not cover data we must keep for the period set out in section 6 because of a legal obligation (accounting records) or to defend legal claims (proof of acceptance of the terms).
  • Restriction: you may request that in certain cases (e.g. while the accuracy of the data is contested) your data is only stored but not used.
  • Data portability: you may request the data you provided and that we process on the basis of the contract in a machine-readable format (JSON).
  • Objection: you may object to processing based on legitimate interest. In that case we continue only if there are compelling legitimate grounds (e.g. fraud prevention, enforcing a ban), and we will explain that decision.
  • Withdrawal of consent: where processing is based on your consent (e.g. the e-mail address given with a crash report), you may withdraw it at any time. This does not affect the lawfulness of earlier processing.
  • Review of automated decisions: see section 3.

How to make a request: by e-mail to [email protected], by post to our registered office, or in a support ticket on our Discord server. Please send your request from the e-mail address linked to your account, as we identify you by it. We reply without undue delay and within one month at the latest. For complex or numerous requests this period may be extended by two further months; we will inform you of this within the first month. Requests are handled free of charge.

8. What you must provide

Providing a username, e-mail address, password and character deletion code is necessary to conclude the contract; without them we cannot create an account. Processing of the HWID hash and IP address is a condition of using the game. When purchasing, providing your name and billing address is a legal requirement for issuing the invoice.

9. Minors

Registration requires you to be at least 16 years old. Users under 18 may only make purchases with the consent of a parent or legal guardian. If we learn that a person under 16 has registered, we delete the account and the associated data.

10. Cookies and local storage

  • endoria-session – login session; lifetime: 7 days; strictly necessary
  • XSRF-TOKEN – protection against cross-site request forgery (CSRF); lifetime: same as the session; strictly necessary
  • endoria_lang – remembers your chosen language; lifetime: 1 year; functional, a setting you requested
  • endoria:lastPage (sessionStorage) – navigation until the browser tab is closed; lifetime: until the tab is closed; strictly necessary

These are necessary to provide the service you requested, so we do not ask for consent to them. We do not use analytics, tracking or advertising cookies. The Discord widget is only loaded (and Discord only receives your IP address) when you open the Discord panel.

11. Data security

We protect your data with appropriate technical and organisational measures: encrypted (HTTPS) connections, permission-based and logged staff access, and regular encrypted backups. For security reasons we do not describe the specific solutions in detail.

12. Personal data breaches

We report a personal data breach to the Hungarian supervisory authority (NAIH) within 72 hours of becoming aware of it, unless it is unlikely to result in a risk. In the case of a high risk, we also notify the affected users directly. We keep a record of breaches.

13. Complaints and remedies

If you believe we have infringed your rights, please contact us first at [email protected]. You may also lodge a complaint with the supervisory authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH – Hungarian National Authority for Data Protection and Freedom of Information)
Falk Miksa utca 9–11., 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400; e-mail: [email protected]; https://naih.hu

You may also go to court; you can bring the action before the regional court of your place of residence or stay. Users living in another EU Member State may also lodge a complaint with the supervisory authority of their place of residence.

Voltar