Privacy Policy

ULTRO aims to collect the minimum personal data needed to take payment, deliver an order, prevent fraud and handle support.

Data we collect

For store orders we may process an optional email address, optional Discord username, Epic username/display name, selected delivery method, optional order message, order reference, product/price, payment status, fulfilment status, timestamps, support-message thread and technical security data needed to protect the service. If you use the Discord member-only Store area, ULTRO also processes the Discord user ID/display name and whether the authenticated account is a member of the configured ULTRO Discord server so member-only access can be enforced. ULTRO does not ask for payment-card details on this checkout. Payment is completed through the payment invoice page configured by ULTRO.

Discord member verification

Discord verification uses Discord OAuth with the minimum scopes needed for this feature: identity and server/guild membership. The one-time Discord access token is used by the server to check the authenticated account and ULTRO server membership; this implementation does not save that OAuth access token in browser storage or persist it as order data. A short-lived signed ULTRO member session is then stored in a Secure, HTTP-only cookie.

Payments

Payment happens on the configured Paymento checkout. ULTRO receives the invoice identifier and status needed to match the payment to your order; Paymento API credentials stay on the server.

Why we use data

We use order data to perform the contract, deliver the product, respond to support, prevent abuse, keep transaction records and comply with legal obligations. We do not sell customer personal data.

Retention

Operational personal data should be deleted or anonymised when it is no longer needed. Some transaction/accounting records may need to be retained for periods required by law. Private order data is stored in the configured ULTRO server-side storage and is protected from public order access by high-entropy order tokens.

Sharing

Data may be shared with service providers only as needed for payment, hosting, legal compliance, fraud/security or support. This includes the Paymento payment service and the website hosting/storage provider. Order data is not shared with Epic merely because you place an order. Where an independent fulfilment provider is used, only information necessary for the chosen fulfilment method should be shared, subject to the applicable provider terms and privacy rules.

Your rights

Depending on applicable UK data-protection law, you may have rights to access, correct, erase, restrict or object to certain processing, and to complain to the ICO. Contact ultroesports@gmail.com for privacy requests. Identity verification may be needed before releasing order data.

Security

ULTRO uses server-side payment credentials, private order access tokens, server-authoritative prices and restricted server-side order storage. No website can promise absolute security, so customers should keep private order links confidential.