Privacy Policy

1. Who is responsible

The data controller (“veri sorumlusu” under KVKK) for this website is Astronaut Entertainment, an independent game studio founded in Türkiye in September 2019.

For any privacy question or request, write to ground@astent.games. Press and business enquiries go to press@astent.games and partners@astent.games.

2. What we collect

We collect as little as possible. Our websites have no user accounts, no logins and no advertising, and analytics cookies are set only with your consent.

• Visit data: when you open a page, our web server and Cloudflare (our network and security provider) automatically process technical data: IP address, date and time, requested page, referring page, browser and device type (user agent) and response status.
• Contact form: the topic you choose, your name, email address and message, together with your IP address, browser user agent, interface language and the time of sending. hCaptcha checks that you are human (see section 5).
• Emails and applications: whatever you send us by email. For crew applications this is typically your name, contact details, experience, availability, country, Discord username and, where needed, proof that you are 18 or older.
• Preferences: the language you selected, stored in a cookie and in your browser (see the Cookie Policy).
• Statistics: Cloudflare Web Analytics counts page views without cookies and without identifying individual visitors.
• Game accounts: Ancient Online: Remastered accounts (email address, password, two-factor authentication, characters) are created and used inside the game. Our websites do not collect them; the game website shows only public in-game information such as character and guild names, levels and rankings.

• Analytics (only with your consent): if you accept analytics cookies, Google Analytics 4 records the pages you view, your approximate location (country and city derived from the IP address, which is not stored), device and browser type, the referring page and interactions, linked to a random cookie identifier.

3. Why we use it and on what legal basis

We do not sell personal data, do not use it for advertising and do not make decisions about you based solely on automated processing, including profiling.

• Delivering and securing the website (visit data, security cookies): our legitimate interest in a working, safe site — GDPR Art. 6(1)(f); KVKK Art. 5(2)(f).
• Answering your message (contact form, emails): steps taken at your request and our legitimate interest in replying — GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f).
• Preventing spam and abuse (rate limit, hCaptcha): our legitimate interest — GDPR Art. 6(1)(f); KVKK Art. 5(2)(f).
• Reviewing crew applications: steps before a volunteer engagement, at your request — GDPR Art. 6(1)(b); KVKK Art. 5(2)(c). Age is checked only to confirm the 18+ requirement.
• Remembering your language: a function you request by choosing a language — GDPR Art. 6(1)(f).
• Legal obligations and claims: where the law requires us to keep or disclose data, or to establish, exercise or defend legal claims — GDPR Art. 6(1)(c) and (f); KVKK Art. 5(2)(ç) and (e).

• Visitor statistics with Google Analytics 4 (only if you agree in the cookie banner): your consent — GDPR Art. 6(1)(a); KVKK Art. 5(1) explicit consent, which also covers the transfer abroad (KVKK Art. 9). You can withdraw it at any time via “Cookie Settings”.

4. How long we keep it

• Web server logs: 14 days, then deleted automatically.
• Contact form messages: up to 24 months after receipt, then deleted automatically — earlier if you ask and no legal reason requires keeping them. Messages we have archived after handling them, or marked as spam, are deleted after 180 days. The IP address stored with a message is used only to prevent abuse.
• Rate-limit records (a one-way hash of your IP address): deleted after 24 hours.
• Crew applications: for the duration of the selection and up to 12 months after it ends, unless you join the crew or ask for earlier deletion.
• Language cookie: 1 year. Contact form session cookie: until you close the browser.
• Data held by Cloudflare and hCaptcha: according to their own policies (linked in section 5).

• Google Analytics data: 14 months, then deleted automatically by Google. Analytics cookies: 13 months, or until you withdraw consent.

5. Who receives your data

We share data only with the service providers we need to run the website. We never sell it. Public authorities receive data only where the law requires it.

6. International transfers

The website runs on our own servers in Türkiye. Cloudflare and hCaptcha are based in the United States and operate worldwide, so data may be processed outside Türkiye and the European Economic Area. These transfers rely on the safeguards offered by these providers, such as standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework, as permitted by GDPR Articles 45–46 and KVKK Article 9.

Google Analytics is provided by Google Ireland Limited; data may also be processed by Google LLC in the United States, which is certified under the EU–US Data Privacy Framework.

7. Your rights

Depending on the law that applies to you, you have the right to:

• learn whether we process your data and receive a copy of it (GDPR Art. 15; KVKK Art. 11);
• have inaccurate or incomplete data corrected (GDPR Art. 16);
• have your data deleted (GDPR Art. 17; KVKK Art. 7);
• restrict processing (GDPR Art. 18);
• receive your data in a portable format (GDPR Art. 20);
• object to processing based on legitimate interest (GDPR Art. 21);
• learn the purpose of processing and the third parties in Türkiye or abroad that received your data, and claim compensation for damage caused by unlawful processing (KVKK Art. 11).

To use these rights, email ground@astent.games from the address you used with us. We reply free of charge within 30 days. You may also complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) or to the data protection authority of your EU country of residence.

8. Children

This website is not directed at children under 16, and crew roles are open only to people aged 18 or older. If you believe a child has sent us personal data, contact us and we will delete it.

9. Security

All traffic is encrypted with HTTPS (TLS). The contact form is protected against forged submissions (CSRF tokens), bots (hCaptcha, honeypot field, minimum fill time) and flooding (per-IP rate limit). Stored messages are not publicly accessible; only the team can read them.

10. Changes to this policy

We update this policy when the website or the law changes. The date at the top shows the current version.