1. Roles and scope
These terms apply when a developer using the Multiplayer API (the "customer") sends us its players' personal data for processing. The customer is the controller; Michitai — Nichita Levandovici, Chișinău, Republic of Moldova — acts as processor for that player data. We remain an independent controller for our own purposes: developer accounts, billing, website analytics, security and abuse prevention, and legal obligations.
Processed data: player names/IDs, SteamIDs where Steam sign-in is used, optional declared birth year, room/matchmaking state, chat and game data the customer stores through the service, and connection/security metadata.
2. Our obligations as processor
- Process player data only on the customer's documented instructions — the service configuration, API calls and support requests — unless law requires otherwise (we will inform the customer where legally permitted);
- Keep personnel handling the data under confidentiality obligations;
- Maintain appropriate technical and organisational security measures (encryption in transit, hashed credentials and tokens, access controls, log redaction);
- Assist the customer with data-subject requests and with its own breach-notification duties — we notify the customer of a personal-data breach affecting its player data without undue delay;
- Delete or return player data at the end of the service or on documented instruction, subject to legally required retention and normal backup-expiry cycles (deletion is re-applied if a backup is restored);
- Make available information reasonably needed to demonstrate compliance and allow audits or inspections on reasonable notice, remotely where possible.
3. Sub-processors
Current sub-processors for player data: Hostinger (primary hosting, Amsterdam, Netherlands; backups in Lithuania) and the realtime relay service at realtime.michitai.com operated on the same infrastructure. The customer authorises these. We will post changes to this list on this page and give advance notice by email where practical; the customer may object to a new sub-processor and terminate the affected service if the objection can't be resolved. Each sub-processor is bound by equivalent data-protection obligations.
4. International transfers
Core service data is hosted in the EU/EEA. Our administration and support are performed from Moldova, which means player data may be accessed remotely from a third country — a "transfer" under GDPR chapter V. Customers subject to GDPR should notify us before sending player data subject to strict residency requirements so an appropriate safeguard (e.g. standard contractual clauses) can be put in place. Contact support@michitai.com.
5. Customer responsibilities
- Publish a privacy notice for your players naming this processing and the recipients involved (see the Player Privacy Guide);
- Establish a lawful basis for sending player data to us, including required consents and store disclosures;
- Provide the functionality you promise players — e.g. do not advertise an in-game account-deletion button unless it is implemented or clearly routed to a working process;
- Do not send us special-category data, payment card data, or children's data without a prior written arrangement;
- Handle player rights requests; we assist with data we hold on your instructions.
