Information We Collect
A. Account & Platform Data
- Email address – required for account registration, support, and security notices.
- Discord ID (if linked) – used for integrations, community access, and support.
- IP addresses & user-agent strings – used for login security, fraud prevention, cheat detection, and compatibility checks. Retained indefinitely.
- Geolocation (coarse) – country/region inferred from IP for fraud prevention and security.
- Support tickets / communications – messages and metadata you send to us (including via email or Discord).
B. Payment & Transaction Data
Payment processing details – handled by third-party processors (Stripe, PayPal). We do not store full card numbers. We retain purchase history and license activations for records, support, and compliance.
C. Cookies & Similar Technologies
We use cookies and similar tech for authentication, session management, and performance analytics. You can block cookies in your browser; some features may not function without essential cookies.
D. Product / Scanner / Anti-Cheat Data
When you use ZeroTrust Anticheat or the ZeroTrust Scanner, we may collect data necessary to detect cheating, secure accounts, and prevent fraud, including:
- Hardware identifiers (e.g., HWID, device/CPU/GPU/motherboard hashes)
- Operating system, process/service information, and integrity signals
- Server identifiers and game process captures
- Game/platform identifiers (e.g., Discord, FiveM, Rockstar, Steam, Xbox Live)
- Scan results and related logs, which may include raw system information relevant to cheat detection
- Limited chat artifacts or excerpts if they are part of scan evidence or included in support/appeals communications
Note: We do not collect payment card data through the scanner or anti-cheat.
E. Gaming Platform Information
For anti-cheat and security purposes, we may collect publicly available information from gaming platforms and communities, including:
- Public gaming community discussions – Public discussions related to cheating or mod menu activity from gaming communities. These are processed solely to identify security risks and support community moderation.
- User identifiers and profiles – Discord IDs, usernames, and public profile information from gaming platforms
- Server memberships – Public gaming community memberships and participation
- Ban history and enforcement records – Public ban records and enforcement actions across gaming communities
- Steam and gaming platform data – Publicly available Steam profiles, game ownership, and VAC ban information
Purpose: This information is collected exclusively for security and anti-cheat services to maintain gaming community integrity and prevent cheating across multiple servers. We only collect information that is publicly visible and accessible, and only data directly relevant to security threats.
Retention: Platform information is retained only as long as reasonably necessary for anti-cheat enforcement, fraud prevention, and security purposes. Data is automatically purged when no longer needed for these legitimate security interests.
Legal Basis: We process this data under legitimate interest for security services and fraud prevention. This is not data resale or commercial data processing - it is security intelligence gathering for legitimate anti-cheat services.
F. AI Assistant Data
When you use our AI assistant (Oscar):
- Conversation messages – Your questions and interactions with the AI assistant are processed through AI models to generate responses.
- Conversation storage – Conversation history is stored locally in your browser using localStorage. We do not store conversation history on our servers.
- Server processing – Only the last 3 messages (up to 1,500 characters) are sent to our servers for context during each request. This data is used only for the current request and is discarded after processing.
- Data retention – Conversation history remains in your browser until you delete it or clear your browser data. Server-side processing logs may be retained for security and debugging purposes for up to 90 days.
Your control: You can delete conversations at any time through the AI assistant interface, which removes them from your browser storage.
How We Use Information
We process information to:
- Provide, operate, and secure the Services and deliver licenses you purchase
- Detect, investigate, and prevent cheating, abuse, fraud, and policy violations
- Authenticate users, enforce bans, and prevent ban evasion
- Communicate important updates, security alerts, and responses to support requests
- Improve performance, reliability, and features of the Services
- Comply with applicable laws, regulations, and lawful requests
How We Share Information
A. Service Providers
We share information with trusted vendors that help us operate the Services. They may only use data as instructed by us. Our third-party processors include:
- Payment Processors: Stripe, PayPal (payment processing)
- Hosting & Infrastructure: Vercel (data storage and hosting)
- CDN & Media Storage: sCloud (sacul.cloud) - for storing player images and videos from FiveM servers
- Analytics: Google Analytics (website analytics - anonymized)
- Authentication: NextAuth.js, Discord (user authentication)
- Communication: Gmail/Google Workspace (support communications via [email protected])
These processors are contractually obligated to protect your data and may only process it as necessary to provide their services to us.
B. Cross-Server Data Sharing
Important: Data collected from players may be shared across servers using ZeroTrust services. This sharing enables server administrators to identify players who have been banned or detected for cheating on other servers, helping prevent ban evasion and maintain security across the entire ZeroTrust network.
Data shared across servers includes:
- Platform identifiers (Discord IDs, Steam IDs, FiveM identifiers, etc.)
- Hardware identifiers (HWIDs)
- Ban records and enforcement actions
- Public gaming community information linked to platform identifiers
- Scan results and related security data
This cross-server sharing is essential for preventing cheaters from simply switching servers after being banned and is a core security feature of the ZeroTrust anti-cheat system.
C. Sharing With Our Customers (Scan Outputs)
For legitimate server administration and integrity purposes, we share certain scan outputs with the paying customer who initiated or is authorized to review a scan, including:
- Game/platform identifiers (e.g., Discord, FiveM, Rockstar, Steam, Xbox Live)
- Scan results and related logs and, where relevant, raw system information necessary to assess cheating indicators
These outputs are not public; they are accessible to the relevant customer's authorized staff (and, for enterprise accounts, authorized members of that organization). Recipients agree to use these data solely for server administration, integrity enforcement, and dispute resolution and to comply with their own legal obligations. We are not responsible for third-party misuse after lawful disclosure.
D. Legal, Safety, and Rights
We may disclose information when we believe in good faith it's necessary to comply with the law or a valid legal process; to protect the security and integrity of the Services; to protect our users or the public from harm or illegal activity; or to protect our rights, property, or legal interests.
E. Business Transfers
If we are involved in a reorganization, merger, acquisition, or sale of assets, information may be transferred as part of that transaction.
F. With Your Consent
We may share information with third parties when you direct us to do so or give explicit consent.
Data Retention
Security identifiers: We retain IP addresses, user-agent strings, and key identifiers (e.g., HWIDs; linked platform IDs) for as long as necessary for enforcement and fraud prevention, which may be indefinite to maintain service integrity and security.
Scan results & logs: Retained for as long as needed for enforcement, investigations, dispute resolution, and security (including permanently in connection with ban enforcement).
Account and purchase records: Retained for the life of the account and longer as needed for compliance, security, and record-keeping.
If you request deletion or close your account, we may continue to retain data necessary for ban enforcement, fraud prevention, security, and legal obligations.
Security
Data Storage and Transfers
Data is stored on secure servers in data centers we control or through trusted providers, primarily in the United States. By using our Services, you consent to the storage and processing of your data in the United States and other jurisdictions where we operate.
International Data Transfers: If you are located outside the United States, your data may be transferred to and processed in the United States. For EEA users, we rely on appropriate safeguards for international data transfers, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
- Other legally recognized transfer mechanisms
Some jurisdictions may have data localization requirements. While we primarily store data in the United States, we comply with applicable local laws regarding data storage and processing.
Your Choices & Rights
Depending on your jurisdiction, you may have various rights regarding your personal information. We will respond to requests sent to [email protected] within the timeframes required by applicable law (typically 30 days for GDPR requests or 45 days for CCPA requests).
A. Access, Correction, and Deletion
You have the right to:
- Access your personal information we hold
- Correct inaccurate or incomplete information
- Delete your personal data (subject to limitations below)
Data Deletion Requests: You may request deletion of your personal data by emailing us at [email protected].
Our Deletion Policy:
If you have never engaged in abuse on any server using our Services, we will delete all of your personal information upon request, including:
- Account information
- Platform identifiers (Discord, Steam, FiveM, etc.)
- Hardware identifiers (HWIDs)
- IP addresses
- All other collected data
Data Retention: For users who have not engaged in abuse, we retain your data indefinitely until you request deletion.
Data Retention for Abuse Cases:
What We Consider Abuse: Abuse typically includes bans and kicks issued by server administrators, as well as evidence of abusive behavior detected through our systems, including public communications or other security indicators.
If we have found evidence of abuse on servers that rely on our Services, we will retain all data necessary for security and enforcement purposes, including:
- All administrative actions (ban records, kick records, warn records, etc.)
- All identifiers collected from platforms (Discord IDs, Steam IDs, FiveM identifiers, etc.)
- Hardware identifiers (HWIDs)
- IP addresses and user-agent strings
- Scan results and related logs
- Public communications and other abuse indicators
- Any other data related to the abuse
This data is retained indefinitely to prevent ban evasion, protect server integrity, and maintain security across all servers using our Services.
We may also refuse deletion requests when:
- We cannot verify your identity
- We have legal obligations to retain the information
- The request is made in bad faith or for malicious purposes
B. Data Portability (GDPR - EEA users only)
If you are in the European Economic Area (EEA), you have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may request a copy of your data by contacting us at [email protected].
C. Right to Object to Processing (GDPR - EEA users only)
If you are in the EEA, you have the right to object to our processing of your personal data when we process it based on legitimate interests. However, we may continue processing if we have compelling legitimate grounds that override your interests, or for the establishment, exercise, or defense of legal claims.
D. Right to Restrict Processing (GDPR - EEA users only)
If you are in the EEA, you may request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing while we verify your request.
E. Automated Decision-Making (GDPR - EEA users only)
Important: ZeroTrust provides automated detection technology, but all ban decisions are processed and enforced by the individual server administrators where you were playing. ZeroTrust does not directly ban players.
Our automated systems detect potential cheating behavior and provide information to server administrators. Server administrators then make the final decision on whether to ban a player based on our detection data and their own server policies.
If you are in the EEA and believe an automated decision was made incorrectly, you have the right not to be subject to a decision based solely on automated processing that produces legal effects, unless:
- The decision is necessary for entering into or performing a contract with you
- You have given explicit consent
- The decision is authorized by law
Ban Appeals:
If you have been banned and wish to appeal, you must first contact the server administrator where you were playing. ZeroTrust only provides detection technology—we do not make ban decisions or process ban appeals. All ban enforcement and appeals are handled by the individual server owners and administrators.
You may contact ZeroTrust if needed, but please note that we do not handle individual server bans or appeals. Any contact regarding bans should first go through the server administrator.
F. Right to Withdraw Consent
Where we process your personal data based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
G. Right to Lodge Complaints (GDPR - EEA users only)
If you are in the EEA, you have the right to lodge a complaint with a supervisory authority in your country if you believe our processing of your personal data violates applicable data protection laws. However, we encourage you to contact us first at [email protected] so we can address your concerns.
H. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to Know: You may request information about the categories and specific pieces of personal information we collect, use, disclose, and sell (if applicable).
- Right to Delete: You may request deletion of your personal information (subject to exceptions for security, fraud prevention, and legal obligations).
- Right to Opt-Out of Sale: We do not sell your personal information. If this changes, we will provide an opt-out mechanism.
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Limit Use of Sensitive Information: You may request limits on our use of sensitive personal information.
To exercise your California privacy rights, contact us at [email protected].
I. General Limitations
We may limit or deny requests when we cannot verify your identity, when requests are unreasonable or excessive, or when compliance would undermine security, ban enforcement, fraud prevention, or legal obligations. We will inform you of any limitations or denials and the reasons for them.
J. Cookie Controls
You can control non-essential cookies via your browser settings. Note that blocking essential cookies may affect the functionality of our Services.
How to Exercise Your Rights: To exercise any of these rights, please contact us at [email protected] with your request. We will respond within 30 days (or as required by applicable law). We may ask you to verify your identity before processing your request.
Children's Privacy
The Services are not directed to children. Age requirements vary by jurisdiction:
- United States (COPPA): Users under 13 are not permitted. Users aged 13–17 may use the Services with verified parental/guardian consent.
- European Economic Area (GDPR): Age of consent varies by country (typically 13–16). Users below the age of consent in their country require parental/guardian consent.
- Brazil (LGPD): Users under 18 require parental/guardian consent.
- Other Jurisdictions: Age requirements follow local laws. Users must be of legal age to enter into binding agreements in their jurisdiction, or have parental/guardian consent.
We reserve the right to verify age and consent at any time. Accounts in violation of age requirements will be terminated. If you are a parent or guardian and believe your child has provided personal information, contact us immediately at [email protected].
Third-Party Links
Data Breach Notification
In the event of a data breach that may affect your personal information, we will:
- Investigate immediately upon discovery of any potential breach
- Notify affected users without undue delay, typically within 72 hours of becoming aware of the breach (as required by GDPR) or as soon as reasonably possible
- Notify relevant authorities where required by law (e.g., supervisory authorities in the EEA within 72 hours under GDPR)
- Provide clear information about the nature of the breach, what data was affected, potential consequences, and measures we're taking to address it
- Take immediate remedial action to contain the breach and prevent further unauthorized access
Notifications will be sent via email to the address associated with your account, or through other secure means if email is unavailable. We will also post notices on our website and dashboard when appropriate.
If you suspect a data breach or unauthorized access to your account, please contact us immediately at [email protected].
Regional Privacy Laws
We comply with applicable privacy laws in the jurisdictions where we operate. In addition to GDPR and CCPA, we acknowledge and comply with:
- Brazil (LGPD): Lei Geral de Proteção de Dados - Similar rights to GDPR for Brazilian residents
- Canada (PIPEDA): Personal Information Protection and Electronic Documents Act - Privacy rights for Canadian residents
- Australia (Privacy Act): Australian Privacy Principles - Privacy rights for Australian residents
- United Kingdom (UK GDPR): Post-Brexit UK data protection laws - Similar to EU GDPR
- Other Jurisdictions: We make reasonable efforts to comply with local privacy laws where our Services are used
If you are located in a jurisdiction with specific privacy laws, the rights described in this policy apply to you to the extent required by local law. Some rights may vary by jurisdiction.
Export Restrictions & International Use
The Services may be subject to export control laws and regulations. By using our Services, you agree to comply with all applicable export and re-export control laws and regulations, including:
- United States Export Administration Regulations (EAR)
- Sanctions administered by the Office of Foreign Assets Control (OFAC)
- Local export control laws in your jurisdiction
You may not use, export, re-export, or transfer the Services in violation of any applicable law, including to any country, person, or entity subject to U.S. or other applicable sanctions or embargoes.
If you are located in a country subject to U.S. or other applicable sanctions, you may not be able to access or use our Services. We reserve the right to restrict access from any jurisdiction as required by law.