Privacy Policy

01Who is responsible

Phantom DMA runs this store (phantomdma.cc) and the customer dashboard (dash.phantomdma.cc). The dashboard, loader and in-game menu run on systems provided by our software platform partner, which processes data on our behalf under this policy. For anything about privacy, contact us through a support ticket or our Discord.

02What we collect

Store visits. Our CDN and web server keep standard access logs (IP address, time, page requested, browser type) for security and to stop abuse. We use no analytics, tracking pixels or advertising cookies.

Store account. Checkout asks for an email address. We use it to send your keys and to create a store account for that address, where every order and key is kept. If you have not reviewed that game yet, we send one email a day after your keys arrive asking for a review. If you leave one within 2 days of delivery, we email you a 20% off code. You can stop these review emails at any time by opening a ticket. We store the address, a salted password hash, and the time the account was made and last signed in. We also store the IP address it was made from, and the recipient, subject and delivery result of each email we send. The text of each email is deleted once it is sent. Login sessions and password reset links are stored as hashes with an expiry.

Dashboard account. When you create an account on the dashboard we store a username, a salted password hash and the time you signed up and last signed in. An avatar is optional.

Orders. For each purchase we store the product, the plan, the amount, the email address given at checkout, the key that was delivered and the payment details. For crypto that is the coin used and the payment address and transaction reference issued by the payment processor. For cards it is the card brand, the last four digits, the expiry date, the country the card is from, the billing postcode and country, the payment reference, and a card fingerprint: a code our card payment processor makes from the card number, so the same card can be recognised again without anyone seeing the number. We also keep the bank's checks on the payment: whether you confirmed it with your bank (3D Secure), whether the security code and postcode matched, and the processor's fraud risk rating.

Card payments. You type your card details into a secure form run by our card payment processor. It uses them, together with your IP address and browser details, to take the payment and to stop fraud. We never see or store your full card number.

Checkout and delivery records. To stop fraud and to answer chargebacks, we keep a record of what happens with each order. At checkout that is your IP address and the country it is in, your browser and operating system, a device cookie, your time zone, screen size and languages, and the time you ticked the box agreeing to our terms. After payment it is when your keys were shown on the order page, copied, emailed and opened from your account, when you sign in to your store account, and, from the licence server, when each key was redeemed, the machines it was locked to and when it was last used. Each entry has the time and, where there is one, the IP address and browser.

Licence enforcement. To lock a key to your hardware, the loader reads identifiers from the gaming PC and the second PC. Examples are the board model and serial, disk identifiers and DMA card identifiers. We store a fingerprint made from them together with the individual values, so we can tell a real hardware change from key sharing. We also store when the lock was set and last seen, and how many resets you have used.

Security. Sign-ins, loader connections, key redemptions, hardware resets and admin actions are logged with the IP address and time. Rate limiting keeps a short-lived record of recent requests per IP.

Settings. Your menu configuration, saved presets and web radar share links are stored so they follow you between sessions.

Support tickets. When you open a ticket we store its subject, topic, the product and invoice you pick, every message in it, the files you attach, who wrote each message and when, and when you last read it. A copy of each ticket is posted in a private channel on our Discord server that only our staff (and you, if you linked Discord) can see, and a transcript is kept there when the ticket closes. We email you when we reply to a ticket you opened on this site.

Chat assistant. The chat on this site and Phantom AI in support tickets are answered by an AI model. When you use the chat we store your questions, the answers, the page you were on and a one-way hash of your IP address, so we can stop abuse and improve the answers. In a ticket the AI reads that ticket and the orders on your account so it can help, and its replies are saved in the ticket like any other message.

Discord link. If you link Discord to your store account, we receive your Discord user id, username, display name and avatar from Discord. We only ask for the "identify" permission, so we never see your messages elsewhere, your servers or your email. We use these details to add you to your ticket channels and to show your name on your tickets. You can unlink at any time from your account page.

Other support. If you message us on Discord outside a ticket, we see your Discord handle and whatever you send us. Discord's own privacy policy applies to that platform. If you email support@phantomdma.cc we keep the message and our reply on our own mail server for as long as the conversation is useful.

03Why we use it

• to deliver the key you paid for and keep your account working (performance of a contract);
• to enforce the hardware lock and stop key sharing, fraud and chargebacks (our legitimate interest in running the service);
• to show your bank what happened with an order if a card payment is disputed (legitimate interest);
• to keep the service secure, rate limited and available (legitimate interest);
• to answer support requests (performance of a contract);
• to ask for one review after an order and send the discount code you earn for it (legitimate interest).

We do not use your data for advertising, profiling or automated decisions with legal effect, and we do not sell or rent it to anyone.

04Who can see it

• Our software platform partner, which hosts the dashboard, the loader backend and the licence database and processes the data above on our behalf.
• The payment processor, which receives the payment amount and generates the payment address. It sees your wallet transaction, as does anyone reading the public blockchain.
• Our card payment processor, which takes card payments. If a card payment is disputed, it and the bank that issued the card receive the records of that order described above.
• Cloudflare, which sits in front of the store and dashboard for DDoS protection and caching and therefore sees your IP address and requests.
• Discord, which hosts the private channel for each support ticket and anything you send us there.
• Our AI provider, which processes chat messages and ticket conversations to write the assistant's answers. It does not train its models on them.

We do not share data with game developers, publishers, anti-cheat companies or anyone else, and we will not hand it over unless the law requires us to.

05Cookies

The store sets a sign-in cookie when you log in. It also sets a short-lived cookie that lets a new buyer open their invoice and account right after paying, and a 10 minute cookie while you link Discord. When you check out we also set a device cookie that lasts two years, so we can recognise the same device on later orders. It is used only to stop fraud and to answer chargebacks. None of these cookies are used for advertising, and scripts cannot read them. The dashboard sets one session cookie so you stay signed in. It is limited to the dashboard hostname, scripts cannot read it, and it expires when the session does. Cloudflare may set its own technical cookies for bot protection. Your browser may keep a few preferences (such as your basket, and whether you closed the card payments notice) in local storage, which never leaves your device.

06How long we keep it

• Access and security logs: up to 90 days.
• Rate limit counters: minutes.
• Checkout and delivery records, the card details and the bank's checks for an order: 18 months from the purchase, so we can answer a chargeback.
• Account, orders, keys and hardware identifiers: while the account exists, and for up to 12 months after the last key expires so we can handle disputes, replacements and fraud checks. After that they are deleted or anonymised.
• Support tickets, their attachments and Discord transcripts: while your account exists, so we can see the history if the same problem comes back. Ask in a ticket and we delete them sooner.
• Discord link: until you unlink it or your account is deleted.
• Chat assistant conversations on this site: 90 days.
• Other support conversations on Discord are governed by Discord. Support emails are kept on our mail server until the conversation is closed and archived.

07Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to a data protection authority. To use any of these, open a ticket while signed in to the account in question, or open one on our Discord. We will need to verify that you control the account before acting. Deleting an account cancels any remaining key time on it and cannot be undone.

08Security

Passwords are stored only as salted hashes. Traffic to the store and dashboard is encrypted in transit. Hardware identifiers are never shown to other customers and are used only for the lock. Access to the licence database is limited to the people who need it to run the service. No system is perfectly secure. If we ever discover a breach that affects you, we will tell you through the dashboard or Discord as soon as we reasonably can.

09Children

The service is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has an account, open a ticket or tell us on Discord and we will remove it.

10Changes

If we change this policy, the date at the top changes with it. Important changes will also be announced on Discord. If you keep using the service after a change, you accept the updated policy.