Who we are
[Registered company name] (“Asterisk”, “we”, “us”), [Registered office address, City, State, PIN, India], decides how and why your personal data is used. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) we are the data fiduciary; under the GDPR we are the controller.
Questions about privacy? Email info@asterisk.gg or our privacy team at [privacy@asterisk.gg].
What this policy covers
This policy applies to asterisk.gg, our store at shop.asterisk.gg, Aura membership, our newsletters, and our community spaces where we collect data directly (for example game-server whitelists). It explains what we collect, why, who we share it with and your rights. Visitors in the EEA and UK should also read our GDPR Notice.
Personal data we collect
| Data | Examples | When we collect it |
|---|---|---|
| Account | Name, email, phone number, username or gamertag, password (stored hashed) | When you create an account |
| Orders | Delivery and billing address, PIN code, phone number, items, order history | When you buy from the Outlet |
| Payments | Payment status, transaction ID, card brand and last four digits | When you pay — full card details are handled by Stripe, never by us |
| Aura | Membership status, plan, renewal dates, mandate reference | When you join or manage Aura |
| Communications | Messages to support, newsletter preferences, survey answers | When you contact us or sign up |
| Community | Game usernames, server whitelist details, contest entries | When you join our servers or enter a giveaway |
| Device and usage | IP address, browser, device type, pages viewed, approximate location | When you visit — analytics only with your consent |
We don’t ask for sensitive data such as health, biometric or financial account details. If you win a prize, we may need extra details required by tax law, which we’ll ask for at the time.
How we use your data and why
| Purpose | Data used | Basis |
|---|---|---|
| Running your account | Account | Providing the service you asked for |
| Taking payment, delivering orders and handling returns | Orders, payments | Providing the service you asked for |
| Managing Aura renewals, reminders and cancellations | Aura, payments | Providing the service you asked for |
| Customer support and service messages | Account, orders, communications | Providing the service you asked for |
| Tax invoices, accounting and legal compliance | Orders, payments | Legal obligation |
| Keeping the site, servers and payments secure; preventing fraud | Device and usage, orders | Legitimate use / legal obligation |
| Newsletters and offers | Account, communications | Your consent |
| Analytics to improve the site | Device and usage | Your consent (cookie settings) |
| Measuring our ads | Device and usage | Your consent (cookie settings) |
Consent and how to withdraw it
Where we rely on your consent, we ask clearly and never pre-tick boxes. You can withdraw consent as easily as you gave it:
- Newsletters: use the unsubscribe link in any email.
- Cookies and tracking: use Cookie settings at the bottom of any page.
- Anything else: email info@asterisk.gg.
Withdrawing consent doesn’t affect anything we did before, and we may still keep data we need for legal reasons.
Who we share data with
We share personal data only with service providers who help us run Asterisk, under contracts that require them to protect it:
- Stripe — payment processing and recurring payment mandates.
- Courier and logistics partners ([Delhivery, Blue Dart, DHL Express]) — to deliver and return your orders.
- Cloudflare and SurrealDB — hosting, content delivery and our database.
- Email service provider [name] — to send order updates and newsletters.
- Google Analytics, Microsoft Clarity and Meta — only if you accept analytics or marketing cookies.
- YouTube — only when you choose to play an embedded video.
- Professional advisers, auditors and authorities — where required by law, or to protect our rights and users.
If Asterisk is ever involved in a merger or acquisition, your data may transfer to the new owner under this policy. We never sell your personal data.
International transfers
Some of our service providers store or process data outside India, for example in the United States or the European Union. We transfer data only as permitted by Indian law, and for GDPR purposes we rely on safeguards such as Standard Contractual Clauses.
How long we keep data
| Data | How long |
|---|---|
| Account | While your account is open, then deleted within 30 days of closing it |
| Orders and invoices | 8 years, as required by tax and company law [confirm with your CA] |
| Aura and payment records | For the membership, then 8 years for accounting |
| Support messages | 2 years after the conversation ends |
| Newsletter subscriptions | Until you unsubscribe |
| Analytics and security logs | Up to 14 months for analytics; at least 1 year for security logs |
How we protect your data
We use reasonable security practices, including encryption in transit, access controls, and working only with providers that meet recognised standards (Stripe is PCI DSS certified). No system is perfectly secure, so please use a strong, unique password.
Your rights
Under the DPDP Act you can:
- access a summary of the personal data we hold about you and how we use it;
- correct, complete or update inaccurate data;
- erase data we no longer need, or that you withdrew consent for;
- withdraw consent at any time;
- nominate someone to exercise your rights if you die or become unable to;
- raise a grievance with us, and then with the Data Protection Board of India.
To exercise a right, email [privacy@asterisk.gg]. We may need to confirm your identity first. We aim to respond within 30 days.
Children
Our website is open to fans aged 13 and over, but purchases and Aura are for adults, or for under-18s with a parent or guardian’s approval. We don’t knowingly track children, profile them or show them targeted ads. If you believe a child has given us personal data without a guardian’s consent, contact us and we’ll delete it.
Marketing messages
We only send marketing emails if you opt in, and every email has an unsubscribe link. Order and account messages (such as delivery updates and Aura renewal notices) aren’t marketing, and we’ll send them whether or not you’re subscribed.
Data breaches
If a breach affects your personal data, we’ll tell you and the relevant authorities without undue delay, as the law requires, and explain what we’re doing about it.
Grievance Officer and complaints
If you have a concern about how we handle your data, contact our Grievance Officer:
- [Grievance Officer name], [Designation]
- [grievance@asterisk.gg] · [+91 phone number]
- [Registered company name], [Registered office address, City, State, PIN, India]
We’ll acknowledge your complaint within 48 hours and aim to resolve it within 30 days. If you’re not satisfied, you can complain to the Data Protection Board of India.
Changes to this policy
We’ll post any changes here with a new “last updated” date and, for significant changes, tell you by email or on the site.