Privacy Policy

The controller responsible for processing your data is the neotag.lol team. You can contact us about anything related to this policy through our Discord server, our only official contact channel.

We collect different categories of data depending on how you use the Service:

• Account data: username, email address, and password (always stored encrypted, never in plain text).
• Public profile data: everything you choose to show on your neotag (bio, title, avatar, links, music, widgets, tags, custom CSS, and other customization settings). This content is public by design.
• Files you upload: images, avatars, backgrounds, and music tracks, stored under a randomly generated file name.
• Technical visit data: IP address, approximate country (derived from the IP), and browser user-agent, for visits to both your public profile and the main site, for statistical and security purposes. We do not use this data for advertising purposes or share it with ad networks.
• Discord linking data (optional): your Discord ID and username, only if you choose to link your account from the dashboard.
• NeoCoins balance and activity: your balance, daily reward claims, and your history of in-Service bets/purchases.
• Minigame scores: player name and score that you enter yourself while playing.
• Payment data: if you purchase Premium or Ultra, our payment provider (Whop) confirms the amount, currency, and plan purchased to us; we do not receive or store your full card details.
• Affiliate data: if you use or manage an affiliate code, we record which account used it and when, to apply the corresponding benefits.

We process your data to: create and manage your account and public page (performance of the contract to use the Service); process Premium/Ultra payments and apply affiliate codes (performance of the contract); send transactional emails such as password resets (performance of the contract); keep the Service secure, prevent abuse, and debug errors (legitimate interest); and generate aggregate usage statistics (legitimate interest).

We do not use your data for personalized advertising, and we do not sell it to third parties.

We do not share your data with third parties except in the following cases, always limited to what is necessary to provide the Service:

• Whop, as our payment gateway, to process Premium and Ultra purchases.
• Resend, to send transactional emails (for example, password resets).
• The neotag.lol Discord bot, only for the features you explicitly link (NeoCoins balance, badges, account linking).
• Our hosting and technical infrastructure provider, which hosts the database and uploaded files.
• Public authorities, when we are legally required to do so.

We use only two first-party cookies, strictly necessary or functional for the Service: `neotag_session`, a technical httpOnly cookie that keeps you signed in, and `neotag_locale`, which remembers your chosen language. We do not use advertising cookies, cross-site tracking, or third-party analytics.

We keep your account and profile data for as long as your account remains active. Sessions automatically expire after 30 days. Visit data is kept for statistical and security purposes for a reasonable period and may be periodically deleted or anonymized. If you request deletion of your account, we will delete or anonymize your personal data unless we must keep some record (for example, of payments) due to a legal obligation.

You have the right to access your data, rectify it, request its erasure, object to processing, request restriction of processing, and request data portability. These rights are currently handled manually: message us on Discord stating your username and which right you want to exercise, and we will respond within a reasonable time.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your country's supervisory authority if you believe our processing of your data does not comply with applicable law.

The Service is not directed at anyone under 16 (or the minimum digital consent age in your country, if different) without the consent and supervision of a parent or legal guardian. NeoCoins and casino-style minigame features are restricted to people 18 and older. If we detect an account belonging to a minor without the required authorization, we may suspend it.

Some of the providers we use (for example, for payments or sending emails) may process data outside the European Economic Area. In those cases, we rely on the safeguards provided for under the GDPR, such as standard contractual clauses, to ensure an adequate level of protection.

We apply reasonable technical measures to protect your data: encrypted passwords (never stored in plain text), httpOnly session cookies, sanitization of rich-text content and custom CSS to prevent attacks (for example, XSS), and randomly generated file names for uploaded content. No system is 100% invulnerable, but we work to keep these measures up to date.

We may update this Privacy Policy to reflect changes to the Service or applicable law. We will always publish the current version on this page along with its update date.

For any privacy question or to exercise your rights, reach out on our Discord server.