1. Project and contact
This policy covers data processing by the L2 Burn website, panel and server, a private independent entertainment project unaffiliated with NCSoft. For privacy and rights under the Brazilian LGPD: [email protected]. General support: [email protected].
2. Data and purposes
Registration and authentication: email, final login, verification records and protected credentials enable account creation, authentication, access recovery and change notices. The link between website account, game login and characters enables authorized character lists and transfers.
Payments and transfers: orders, provider references, statuses, amounts, bonuses, fees, installments, refunds, balances, ledger and receipts support purchases, delivery evidence, duplicate prevention and support requests. Never send full card numbers through the website or support; payment details are entered at Mercado Pago checkout.
Operations and security: IP addresses, timestamps, technical events, sessions, failures and abuse signals protect accounts, support incident investigation and fraud prevention. Essential cookies support sessions and security. If enabled, metrics and Meta Pixel may process visits, identifiers and conversions subject to the applicable choices for non-essential technologies.
3. Legal bases and suppliers
Depending on purpose, necessary service processing relies on contract performance and steps requested by you; required records rely on legal obligations; security and fraud prevention rely on assessed legitimate interests and applicable legal grounds. Non-essential metrics require your specific choice where consent is used. Terms acceptance is not advertising consent.
Mercado Pago processes payments and may independently control its own data. Mailtrap sends transactional emails. Cloudflare protects and delivers the website and Email Routing forwards official incoming messages. Meta participates in measurement/advertising only if enabled with the corresponding choice. Only necessary data is shared; legally grounded authority requests may also be fulfilled.
Suppliers may process data outside Brazil. International transfers must follow applicable legal safeguards and mechanisms. This candidate does not claim an international certification or compliance that has not been demonstrated.
4. Security and retention
Access controls, protected connections, restricted credentials and durable operation records are used. Passwords must not be stored in plaintext. The TXT is generated in your browser and must be kept secure by you. No protection eliminates all risk.
The retention policy sets: technical/access logs for 6 months; rotating backups for 14 days; payments, refunds, antifraud and economic audit records for 5 years. Account data is kept while active and deleted or anonymized upon request, preserving only legal obligations. Email status, purpose and dates are retained; tokens and sensitive content are removed when no longer necessary.
Backup deletion follows the 14-day rotation cycle. Data preserved for legal obligations must be restricted to that purpose. Financial evidence subject to mandatory legal retention cannot be promised immediate deletion.
5. Your rights
Under the Brazilian LGPD, you may request confirmation and access, correction, sharing information, portability where regulated, anonymization, blocking or deletion of unnecessary or unlawfully processed data, consent withdrawal and deletion of consent-based data, subject to legal exceptions. You may also question automated decisions and complain to ANPD.
Contact the privacy address. Proportionate identity verification may be requested to prevent unauthorized disclosure, never your password. Responses follow applicable legal procedures and deadlines. Deletion or withdrawal can limit features dependent on the data but does not remove justified retention obligations. International users retain applicable mandatory rights.