Privacy Notice

1. Scope and controller

This Notice covers the ComePlay website, Discord app and server workflows, creator onboarding, bookings, restricted session spaces, referrals, and support or safety operations. The US data controller is the ComePlay.GG early-access project; no company or LLC is represented as formed. No public privacy email is designated during early access. A signed-in user can use the authenticated private intake. Public enrollment and live payments stay disabled until a complete public contact is published.

Third-party services you use with ComePlay, including Discord, Stripe, and the hosted identity and age verification service, process information under their own privacy notices. This Notice does not replace theirs.

2. Information we collect

• Account and Discord data: internal account ID, Discord user ID, username, display name, avatar, email returned by Discord or the authentication service, guild membership, relevant roles, sign-in timestamps, and account status.
• Creator data: public handle, display name, bio, country, timezone, services, prices, availability, listing state, verification eligibility, creator-term acceptance, Stripe Connect account ID, onboarding state, payout readiness, and related commercial settings.
• Booking and session data: participants, service snapshot, date, timezone, duration, price and policy snapshot, status, Discord guild/category/channel identifiers, reminders, check-ins, room-presence signals, issue flags, completion signals, and audit history.
• Payment and tax data: Stripe customer, Checkout, payment, refund, dispute, balance, transfer, and connected-account identifiers; amount, currency, tax, fee, and reconciliation records. Stripe—not ComePlay—receives full card numbers, security codes, payout bank details, and most tax onboarding documents.
• Verification data: provider and workflow identifiers, policy version, status, reason or warning codes, country or age-eligibility result, and event timestamps. ComePlay's application database does not store raw identity documents, document numbers, selfies, liveness video, face templates, date of birth, or biometric media.
• Support and safety data: report category, narrative, involved booking and users, communications, relevant evidence references, decisions, appeals, access history, and preservation or legal-hold status.
• Referral data: referral code, source URL or campaign, referring account, attribution timestamps, qualifying booking, reversal and commission state, and anti-fraud review.
• Device and security data: IP address, user agent, request time, authentication and webhook metadata, cookie or local storage identifiers, rate-limit events, error logs, and signals used to detect account abuse, duplicate events, and fraud.

3. Where information comes from

We receive information directly from you; from Discord during OAuth, guild access, bot interactions, and session delivery; from Creators and other participants; from Stripe and Didit; from referral links; from service providers and security logs; and from lawful public or fraud-prevention sources when reasonably necessary.

4. Why we use information

• Provide authentication, creator pages, availability, booking, checkout, reminders, restricted session spaces, support, and account controls.
• Confirm adult eligibility, creator identity, policy acceptance, payment readiness, and access permissions.
• Prevent double-booking, fraud, spam, policy evasion, unauthorized access, duplicate webhooks, and security incidents.
• Process and reconcile payments, refunds, disputes, Creator allocations, referrals, accounting, and legally required tax records once live money is enabled.
• Investigate service issues and safety reports, enforce policies, provide appeals, protect people, and preserve evidence when necessary.
• Debug, measure, and improve the service, create aggregated statistics, communicate material changes, and comply with law.

Depending on the activity and applicable law, we rely on performing our contract with you, consent, legitimate interests in operating and securing the marketplace, and legal obligations. We do not use identity documents or biometric media for advertising.

5. Cookies and local storage

ComePlay uses authentication cookies required to keep you signed in. An eligible referral visit sets the HttpOnly, SameSite=Lax cp_ref cookie for up to 90 days so a qualifying booking can be attributed. The booking interface uses browser session storage to preserve an unfinished selection in that browser tab. Security and hosting providers may use essential cookies or request identifiers.

ComePlay does not run third-party behavioral advertising cookies. If that changes, we will update this Notice and provide any consent or opt-out control required by law. Clearing cookies and storage in your browser ends the sign-in, discards an unfinished booking, and removes referral attribution.

6. Verification and sensitive information

When configured, Didit hosts document, face-match, liveness, and age checks for Creators and an age-assurance flow for Members. Didit receives the verification media and applies its own privacy terms. ComePlay receives only the eligibility result and the operational metadata needed to enforce access. The launch configuration sets the provider's raw verification-media retention to 30 days, subject to a shorter deletion right or longer period that applicable law requires.

Do not send identity documents, document numbers, selfies, biometric media, full payment credentials, health information, or intimate media through Discord or ordinary support. If the verification provider is unavailable or not configured, gated publication and booking stay closed; ComePlay never accepts a manual document upload in place of the hosted check. Learn more in the Identity and Age Verification Notice.

7. How information is disclosed

• Session participants: the information reasonably needed to identify the Creator, describe the service, coordinate the booking, and enter the restricted session space.
• Service providers: companies that perform hosting, data storage, authentication, payment and payout processing, identity and age verification, communications, security, fraud prevention, accounting, and professional support for ComePlay. They receive only the information reasonably needed to perform the contracted service, and ComePlay does not authorize them to use it for their own advertising.
• Legal and safety: authorities, emergency services, rights holders, insurers, advisers, or affected persons when reasonably necessary to comply with law, respond to valid process, prevent fraud, protect safety, or enforce rights.
• Business changes: a buyer, investor, lender, or successor under confidentiality protections during a financing, merger, sale, reorganization, or insolvency process.

ComePlay does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not knowingly sell or share the personal information of anyone under 18. ComePlay treats a recognized Global Privacy Control signal as a request to opt out of sale, sharing, and targeted advertising for that browser and any account we can reasonably associate with it. Because ComePlay performs none of those activities, the signal does not change how data is used today.

8. Discord calls, messages, and evidence

ComePlay does not routinely record or transcribe Discord voice or video sessions and provides no covert surveillance. Discord may process room metadata, messages, voice, and video under its own terms. A restricted session space is not absolutely confidential: authorized operators and Discord may retain technical access.

A person making a report may submit limited, relevant, lawfully obtained evidence through an approved intake. Do not publish it and do not upload illegal content. Never copy or send suspected child sexual abuse material to ComePlay; report it directly to the platform hosting it and to the authorities.

9. Retention

• Account and public profile data: while the account is active, then generally 30 days after a completed deletion request.
• Booking, payment, payout, refund, dispute, and tax records: generally seven years after the transaction or longer if law, audit, or an open dispute requires.
• Verification eligibility and policy evidence: generally five years after the last gated transaction; raw provider media remains with the provider for the configured 30-day period, subject to applicable law.
• Session operational and access logs: generally two years after the session.
• Safety and support cases: generally five years after closure, with longer preservation for serious safety matters, litigation, regulatory requests, repeat abuse, or a legal hold.
• Referral and commission records: generally seven years after final payment, reversal, or expiration.
• Routine security and application logs: generally 12 months unless needed for an incident or legal hold.

Backups may retain deleted data for up to 90 additional days before ordinary rotation. We may de-identify data and keep it where it can no longer reasonably identify a person. These periods are launch defaults and must be implemented and validated before live money.

10. Your privacy choices and rights

Every US user may request access to, correction or deletion of, and a portable copy of personal information; opt out of sale, sharing, targeted advertising, and qualifying profiling; limit uses of sensitive information where applicable; and appeal a denied request. State law may provide additional rights or exceptions.

Submit a request through the authenticated private intake. We verify each request using information appropriate to its sensitivity. An authorized agent must provide proof of authority, and we may confirm the request with the account holder. We aim to respond within 45 days and may take one additional 45-day extension when reasonably necessary after giving notice. You may appeal within 45 days after a denial. We will not discriminate against you for exercising a privacy right. Some data cannot be deleted while it is needed for a transaction, security, safety, legal obligation, or legal claim; we will identify the exception we rely on.

11. Automated processing and appeals

Automated systems may detect duplicate events, block an invalid booking, route a risk signal, or apply a verification provider's eligibility result. No automated system is the sole final judge of report credibility, participant fault, serious sanctions, refunds, or Creator payouts. Where a consequential eligibility or enforcement decision can reasonably be reviewed, the Help page explains how to request that review.

12. Security, US processing, and children

ComePlay uses role-based access, signed events, encryption in transit, provider-managed encryption at rest, audit records, and data-minimization practices. No service can promise perfect security. Report a suspected compromise through the Help page immediately.

The launch is limited to US users, though providers may process data in other jurisdictions subject to their safeguards. ComePlay is for adults 18 and older only and does not knowingly permit a minor to book, list, or join a session. If we learn that an underage person supplied personal information, we block the account and delete or preserve the information as law and safety require.

13. Changes and contact

Every material change receives a new version and effective date. If a change materially affects previously collected information, we provide the notice or consent required by law. During early access, signed-in users can use the authenticated private intake. No public privacy inbox or legal-mail address is designated yet. Live payments are not yet enabled.

Questions, reports, or requests

Start at the ComePlay Help page. The current Discord session button creates a private owner-attention flag; it is not an emergency line or a complete legal, privacy, copyright, or payment claim by itself. Never put identity documents, card details, intimate media, or illegal content in Discord.