Who Controls Data, What We Collect, and Where It Comes From
ShadowByte Studios is the data controller for personal data processed through DrugRunners. We may collect account data, gameplay data, technical data, communications data, and payment or commercial data needed to operate the service.
- Account Data: username, email address, encrypted or hashed credentials, and account settings.
- Gameplay Data: actions, inventory, messages, economy logs, and moderation events.
- Technical Data: IP address, timestamps, user-agent, device or browser metadata, session identifiers, and security telemetry.
- Communications Data: support messages, admin correspondence, and email delivery events.
- Payment Data: purchase records and virtual credit records. Full payment card numbers are not stored on our servers.
Data is collected directly from you, automatically from your device or browser while using the service, and from service providers such as infrastructure or payment partners.
How We Use Data and Cookies
We process personal data for service delivery, account management, security, fraud prevention, anti-cheat, moderation, support, accounting, legal compliance, and service improvement. Optional marketing communications rely on consent where required by law.
- Contract necessity supports account management and core service delivery.
- Legitimate interests and legal obligations support fraud prevention, anti-cheat, moderation, and abuse prevention.
- Contract and legal obligations support payment operations and accounting or tax compliance.
We use cookies and similar technologies to keep you signed in, maintain session state, store security tokens and preferences, and support abuse prevention and service reliability. Where legally required, we seek consent before setting non-essential cookies.
Sharing, Transfers, Retention, and Anti-Abuse Signals
We may share data with hosting, infrastructure, email, anti-abuse, and payment providers acting as processors; with legal, accounting, or audit advisers; with regulators or law enforcement where required; and with successor entities in merger or acquisition scenarios. We do not sell personal data for money.
If personal data is transferred across jurisdictions, we apply the contractual, operational, and legal safeguards required by applicable law.
We retain data only for as long as needed for service operation, security, legal compliance, accounting, dispute resolution, or ongoing investigations. We may also use automated signals such as device, network, and behavioral indicators to detect abuse, cheating, fraud, and account compromise, with human review where needed for enforcement.
Your Rights, Children, Security, and Contact
Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, or port your data, and to withdraw consent where processing relies on consent. Residents of certain US states may also have rights to request access, deletion, correction, and disclosure of collected personal data.
- We provide an in-service data portal for logged-in users to download core account exports where available.
- Additional rights requests are handled by email and may require identity verification.
- The service is intended for adults, and we do not knowingly collect personal data from children under 18.
- We use administrative, technical, and organizational safeguards to protect personal data, though no system is perfectly secure.
Privacy questions, complaints, and rights requests can be sent to admin@drug-runners.com. We may update this policy from time to time and will post updates here with a revised effective date.