1. Who controls the data
The data controller is the operator of the L2 Black project (“L2 Black”). Privacy requests can be sent to privacy@l2black.com.
L2 Black is a fan-made Lineage II project and is not affiliated with or endorsed by NCSOFT.
2. Data we process
When you browse the site, normal network and security data may be processed by L2 Black and its infrastructure providers, such as IP address, request time, requested URL, browser/user-agent information and security signals.
When you create or recover a game account, we process the account ID and email address you submit, the password you submit for hashing, verification or recovery data, and technical security information needed to prevent abuse. When you use the Partner Portal, we process the separate Partner username, Partner email, password hash, invitation/verification/recovery data, session records, and the affiliate or financial information required to provide that Portal. Passwords are not stored in plaintext.
The Account API uses keyed one-way hashes derived from security identifiers such as IP address, email address or account ID for rate limiting. The website does not use these identifiers for advertising or profiling.
When you use the game service, account and gameplay records necessary to operate the server may also be associated with your game account.
3. Why we process it
Account registration, verification, recovery and game-account operation are processed because they are necessary to provide the account and game services you request. Security, rate limiting, abuse prevention and service integrity are processed on the basis of L2 Black’s legitimate interests in protecting the service and its users. Data may also be processed where required to comply with applicable legal obligations.
L2 Black does not currently send marketing email. Account emails are transactional and relate to verification, recovery or security.
4. Service providers
Cloudflare provides website delivery and security services and Cloudflare Turnstile protects account forms from automated abuse. Turnstile processes information needed for its security function and does not receive the contents of L2 Black form fields from the widget. The Account API validates Turnstile tokens with Cloudflare.
Resend is used to deliver transactional verification and account-recovery email. Recipient email addresses and the message information required for delivery are transmitted to Resend.
Google Fonts is currently used to deliver the site’s Cinzel and Manrope web fonts. Loading those resources causes the visitor’s browser to contact Google’s font infrastructure and transmit ordinary network-request information.
Hosting, network and database infrastructure providers may process limited technical information as required to operate and secure the service. Some providers may process data outside the European Economic Area under the safeguards applicable to their services.
5. Cookies and browser storage
L2 Black does not currently use analytics, advertising, marketing or preference cookies. Game-account registration and recovery do not use an application login cookie. The Partner Portal and Affiliate Administration each use a separate strictly necessary secure, HttpOnly session cookie for authenticated access; these cookies are not used for advertising or profiling. The site does not store Partner or Admin session credentials in localStorage, sessionStorage or IndexedDB.
The Alpha download gate keeps an unlocked download address only in the memory of the open page. Closing or refreshing the page removes that state.
Cloudflare may use strictly necessary security cookies or equivalent browser-security mechanisms depending on the security features active for a request. For example, a Cloudflare clearance cookie can be used when a challenge or pre-clearance feature is enabled. These mechanisms are used for security, not advertising.
Because no non-essential tracking technologies are currently deployed by L2 Black, the site does not show a consent banner. If analytics, advertising or other non-essential storage is introduced, this notice and the required consent controls will be updated before those technologies are enabled.
6. Retention
Unverified game-account registration data is configured to expire after 24 hours. Consumed pending-registration records are removed after 7 days. Game-account password-recovery links expire after 15 minutes, and expired, consumed or revoked game-account reset-token records are cleaned after about 24 hours. Security rate-limit records are cleaned after 24 hours.
Partner email-verification links expire after 30 minutes and Partner password-reset links after 15 minutes. Expired, consumed or revoked Partner verification and reset-token records are retained for a cleanup window of about 7 days. Expired or revoked Partner session rows are retained for a cleanup window of about 30 days.
Active account, Partner Portal, affiliate and gameplay records are retained for as long as reasonably necessary to operate, secure and maintain the relevant account, commercial relationship and service, subject to applicable legal requirements and valid data-rights requests. Partner Portal sessions have configured idle and absolute expiries and can be revoked on logout, password reset or administrative status changes. Service providers may retain their own operational records under their respective policies.
7. Your rights
Where the GDPR or similar law applies, you may have rights including access, rectification, erasure, restriction, portability and objection. You may also have the right to complain to the competent data-protection supervisory authority.
To make a privacy request, contact privacy@l2black.com. We may need enough information to verify that a request relates to your account before acting on it.
8. Security
L2 Black uses measures including HTTPS, restricted service identities, password hashing, hashed verification/recovery tokens, rate limiting and Turnstile protection. No online system can guarantee absolute security.
9. Changes to this notice
This notice may be updated when the service, providers or data practices change. The date at the top of the page identifies the current version.