Privacy Policy

Last updated: October 11, 2026

1. Who is responsible

The controller for personal data on SummSing is the operator named in our operator details. For privacy questions, open a ticket via Support or write to that address.

2. What we collect and why

  • Account data - email address, username, password (stored only as a secure hash), two-factor settings. Purpose: providing your account (contract).
  • Roblox data - your linked Roblox username, user ID and public avatar. Purpose: carrying out trades with the right account (contract).
  • Trading and payment data - inventory, listings, purchases, sales, deposits, top-ups and payouts including amounts, coins and wallet addresses. Purpose: running the marketplace, bookkeeping, fraud prevention (contract, legal obligations, legitimate interest).
  • Messages and support - chat messages, private messages, support tickets and files you attach. Purpose: communication and resolving problems (contract, legitimate interest).
  • Security data - IP address, login times and basic device information. Purpose: protecting accounts, preventing abuse, rate limiting (legitimate interest).
  • Game screenshots - while a trade runs, our bot takes screenshots of the trade window to recognise items. They may contain your Roblox name. They are deleted after a short time unless they are needed for an open support ticket (legitimate interest).
  • Optional - a Discord webhook address if you add one for notifications.

3. Service providers

We use the following processors, only as far as needed:

  • Railway (hosting of the website and database)
  • NOWPayments (processing of cryptocurrency top-ups and payouts)
  • our email provider (sending confirmation and security emails)
  • Google, only if you choose "Sign in with Google"
  • Discord, only if you add a webhook
  • OpenAI, for automatic recognition of items on game screenshots

Some of these providers are located outside the EU (e.g. in the USA). Where this is the case, the transfer is based on an adequacy decision (EU-U.S. Data Privacy Framework) or the EU standard contractual clauses.

4. Cookies and local storage

We use one technically necessary session cookie to keep you signed in and protect forms. Your browser's local storage remembers small preferences (e.g. sort order, whether values are shown). We do not use advertising or tracking cookies.

5. How long we keep data

Account data is kept as long as your account exists. Transaction records are kept for as long as tax and commercial law requires (in Austria generally seven years). Security logs and screenshots are deleted after a short period unless needed to resolve a dispute.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. To use these rights, contact us. You also have the right to lodge a complaint with a supervisory authority - in Austria the Datenschutzbehörde (dsb.gv.at).

7. Young players

Many MM2 players are young. We only collect the data described above, never sell it and never show your email or Roblox name to other players.

Are you sure?