Virto Mat- Home
- Privacy policy
Privacy policy
What we collect, why, and how your account details are kept safe on our server.
Last updated: 25 October 2026
Who we are
Virto Mat (virtomat.com) is the controller of the personal data described in this policy. If you have any question about your data, write to [email protected] or use our contact page.
This policy explains what we collect, why, how long we keep it and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What we collect
| Data | When | Why |
|---|---|---|
| Username, email address and a secure password hash | When you create an account with email | To create and run your account (contract) |
| Name, email address and Google account ID | When you use Continue with Google | To sign you in with Google (contract) |
| Coin balance, XP, level, games played and recently played games | While you use your account | To show your progress (contract) |
| Name, email address, topic and message | When you use the contact or Player Care form | To answer you (legitimate interests) |
| IP address, date and time of form submissions | When any form is sent | Security and preventing misuse (legitimate interests) |
| Age confirmation and cookie choice | When you visit | Stored only in your own browser |
We never ask for bank or card details, and we do not collect special category data.
How your password is protected
Your password is never stored as you type it. Our server turns it into a one-way hash using PHP's built-in password_hash function, so not even we can read it. Passwords are never written to any log, never emailed and never shown on screen after you type them.
After five wrong password attempts an account is locked for 15 minutes to protect it from guessing.
Where your data is kept
All forms on Virto Mat (sign up, sign in, contact and Player Care) are handled on our own web server, not in your browser. Account details are saved in private files on the server which are blocked from public access. Nothing about your account is stored in the page code, and no account information is shown to other visitors.
Contact and Player Care messages are sent to our support inbox through an encrypted (TLS) connection with our email delivery provider. The whole website is served over HTTPS.
Who we share data with
- Our hosting provider, which runs the server the website and its files are on.
- Our email delivery provider (Brevo), which passes contact and Player Care messages to our inbox.
- Google, only if you choose Continue with Google. Google's own privacy policy applies to that sign-in.
We do not sell your data and we do not share it for advertising.
How long we keep it
- Account data: while your account is open. When you delete your account, its file is removed from the server straight away.
- Contact and Player Care messages and form logs: up to 24 months, then deleted.
- Browser storage (age check, cookie choice): until you clear it.
Your rights
You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. You can delete your account yourself at any time from your account page. For anything else email [email protected]. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Children
Virto Mat is only for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If you think a child has given us their details, please contact us and we will delete them.
Changes to this policy
We may update this policy. The date at the top shows when it last changed.