← Anvil

Privacy Policy

This Privacy Policy explains how Anvil (“Anvil”, “we”, “us”) collects, uses, and protects personal data when you use Anvil, our platform for running Old School RuneScape clan events at anvilosrs.com.

1. Who we are

Anvil is the data controller for account and billing data described below. For the clan data you and your members put into the platform, you (the clan operator) are the controller and we act as your processor, storing and processing it on your behalf.

2. Data we collect

  • Account & contact: your email address and the Discord identity you sign in with (Discord user ID, username, avatar).
  • Billing: subscription tier and status, and limited transaction metadata. Payment-card details are collected and processed by Gumroad — we do not see or store full card numbers.
  • Clan data (processed on your behalf): roster and player information your clan enters (such as RuneScape names and Discord IDs), event and competition data, and images uploaded as drop or fee proof.
  • Discord bot interactions: when someone runs one of the bot’s slash commands (such as /bingo) in a server the bot has been added to, Discord sends us the command used, its arguments, the server and channel it was run in, and the Discord user ID of the person who ran it. The user ID is used to look that person up on the clan’s roster so the reply is about them; the interaction itself is not stored, and the bot does not read ordinary chat messages.
  • Technical: log data such as IP address, request metadata, and error diagnostics, used to operate and secure the service.

3. How we use data

  • To run, maintain, and back up the platform and your clan’s data on it.
  • To process subscriptions, prevent fraud, and provide support.
  • To communicate service, billing, and security notices.
  • To secure, monitor, and improve the service, and to comply with legal obligations.

Our legal bases (where the GDPR applies) are performance of our contract with you, our legitimate interests in operating and securing the service, and compliance with legal obligations.

4. Service providers (sub-processors)

We share data with the following providers only as needed to run the service:

  • Gumroad — payments, billing, and tax as Merchant of Record. See its privacy notice.
  • Hetzner Online GmbH — server hosting (Germany / EU).
  • Cloudflare, Inc. — DNS, network/security, and R2 object storage for uploaded media.
  • Discord, Inc. — authentication (login) and, where you enable it, bot integrations for your clan.
  • Jagex Hiscores — public OSRS Hiscores are queried to refresh competition stats; we send RuneScape names you provide.

5. International transfers

Our servers are located in the EU. Some providers above may process data in other countries; where required, such transfers rely on appropriate safeguards such as Standard Contractual Clauses.

6. Retention

We keep account and billing data for as long as your subscription is active and as required for legal, tax, and accounting purposes afterward. Your clan’s data is retained while your clan exists on the platform; if you delete your clan we keep it for a short grace period to allow export, then delete it along with associated backups. Ending a paid subscription does not delete your clan’s data — it returns to the free tier.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, delete, or restrict processing of your personal data, and to object to certain processing. To exercise these rights, email help@anvilosrs.com. If a request concerns data a clan holds about its members, we may direct it to the clan operator who controls that data. You may also lodge a complaint with your local data-protection authority.

8. Cookies

We use strictly necessary cookies to keep you signed in and to operate the service. We do not use advertising cookies. Our payment provider may set cookies during checkout as described in their privacy notice.

9. Children

The service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will remove it.

10. Changes

We may update this policy from time to time. Material changes will be communicated by email or in-app, and the “last updated” date below will change.

11. Contact

For any privacy question or request, email help@anvilosrs.com.

Last updated: August 29, 2026. Questions? Email help@anvilosrs.com.