Privacy Policy

1.1. This Privacy Policy (the “Policy”) describes the processing of personal information in connection with GGRate (the “Service”), including website visits, account functions, Steam linking, inventory analysis and support communications.

1.2. “Controller” means GGRate Administration, which determines the purposes and means of personal-information processing in connection with the Service.

1.3. “Data Subject” means an identifiable individual to whom the information relates, including an owner of a Steam profile who does not hold a GGRate account. Privacy enquiries and requests shall be submitted using the contact address below.

2.1. A GGRate account contains a name, email address, email-verification status and avatar, where one is supplied. The Service also processes the information needed to check the password, confirm an email address and restore access. If two-factor authentication is enabled, this includes the information needed to verify authenticator and recovery codes.

2.2. Support communications comprise the sender’s email address, the content of the enquiry and voluntarily supplied attachments or other information. Passwords, authenticator secrets or recovery codes must not be included in such communications.

3.1. Steam sign-in and account linking involve the processing of the Steam identifier, public display name and available avatar. Authentication is performed by Steam; the Service does not obtain the Steam password.

3.2. An inventory lookup uses the Steam ID or profile address entered by the visitor. Saved inventory information includes the available public Steam name and avatar, items, their attributes, estimated values and update times. A lookup can concern a Steam owner who has not registered with GGRate.

3.3. Inventory pages are publicly accessible: other visitors can see the saved Steam profile and inventory information. Changing Steam visibility later does not automatically remove information already saved by GGRate. To request removal or restricted publication, the Steam owner should contact the Administration and identify the inventory page. GGRate account email addresses, passwords and two-factor codes are not published as inventory information.

4.1. Operation and protection of the Service involve technical information, including IP addresses, browser and operating-system details, request times and device-session activity.

4.2. Device-session information is used to show the User’s browser or device, IP address and session activity in the profile and to terminate other sessions on request. Request and error information is used to investigate failures, detect suspicious access and enforce request limits. Signing out or terminating a session does not delete the account.

5.1. The name and avatar are used to display the account; the email address is used for account identification, verification, password recovery and replies to account enquiries. Steam information links the confirmed Steam profile to the GGRate account. Public item information is used to display inventory contents and calculate estimated values.

5.2. Account creation, sign-in, verification and recovery use the information necessary to provide the functions requested under the Terms of Use. Security processing serves the legitimate interest in preventing unauthorised access, fraud and disruption of the Service. Disclosure required by a binding legal demand is based on the corresponding legal obligation. Website analytics is described separately in section 6.

5.3. Access to the website or acknowledgement of this Policy does not constitute consent to all processing activities. Where processing is based on consent, the Data Subject has the right to withdraw that consent in accordance with applicable law.

6.1. Cookies and browser storage support account access, request security and preferences, including the selected currency. Blocking or deleting necessary cookies may prevent access to account functions or reset saved preferences.

6.2. The Service uses Google Analytics to measure traffic and analyse website use. Where analytics is enabled, the Google Analytics tag loads automatically when a page is opened.

6.3. Google Analytics may process page views, traffic sources, website interactions, browser and device information, and cookie identifiers. Information is transmitted to Google to produce audience and usage reports. Analytics cookies, including _ga and _ga_*, help distinguish browsers and sessions.

6.4. Cookies may be viewed, blocked or deleted through browser settings. Blocking cookies alone does not guarantee that all analytics requests will stop; browser privacy controls and tracking-blocking tools may provide additional restrictions. Information in this Policy does not replace consent where consent is required by applicable law.

7.1. Hosting and storage: the infrastructure used to operate GGRate stores account information, saved inventories, uploaded avatars and backups. A hosting provider’s role covers supplying that infrastructure, storing the information and carrying out technical maintenance.

7.2. Email delivery: when a verification or recovery email is sent, the mail system processes the recipient’s email address and message contents, including the relevant link or code. Support messages are processed to read the enquiry and send a reply.

7.3. Analytics: Google receives the website-usage and browser information described in section 6 to provide Google Analytics reports.

7.4. Steam checks the User’s Steam sign-in. GGRate uses the confirmed Steam ID and available public profile information to link the accounts. When the User follows a marketplace link, the destination website processes that visit and any subsequent registration or transaction under its own privacy policy.

7.5. Information may be disclosed to a court, competent authority or legal adviser where necessary to comply with a binding legal demand or establish, exercise or defend a legal claim. The scope of disclosure must correspond to the demand or claim; this clause does not authorise unrestricted transfer of the account database.

7.6. Processing locations depend on the servers used by GGRate and the infrastructure of the relevant service. Where a transfer outside the EEA is subject to GDPR, it requires a permitted transfer mechanism, such as an applicable adequacy decision or appropriate safeguards. This Policy does not itself provide that mechanism. Enquiries about actual recipients and processing locations may be sent to the Administration.

8.1. The name, email address, verification status, avatar and linked Steam details are retained while the account exists. Password and two-factor information is retained while needed for the corresponding sign-in method. Account-deletion requests are submitted to the Administration; signing out does not submit such a request.

8.2. Public inventory records are retained independently of a login session. Signing out, terminating sessions or changing Steam visibility does not automatically delete such records. Requests for account or inventory-record deletion shall be assessed under applicable law.

8.3. Email-verification links and codes expire after 15 minutes. Expiry prevents their use to verify an address; it does not mean that every associated security record is deleted at that moment. Support correspondence and security records may be retained after an enquiry is resolved where needed to investigate the same incident, prevent repeated abuse or handle a legal claim.

8.4. On an erasure request, account information, public inventory records and any justified exceptions are assessed separately. If some information must be retained, the response identifies the reason and affected categories. Backup copies may contain an earlier version of a record until the relevant backup is replaced or deleted; deletion from the live Service does not immediately erase all backup copies.

9.1. GGRate checks account authentication before accepting profile changes, restricts repeated sign-in and verification attempts, and validates uploaded avatars. These measures reduce the risk of account compromise and malicious uploads but do not guarantee that an internet service will never experience a security incident.

9.2. Users are advised to maintain a unique password, enable two-factor authentication, store recovery codes securely and review active sessions. Suspected account-security incidents should be reported using the contact address below.

9.3. The User controls access to their own email inbox, Steam account and devices. GGRate does not configure the security settings of those accounts or devices, receive their passwords or manage software installed on the User’s device. The User should protect them against unauthorised access and avoid sharing sign-in and recovery codes.

10.1. Subject to applicable law, a Data Subject may request access, rectification, erasure, a portable copy or restriction of processing, object to certain processing and withdraw consent. A right to lodge a complaint with a competent supervisory authority may also apply.

10.2. Send a request using the contact address at the end of this Policy, describe the requested action and identify the account email address or public inventory page concerned. To prevent disclosure or deletion of another person’s information, the Administration may ask the requester to confirm control of the relevant email address or Steam account. Passwords and recovery codes are not required for such a request.

10.3. The response explains what action was taken or why the request cannot be fulfilled in full, including any information that must be retained. Applicable statutory deadlines and rights to complain to a supervisory authority or seek judicial protection remain in effect.

11.1. Processing involving minors must comply with applicable age and parental-permission requirements. A parent or legal representative who considers a child’s information to have been processed unlawfully may request a review.

12.1. Changes to material processing practices shall be reflected in an updated Policy bearing a revision date. Notice of material changes and additional consent shall be provided or requested where required by applicable law.

12.2. Enquiries regarding this Policy, an account or a saved inventory record shall be directed to the contact address specified below.