Privacy Policy

This Privacy Policy explains how Anvil (“Anvil”, “we”, “us”) collects, uses, and protects personal data when you use Anvil, our managed hosting service for Old School RuneScape clan sites at anvilosrs.com.

1. Who we are

Anvil is the data controller for account and billing data described below. For the clan data you and your members put into a hosted instance, you (the clan operator) are the controller and we act as your processor, hosting it on your behalf.

2. Data we collect

• Account & contact: your email address and the Discord identity you sign in with (Discord user ID, username, avatar).
• Billing: subscription tier and status, and limited transaction metadata. Payment-card details are collected and processed by Gumroad — we do not see or store full card numbers.
• Clan instance data (processed on your behalf): roster and player information your clan enters (such as RuneScape names and Discord IDs), event and competition data, and images uploaded as drop or fee proof.
• Technical: log data such as IP address, request metadata, and error diagnostics, used to operate and secure the service.

3. How we use data

• To provision, run, maintain, and back up your hosted instance.
• To process subscriptions, prevent fraud, and provide support.
• To communicate service, billing, and security notices.
• To secure, monitor, and improve the service, and to comply with legal obligations.

Our legal bases (where the GDPR applies) are performance of our contract with you, our legitimate interests in operating and securing the service, and compliance with legal obligations.

4. Service providers (sub-processors)

We share data with the following providers only as needed to run the service:

• Gumroad — payments, billing, and tax as Merchant of Record. See its privacy notice.
• Hetzner Online GmbH — server hosting (Germany / EU).
• Cloudflare, Inc. — DNS, network/security, and R2 object storage for uploaded media.
• Discord, Inc. — authentication (login) and, where you enable it, bot integrations for your clan.
• Jagex Hiscores — public OSRS Hiscores are queried to refresh competition stats; we send RuneScape names you provide.

5. International transfers

Our servers are located in the EU. Some providers above may process data in other countries; where required, such transfers rely on appropriate safeguards such as Standard Contractual Clauses.

6. Retention

We keep account and billing data for as long as your subscription is active and as required for legal, tax, and accounting purposes afterward. Clan instance data is retained while your instance exists; after cancellation we keep it for a short grace period to allow export, then delete it along with associated backups.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, delete, or restrict processing of your personal data, and to object to certain processing. To exercise these rights, email support@anvilosrs.com. If a request concerns data held inside a clan instance, we may direct it to the clan operator who controls that data. You may also lodge a complaint with your local data-protection authority.

8. Cookies

We use strictly necessary cookies to keep you signed in and to operate the service. We do not use advertising cookies. Our payment provider may set cookies during checkout as described in their privacy notice.

9. Children

The service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will remove it.

10. Changes

We may update this policy from time to time. Material changes will be communicated by email or in-app, and the “last updated” date below will change.

11. Contact

For any privacy question or request, email support@anvilosrs.com.

Last updated: June 29, 2026. Questions? Email support@anvilosrs.com.