Privacy Policy
This document is provided in English. 本文件以英文提供。本書は英語で提供されています。
1. Who we are
Metaxy City is operated by Meta Loop Design Ltd, a company registered in England and Wales under company number [to be confirmed], registered office [to be confirmed]. We are the controller of the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO) under registration number [to be confirmed].
For any privacy question or request, email info@meta-loop.co.uk with the subject “Privacy”.
This policy applies to the Metaxy City websites (metaxy.world and its regional sites, such as london.metaxy.world) and the experiences inside them. It explains what personal data we collect, why, and the rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
2. What we collect
When you apply for residency
First and last name, date of birth, country or region, city (optional), occupation, organisation (optional), why you want to join, how you heard about us (optional), username, email address, password, whether you want marketing emails, and the language you used.
When you request a 24-hour pass
First and last name, country or region, purpose of visit, planned visit date (optional), username, email address, password, and the language you used.
We never store your password itself — only a one-way, salted cryptographic hash of it.
When you sign in and use the Service
- Technical and security information: your IP address and browser details when you apply, the times you sign in, failed sign-in attempts, and a record of decisions made on your application.
- Account status: your role (resident, tourist or administrator), pass number, application status, and when a 24-hour pass started and ends.
- Settings kept on your device: for example your language, avatar and display choices. These are stored in your browser, not on our servers (see section 11).
- Street messages: in the current preview, messages you type in the street are shown on your own device only and are not sent to our servers. We will update this policy before we launch shared chat.
When you contact us
Your emails to us and our replies.
We do not ask for special category data (such as health, religion or ethnicity). Please do not include it in your application.
3. How we use it and why
We only use your personal data where the law allows us to. The table shows our purposes and the lawful basis for each.
| Purpose | Lawful basis |
|---|---|
| Reviewing your application, creating and running your account, and providing the Service | Contract — to take steps at your request before entering into an agreement with you, and to perform it |
| Sending service emails: confirming your application, telling you our decision, and important changes to the Service or our terms | Contract |
| Checking you meet our minimum age of 16 | Legitimate interests — keeping the Service appropriate for its audience |
| Keeping the Service and accounts secure, preventing abuse and fraud, limiting repeated sign-in attempts, and keeping audit records | Legitimate interests — protecting our users and our systems |
| Handling reports, complaints and requests | Legitimate interests; legal obligation where the law requires us to respond |
| Understanding how the Service is used, in aggregate, so we can improve it | Legitimate interests |
| Sending occasional news about new districts and events | Consent — only if you tick the box. You can withdraw at any time using the unsubscribe link or by emailing us |
| Complying with the law and responding to lawful requests from authorities | Legal obligation |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information about this, and you have the right to object (see section 9).
4. Decisions about you
Every application is reviewed by a person. We do not make decisions about you based solely on automated processing, and we do not use profiling that has legal or similarly significant effects on you.
5. Who we share it with
We do not sell your personal data. We share it only with:
- Service providers who act on our instructions (processors), under contracts that require them to protect your data: cloud hosting [provider to be confirmed] and email delivery [provider to be confirmed];
- Professional advisers such as lawyers and accountants, where needed;
- Authorities such as the police or regulators, where the law requires it or to protect someone’s safety;
- A buyer or successor, if our business or assets are sold or reorganised — they would have to use your data in line with this policy.
6. International transfers
Our service providers may process personal data outside the UK. When that happens we make sure it is protected — for example by using countries covered by UK adequacy regulations, or by using the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for details of the safeguards we use.
7. How long we keep it
| Information | How long |
|---|---|
| Applications that are declined or withdrawn | 6 months after the decision, then deleted |
| Resident accounts | While your account is open; deleted within 30 days after you close it |
| 24-hour pass accounts | 6 months after the pass ends, unless you apply for residency, then deleted |
| Security and audit records (sign-ins, decisions) | 12 months |
| Emails and complaints | Up to 2 years after the matter is closed |
| Marketing consent records | While you are subscribed, and for 2 years afterwards as a record of consent |
We may keep information for longer if the law requires it or if we need it to establish, exercise or defend legal claims.
8. Keeping it safe
We use appropriate technical and organisational measures to protect your data, including salted password hashing, encrypted connections, a sign-in cookie that scripts cannot read, limits on repeated sign-in attempts, and restricting access to staff who need it. No system is completely secure, so please use a strong password that you do not use anywhere else. If a personal data breach is likely to put you at high risk, we will tell you without undue delay.
9. Your rights
Under UK data protection law you have the right to:
- access your personal data and get a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data erased in certain circumstances;
- restrict how we use your data in certain circumstances;
- object to us using your data where we rely on legitimate interests, and to direct marketing at any time;
- data portability — receive data you gave us in a structured, machine-readable format, or have it sent to another organisation;
- withdraw consent at any time where we rely on consent, without affecting what we did before you withdrew it.
To use any of these rights, email info@meta-loop.co.uk. It is free. We may need to confirm your identity, and we will respond within one month (this can be extended by up to two further months for complex requests, in which case we will tell you why).
10. Children
Metaxy City is for people aged 16 and over. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we will delete it. If you believe a child under 16 has given us their data, please contact us.
11. Cookies and local storage
We use one cookie and some browser storage. All of them are needed for the Service to work or to remember choices you make, so under PECR we do not need to ask for consent before setting them. We do not use analytics, advertising or tracking cookies. If we ever want to, we will ask for your consent first.
| Name | Type | Purpose | How long |
|---|---|---|---|
metaxy | Cookie (first-party, secure, not readable by scripts) | Keeps you signed in | 12 hours, or until you sign out |
metaxy_login_lang, metaxy_ui_lang | Local storage | Remembers the language you chose for the sign-in page and for the city | Until you clear it |
ls22_my_avatar | Local storage | Remembers the avatar you chose | Until you clear it |
aicity_style, aicity_net, ls2_… | Local storage | Remembers display settings (for example map style, chat settings) and whether you have already seen the introduction | Until you clear it |
| Browser cache | Cache | Stores city graphics on your device so districts load faster next time | Managed by your browser |
You can delete cookies and local storage in your browser settings at any time. If you block the sign-in cookie, you will not be able to sign in.
12. Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date above and, if the changes are significant, tell you by email or in the Service before they take effect.
13. Contact and complaints
If you are unhappy with how we have used your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office:
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint