This Privacy Policy explains how Cerenos (Cerenos Limited, a private company limited by shares registered in Ireland under company number 824270, with its registered office at Venture Hub, 136 Capel Street, Dublin, Dublin, D01 T2C9, Ireland) ("Cerenos", "we", "us", "our") collects, uses, and protects personal data when you use our products and services, including:
This is version 1 of this Privacy Policy - the full history of every previous version, including exactly what changed and when, is always available from the "version history" link above.
This page is a general overview that applies to everyone. Two more detailed policies sit alongside it depending on where you are:
Nothing in those two policies changes what data we collect or why - they simply set out your rights under the law that applies to you in more detail than this page does.
Cerenos is the data controller responsible for your personal data across the services listed above. "AvalonEleven" and "Helios" are trading names / product names operated by Cerenos, not separate legal entities.
Contact us about this policy at [email protected]. This address does not send automated replies - a member of our team will personally follow up with you once your message is received.
If you interact with us as a representative of a business - for example, using a work email address to sign your organisation up for AvalonEleven, or as the owner of a Discord server that uses Helios - we still treat that as your personal data under EU/UK/Swiss GDPR, the same as any individual consumer's data. Some US states (Texas, in particular) exempt personal data processed purely in this business-to-business context from individual consumer rights requests - see our US Data Privacy Policy for detail. We will let you know if an exemption like this applies to a specific request you make to us.
Account and identity data. When you or your organisation sign up for AvalonEleven, we collect your name, email address, phone number, company name, country, and (where you choose to link it) your Discord ID and Discord username. We store a securely hashed version of your password - we never store or can retrieve your actual password.
Session and authentication data. We use a signed session cookie to keep you logged in (see our Cookies Policy for full details).
Payment data. If your organisation is on a paid plan, our payments provider, Stripe, Inc., collects your payment card details directly through Stripe Elements / Stripe Checkout, embedded securely in our pages. We do not store or process your raw card number, expiry date, or CVC on our own Irish-hosted servers - Stripe tokenises this information and simply confirms back to us whether a payment succeeded.
Support and communication records. If you raise a support ticket, contact our sales team, or chat with an agent, we keep a record of that conversation (your name, contact details, and the content of your messages) so we can respond to you and maintain a record of the interaction.
Retail transaction data. If your organisation uses our EPOS point-of-sale product, we record sales, refunds, and stock movements attributed to a staff PIN. Staff PINs and transaction records are encrypted at rest.
Discord moderation data (Helios). If a Discord server owner adds Helios to their server, and a moderator takes an action against you (for example a warning, mute, kick, or ban), we store your Discord user ID, Discord username, the moderator's Discord user ID and username, the reason given, and the outcome. If you appeal a moderation action, we store the text of your appeal. Helios only ever requests the identify OAuth scope (your Discord user ID, username, and avatar) - we never see your Discord messages.
Analytics data. With your consent (see our Cookies Policy), we use Google Analytics to understand how visitors use our public website - this includes your IP address (truncated/anonymised by Google where supported), pages visited, and general device/browser information. If your browser broadcasts the Global Privacy Control (GPC) signal, we automatically honour it as an opt-out and never load Google Analytics for you, whether or not you click anything on our cookie banner.
We do not sell personal data for money. We share data with the following categories of recipient, only as needed to provide our services:
Some of these providers are located outside the European Economic Area (EEA), including the United States. Where that is the case, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Separately, using Google Analytics may be treated as a "sale" or "share" of personal data under some US state privacy laws, even though no money changes hands - see our US Data Privacy Policy for what this means for you and how to opt out.
We keep personal data only for as long as necessary for the purposes described in this policy:
These are our current retention periods; we review them periodically and may adjust them, in which case we will publish an updated version of this policy.
Subject to applicable law (including the GDPR, if you are in the EEA, UK, or Switzerland), you have the right to:
If you are in the United States, see our US Data Privacy Policy for your state-specific rights, including the right to opt out of targeted advertising or the "sale"/"sharing" of your data, and the right to appeal a denied request.
To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law.
Our services are not directed at, and are not intended for use by, children under the age of 16. We do not knowingly collect personal data from children.
We use industry-standard measures to protect your data, including encryption of particularly sensitive stores (for example point-of-sale transaction data and staff PINs), hashed passwords, and access controls that limit who can see what data. No system is 100% secure, and we continually work to improve our safeguards.
We may update this Privacy Policy from time to time. Every version we publish is kept - use the "version history" link above to see exactly what changed and when. Material changes will be highlighted at the top of this page.