Privacy and cookie policy

Data controller

Neobeta S.r.l.
Via Fontana 7, 20122 Milano (MI), Italia
info@neobeta.com

Account and game services

We process account and contact details, profile and game information, access and security logs, messages and support correspondence, and payment and entitlement references to provide Maxithlon. Some profile and sporting information is visible to other players. Required service data is necessary to provide the requested features; optional analytics can be refused without losing access to the game.

Account and game data are kept while needed to provide the account and preserve sporting history. Account closure requires a review of linked sporting, payment and security records: it is not an automatic deletion of every copy. Data needed for an applicable legal obligation or an identified dispute is separated and kept only for that purpose. Contact Neobeta for the criteria and exceptions applicable to your data.

Purposes and legal bases

Account and game services are provided to perform the service requested by you. Security and abuse prevention protect the legitimate interests of the service and its users. Payment and legally required records meet the applicable obligations. Optional analytics relies on your consent.

External services

Server24, provided by INCUBATEC S.r.l., hosts the website and databases in Italy. Amazon Simple Email Service delivers service emails and Google Workspace handles incoming and forwarded correspondence. Google also provides optional sign-in, anti-abuse checks and consent-based statistics. PayPal is the current payment provider and retains payment data under its own applicable terms; Maxithlon also keeps service, entitlement and payment-reference metadata. Provider privacy information is linked below.

Server24 · Google · Amazon Web Services · PayPal

Staff access

Staff working under Neobeta's direct instructions may access the personal data necessary for their assigned support and game-administration tasks, according to their role. Staff may work outside the European Economic Area. The Staff page, available after sign-in, lists roles and countries of usual work; it supplements this notice and is not an access register. Privacy requests are handled through info@neobeta.com.

Staff access

International processing

Using Google, Amazon and PayPal can involve processing outside the European Economic Area, including in the United States, according to the service and its configuration. Staff abroad are described separately above. Ask Neobeta for information about the applicable locations, transfer arrangements and a copy of the relevant safeguards. Hosting in Italy does not mean that all service data always remains in Italy.

Minors and purchases

Minors may use the service with authorization from a parent or guardian; contact info@neobeta.com to arrange this. Purchases must be managed by an adult. The separate declaration that a visitor is at least 18 applies only to optional statistics: it does not verify identity or replace guardian authorization. Refusing this declaration keeps statistics off and does not block the game. Maxitrainer has no automatic renewals; requests to refund its unused portion are handled through the same contact.

Service retention criteria

Current maintenance uses cutoffs of 180 days for ordinary access logs, 750 days for XML access logs and 45 days for private messages. Some cleanup operations run in bounded batches, so these cutoffs are not guaranteed maximum deletion deadlines. Incoming correspondence, mail queues, incident evidence and paid or refunded entitlement records need separate review and applicable legal retention; PayPal's retention does not remove Maxithlon's local copies. Contact Neobeta for the handling of a specific request.

Backup copies

A daily database backup on a Neobeta server in Italy is retained for 7 days. A daily machine backup on an INCUBATEC server in Italy is retained for 30 days. These are the backup arrangements confirmed by Neobeta. Deleting live data does not instantly remove it from an existing backup. Copies remain subject to their rotation and, before reopening a restored service, later deletion decisions and current consent restrictions must be reapplied.

Consent and retention

Your browser stores your choices and the separate adult self-declaration for 182 days; a different sign-in context requires a fresh declaration. A pseudonymous receipt records the notice version, effective choice and time, without an account identifier, email address, IP address or birth date. Expired receipts are deleted in bounded batches after 365 days. Analytics cookies are configured to expire after 180 days.

Your rights and contact

You can change or withdraw analytics consent at any time using Privacy preferences. Withdrawal stops future optional collection and does not undo earlier lawful processing. Write to the controller to request access, correction, deletion, restriction or portability, or to object where applicable. Neobeta handles requests without undue delay and normally within one month; if a permitted extension is needed, you will be informed within that month. You may lodge a complaint with your supervisory authority, including the Italian Garante.

Age declaration for optional statistics

Optional statistics require a separate declaration that you are at least 18. You can continue playing without statistics. This is a self-declaration; no date of birth or identity document is requested.

Cookies

Necessary services

Session, language and consent cookies support access, preferences and security. Google sign-in and anti-abuse checks are separate from optional analytics.

PHPSESSID, maxithlon_consent

Optional analytics

Google Analytics 4 receives visits to selected pages and limited sign-in or registration events only after optional consent, a separate 18+ declaration and a confirmed server receipt. We send a synthetic page name and address instead of the actual page URL or title, and an empty page referrer. We do not send account identifiers or User-ID. Google receives the network and browser information needed to deliver its service, including the connecting IP address; these requests are not anonymous. Advertising features and Google Signals are disabled. Google Analytics event and user retention is configured to 14 months, without resetting it on new activity; this does not set a lifetime for aggregated reports.

_ga, _ga_CL4JN488LL

Privacy preferences