Privacy Policy

GTA6 Cartel is an independent fan site dedicated to news, guides, community discussion, and user-created modifications ("mods") for the game Grand Theft Auto VI. We are the data controller for the personal information described in this policy.

We are not affiliated with, endorsed by, or sponsored by Rockstar Games, Take-Two Interactive, or any of their subsidiaries. If you have any question about privacy or your data, you can reach us at [email protected].

Account data. When you register, we collect your email address, your chosen username, your first and last name, and your country. Your password is never stored in plain text: we keep only a one-way bcrypt hash of it, which cannot be reversed back into your password.

Content you create. This includes mods you upload together with their files, images, titles, and descriptions; forum threads and replies; comments on articles and on mods; and the star ratings you leave on mods. This content is published on the site and is visible to other visitors.

Technical data. When you use the site we process your IP address and your browser user-agent string. We use these strictly for security purposes, rate-limiting, and preventing abuse and spam. We do not build advertising or behavioural profiles from them.

We use your data to operate and secure the service, and specifically to:

• Create and manage your account and keep you signed in.

• Send transactional emails such as email verification codes, password resets, and important account notices.

• Publish the content you choose to submit (mods, posts, comments, ratings) and attribute it to your username.

• Moderate the community and enforce our Terms, including reviewing mods before they go live.

• Prevent, detect, and respond to spam, abuse, fraud, and attacks against the site.

Where data protection law such as the EU/UK GDPR applies to you, we rely on the following legal bases:

• Performance of a contract: processing that is necessary to provide the account and features you request, such as running your account and publishing your content.

• Legitimate interests: keeping the service secure and free of abuse, spam, and fraud, and defending our legal rights. We limit this processing to what is necessary for those aims.

• Consent: where we ask for it explicitly, for example if we ever introduce optional features. You can withdraw consent at any time.

We use only strictly necessary cookies. These are the authentication and session cookie that keeps you logged in (managed by NextAuth) and the cookies and tokens set by Google reCAPTCHA, which protects our sign-up and login forms against automated bots.

We do not use advertising cookies, cross-site tracking, or profiling cookies of any kind. Our content delivery and security provider, Cloudflare, may also set a strictly necessary security cookie.

For the full details, please see our Cookie Policy.

Transactional emails, such as verification codes, password reset links, and account notices, are sent from our own mail server at [email protected]. These messages are a necessary part of operating your account.

We do not sell your email address, and we do not send marketing spam. You cannot opt out of essential transactional emails while your account is active, because they are required for security and account management.

We keep third parties to a minimum, and we do not sell your personal data to anyone.

• Cloudflare provides our CDN, DNS, and DDoS protection. As traffic passes through it, Cloudflare processes request metadata including your IP address to deliver and secure the site.

• Google reCAPTCHA provides bot protection on our authentication forms. Your use of reCAPTCHA is subject to Google's own privacy policy and terms.

These providers act as processors or independent controllers for the limited purposes described above.

We keep your account data and the content you create for as long as your account remains active, so that the service can function and your contributions stay available to the community.

If your account is deleted, we delete or anonymise the personal data associated with it, except where we must keep limited records to comply with a legal obligation or to resolve disputes. Account deletion can be carried out by an administrator on request, so you can ask us at [email protected] to delete your account.

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted (the "right to be forgotten"), to object to or restrict certain processing, and to receive a copy of your data in a portable format.

To exercise any of these rights, email us at [email protected]. We may need to verify your identity before acting on a request.

If you believe we have not handled your data properly, you also have the right to lodge a complaint with your local data protection authority.

The site is not directed to children. You must be at least 13 years old to create an account, or older where your local law sets a higher minimum age for online services (for example, 14 in Spain).

If you believe a child has given us personal data without the appropriate consent, contact us at [email protected] and we will delete it.

The servers and service providers we use may be located in a country different from your own. Where personal data is transferred internationally, we rely on our providers' safeguards and applicable legal mechanisms to protect it.

We may update this Privacy Policy from time to time. When we do, we will revise the "last updated" date at the top of this page, and significant changes will take effect when published.

If you have questions about this policy, contact us at [email protected].