ACE MODDING TOOLS
// UNOFFICIAL COMMUNITY SUITE
// FOR ASSETTO CORSA EVO
Privacy
Last updated: 21 September 2026
This notice describes how ACE Modding Tools handles personal data collected on acemt.guidetutorials.it (Articles 13 and 14 GDPR).
1. Controller and contacts
The controller is the operator of the ACE Modding Tools community suite on acemt.guidetutorials.it. For requests use Contact in the menu or email acemt@guidetutorials.it. No data protection officer is appointed at this stage. ACEMT is unofficial and is not affiliated with Kunos Simulazioni.
2. Data we process
We process email, nickname, password hashes, 2FA status, login sessions, registration and last-login site, browser user-agent, country, preferred language, and a profile photo if you upload one. From Contact we receive the message text and sender IP. If you sign in with OAuth we receive the email and minimum identity from Google, Discord or GitHub. If you use ACMT Agent we process hostname, OS, a device identifier, Agent/tool versions and your tool library. The wallet stores credit balance, holds, ledger history and purchase amounts. If you save a BYOK key we store it encrypted plus a short hint. The inbox stores notification title/body and read/hidden state. We do not sell data and we do not run advertising profiling.
3. Purposes and legal bases (Art. 6 GDPR)
Contract (Art. 6(1)(b)): create and run your account, hub, tools, in-app inbox, credit wallet, checkout and Agent. Legitimate interest (Art. 6(1)(f)): security, guest anti-spam with Turnstile, technical logs, and encrypted offsite backups for service continuity. Legal obligation (Art. 6(1)(c)): tax and invoicing handled by Paddle as merchant of record. Consent (Art. 6(1)(a)): optional cookies only. No optional scripts run today; Accept will enable them when analytics/SEO are added.
4. Account, email and OAuth
Registration uses email and password with confirmation. Login, password reset, 2FA and recovery codes are sent by email via Brevo from our noreply address. OAuth (Google, Discord, GitHub) runs only if you choose it; we do not post to your social accounts.
5. In-app notifications
Notifications stay in the hub (bell and Profile). Sources: ACE Site, System (welcome, gift credits, billing or donation) and Agent (stable releases). There is no browser push and no newsletter. Delete hides the message for you only.
6. Credits and payments
Software and downloads stay available with an active account; there is no software paywall. One credit equals one successful Managed vehicle generation. Developer tips do not add credits. Checkout uses Paddle Billing as merchant of record: we share your ACEMT user id, email and SKU. Paddle issues the invoice and VAT. Paddle privacy: https://www.paddle.com/legal/privacy
7. AI key (BYOK)
An optional Google AI Studio key can be stored encrypted (AES-256-GCM) on the server and used only for your generations (zero credit cost). You can delete it from Profile. Processing at Google then uses your key.
8. Agent and PCs
To install and update tools we register PCs you pair (per-account device limit). Bearer device tokens last about 180 days. Revoke or uninstall removes Agent/tool binaries, not your local project files.
9. Contact and Turnstile
Contact sends name, email, message and IP by email (Brevo). From is our noreply mailbox; Reply-To is yours. Logged-in users send from the verified account email, without captcha. Guests are checked with Cloudflare Turnstile (invisible captcha). Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-addendum/
10. Recipients
Hosting of this site; Backblaze B2 (encrypted backup copies for disaster recovery); Brevo (email); Cloudflare (Turnstile); Paddle (payments); Google, Discord or GitHub if you use OAuth; Google if you use BYOK. We do not share data for marketing.
11. Transfers outside the EEA
Offsite backups are stored in the EU (Backblaze B2 eu-central-003), encrypted before upload, and cannot be read without our vault keys. Backblaze is a US company and applies its own safeguards. Paddle, Cloudflare, Google, Discord and GitHub may process data outside the European Economic Area under their own safeguards (standard contractual clauses or equivalent). See each provider’s privacy notice. Backblaze: https://www.backblaze.com/company/privacy.html
12. Retention
Account and wallet last while the account is active, then we delete on request. Login session: 8 hours. Account flag and language: 1 year. Device tokens: about 180 days. BYOK until you remove it. Inbox until you hide a message or staff retracts it. Contact messages for the time needed to handle support. Encrypted backup copies on Backblaze B2 are kept for about 90 days (bucket lifecycle), then deleted.
13. Your rights
You may request access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (without affecting processing already carried out). Use Profile or Contact.
14. Complaints
You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): https://www.garanteprivacy.it
15. Children
This service is not directed at people under 16.
16. Automated decisions
We do not take automated decisions with legal or similarly significant effects, and we do not run marketing profiling.
17. Updates
The date at the top is the last update. A material change gets a new policy version and the cookie banner is shown again.