Peng Services (“we”, “us”, “our”) operates this website and platform for staff-verified Old School RuneScape (OSRS) services, including on-site wallets, orders, chats tied to orders and payments, and worker matching. This policy explains what personal data we process, why, and what choices you have.
1. Who this applies to
This policy applies to visitors and to users who create an account, place orders, use the wallet (fiat or crypto flows), participate in chats, or otherwise use our services.
2. Data we collect
Depending on how you use the site, we may process:
- Account & identity: name, email address, profile image (if you sign in with Discord or email), Discord user ID when you use Discord OAuth, and internal user ID.
- Authentication: session tokens and related security data managed by our auth provider (e.g. Auth.js) and your browser.
- Orders & services: order details you submit (titles, quantities, amounts, notes), order status history, and links between orders and chat rooms.
- Wallet & payments: ledger entries, payment requests (deposits / withdrawals), amounts, statuses, and staff review notes where applicable; for crypto, proof and details you provide in chat (e.g. transaction references) as staff use to verify payment.
- Messages: content you send in support, order, and related chat rooms, including text and links or attachments you choose to post (e.g. payment proof URLs).
- Technical data: IP address, browser type, and similar data typical of web servers and hosting; cookies as described below.
- Optional features: e.g. tips between users where enabled, ranks or badges displayed on your profile or in the UI.
3. Cookies & similar technologies
We use cookies and local storage as needed to run the site (e.g. sessions, security, and your cookie consent choice). You can control non-essential cookies through our cookie banner. See also our Terms & Conditions for general use rules.
4. How we use your data
We use personal data to:
- Provide, operate, and improve the platform (accounts, orders, wallet, chat, matching).
- Process payments, staff review, fraud prevention, and audit trails where we log staff actions.
- Communicate with you about your account, orders, or payments as needed.
- Comply with legal obligations and enforce our terms.
5. Legal bases (EEA / UK users)
Where GDPR applies, we rely on contract (providing the service you request), legitimate interests (security, fraud prevention, product improvement), and legal obligation where required. Where we ask for consent (e.g. optional cookies), you may withdraw it at any time without affecting lawful processing before withdrawal.
6. Sharing & processors
We share data with service providers who help us run the site, for example: hosting, database, transactional email (such as sign-in verification codes), and file storage if you upload or link assets. Realtime messaging is handled on our own hosting infrastructure and is not shared with a separate messaging provider. They may only process data on our instructions and where contractually required to protect it.
Staff and authorized admins can access data needed to verify payments, moderate chats, and complete orders—consistent with how the product is described on the site.
7. Retention
We keep data for as long as your account is active and as needed for legal, tax, accounting, or dispute resolution. Chat and order history may be retained to maintain a record of service delivery and payment handling unless we are required or choose to delete it sooner where the law allows.
8. Security
We implement appropriate technical and organizational measures for a web application of this kind. No method of transmission over the Internet is 100% secure; use strong passwords and protect your Discord and email access.
9. Your rights
Depending on your location, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise these rights, contact us via the details on our Contact page. You may also lodge a complaint with your local data protection authority.
10. Children
Our services are not directed at children under 13 (or the minimum age in your country). We do not knowingly collect personal data from children.
11. International transfers
Your data may be processed in countries where we or our providers operate. Where required, we use appropriate safeguards (e.g. standard contractual clauses).
12. Changes
We may update this policy from time to time. We will post the new date at the top and, where appropriate, notify you through the site or email.
13. OSRS disclaimer
Peng Services is not affiliated with or endorsed by Jagex Ltd. Old School RuneScape is a trademark of Jagex Ltd. In-game assets and trademarks belong to their respective owners.