Privacy Policy

Chadi El-sayed World is an online service operated personally by Chadi El-sayed under the name Chadi El-sayed World and based in Switzerland. Chadi El-sayed is the controller responsible for the personal data described here; the service is not presented as an incorporated company. Privacy requests can be sent to support@chadielsayedworld.com . This Policy applies to the website, accounts, Playverse, videos, cinema, demo reservations, connected community services, and the Bananaverse virtual-reality application distributed through the Meta Quest Store.

1. Our Privacy Commitments

We do not sell personal data, rent user lists, or use personal data for cross-context behavioural advertising. We collect only data reasonably needed to operate, secure, and improve the service. We do not ask for passwords, payment card numbers, or identity documents by email or private message.

2. Data We Collect

Account data. Email address, username, password hash, profile image, account roles, verification state, account creation and update times, and security or ban status.

Optional public profile data. Pronouns, gender identity, sexual orientation, profile image, badges, and other details you deliberately choose to publish. Sexual orientation and some identity information may be sensitive personal data. Providing it is optional, requires an explicit choice, and it can be removed at any time.

Technical and security data. IP address, browser or user-agent information, session and authentication identifiers, login attempts, page requests, security events, and operational logs. Authentication tokens are stored in hashed form where designed to be verified without retaining the original token.

Community activity. Video likes or dislikes, comments, Playverse applications and membership decisions, moderation history, reports, and communications with support.

Connected game data. Minecraft Java username and UUID when you request to link an account. The submitted username is checked through the official Mojang/Microsoft profile service. Bananaverse can process the linked Chadi El-sayed World account ID and username, an opaque PlayFab custom identifier, game profile and progression, multiplayer session information, game settings, moderation or report information, and security events.

Bookings and purchases. Cinema selection, showtime, seats, ticket number, Stripe Checkout session reference, and transaction status. Vision Pro demo reservations may contain visitor name, email address, phone number, selected time, location, attendance, and cancellation status.

Identity verification. The limited local and Stripe-hosted information described in Section 8.

3. How We Receive Data

Data comes directly from you, automatically from your browser and security interactions, from staff actions, and from service providers when needed to complete a payment, verification, email, game-account check, or abuse-prevention process. We do not buy personal profiles from data brokers.

4. Bananaverse Meta Quest App

When you install or use Bananaverse on a Meta Quest device, the app may receive or process: your linked Chadi El-sayed World account ID and username; an opaque identifier used to connect that account to PlayFab; game profile, progression, settings, session and multiplayer state; interactions with other players; moderation reports or enforcement records; IP address; app version; general device, operating-system and network information; and crash, performance or diagnostic information when generated by the app, Meta platform, PlayFab, or hosting services. Meta may also process store, entitlement, Meta account, device, and platform information under Meta's Privacy Policy.

Headset, controller, hand, and movement inputs can be processed in real time to provide virtual- reality controls, locomotion, avatar movement, and multiplayer synchronisation. These gameplay inputs are not used by Chadi El-sayed World to create an advertising profile or intentionally retained as a biometric identity template. If a released Bananaverse feature uses the microphone, voice is processed only after device permission is granted and as needed to provide that feature; the feature will identify any separate recording or moderation retention before it occurs.

We use Bananaverse data to authenticate the player, connect the correct Chadi El-sayed World profile, save and restore progression, operate multiplayer gameplay, provide support, enforce community rules, prevent cheating and abuse, diagnose failures, secure the service, and improve reliability. We do not sell Bananaverse user data or use it for cross-context behavioural advertising. Data is disclosed only as needed to Meta for Quest platform and distribution services, Microsoft PlayFab for game account and backend services, infrastructure providers, and authorised administrators handling support, security, or moderation.

To request deletion of Bananaverse data, email support@chadielsayedworld.com from the address associated with your Chadi El-sayed World account and state that you want your Bananaverse data deleted. Include your Chadi El-sayed World username or numeric account ID so we can locate the correct record. We may ask you to sign in or otherwise verify account control. A valid request deletes or anonymises the linked game profile, progression, PlayFab link and other app data under our control, and we will request corresponding deletion from processors where required. Uninstalling the app does not by itself delete server-side data. Limited security, moderation, legal, dispute, backup, or fraud-prevention records may remain only where retention is necessary and lawful. We aim to complete valid deletion requests within 30 days or explain any lawful delay or exception.

5. Why We Use Data and Our Legal Grounds

We process data to create and authenticate accounts, deliver requested content and bookings, operate Playverse, process payments, communicate service information, prevent fraud and abuse, enforce community rules, protect users, maintain records, and comply with law.

Account registration, authentication, requested bookings, purchases, and delivery of account features are processed to perform the requested service or contract. Security logs, login controls, moderation, duplicate-account prevention, and service integrity rely on our legitimate interests in protecting users and the platform, balanced against individual rights. Payment, tax, accounting, sanctions, safety, and lawful disclosure records are processed where needed to meet legal obligations or establish, exercise, or defend legal claims.

Optional gender identity and sexual-orientation details are processed and displayed only after an explicit choice for that purpose and can be removed from Account Settings. Identity and age verification is initiated only at the user's request for a restricted feature. It relies on the requested verification service, fraud-prevention and safety interests, and, where special-category or biometric consent is legally required, the express permissions presented during the Stripe flow. Consent can be withdrawn for future processing without affecting processing already performed lawfully, although withdrawal may make an optional restricted feature unavailable.

6. Public Information

Username, profile image, public roles, verification badges, published identity preferences, and video comments can be visible to anyone viewing a profile or public page. Do not publish information you want to keep private. Email address, phone number, IP address, authentication data, document details, and exact identity-verification results are not displayed publicly.

7. Cookies and Similar Technologies

Essential cookies maintain sessions, authentication, security, cinema seat locks, and form protection. Disabling them can prevent account and booking features from working. Google reCAPTCHA is used during account creation to detect automated abuse and may receive browser, device, cookie, and interaction data under Google's terms. We do not currently use advertising cookies or behavioural-advertising trackers.

8. Age and Identity Verification with Stripe

Stripe Identity may collect a government-issued identity document, selfie, biometric data used to compare the selfie with the document, and extracted information such as name, date of birth, document type, issuing country, and document number. Stripe Identity does not support users under 16. Identity verification is optional for general website use but required for Playverse and any feature expressly marked as identity- or age-restricted.

We use the result to confirm identity, determine whether a user is 18 or older, prevent one person or identity document from verifying multiple accounts, and display badges. We do not copy the legal name, document, selfie, biometric template, document number, or date of birth into our local database. Locally, we store the account ID, Stripe Verification Session ID, live/test mode, result status, 18+ result, timestamps, and keyed non-reversible fingerprints derived separately from the verified document details and from the verified legal name and date of birth. A document match is blocked automatically; a name-and-birth-date match is held for administrator review because two different people can share those details. These fingerprints are used only for duplicate prevention and cannot be decrypted to reveal the source information.

Stripe-hosted information can be accessed only by specifically authorised administrators when needed for support, security, fraud prevention, review, or a rights request. Stripe states that biometric data is generally retained for up to one year and non-biometric verification data for up to three years, subject to consent, deletion, and legal requirements. See the Stripe Identity FAQ and Stripe Privacy Policy.

9. Service Providers and Disclosures

We disclose only the data necessary for a provider's task. Current categories include hosting and infrastructure providers; Meta for Quest Store, entitlement, device, and platform services; Microsoft PlayFab for Bananaverse account linking, game data, and backend services; Stripe for payments and identity verification; Google reCAPTCHA for bot prevention; Infomaniak infrastructure for transactional email; and Mojang/Microsoft for Minecraft profile validation. Authorised administrators can access data needed for support, safety, bookings, and moderation.

We may also disclose information when required by valid law, to protect a person's safety or legal rights, to investigate fraud or security incidents, or as part of a legitimate organisational transfer with appropriate safeguards. We do not provide personal data to advertisers for sale or targeting.

10. International Processing

Providers may process data in Switzerland, the European Economic Area, the United Kingdom, the United States, and Canada according to the provider and feature. Where required, transfers are protected by an adequacy decision, recognised standard contractual clauses, contractual and technical safeguards, or another lawful transfer mechanism. Provider privacy notices linked or identified in this Policy contain their current processing locations and safeguards. Contact us to request available information about the safeguard used for a particular transfer.

11. Retention

Account and profile data is retained while the account is active and then deleted or anonymised after a valid deletion request, subject to limited legal, payment, dispute, backup, and safety needs. Authentication tokens remain only until expiry or revocation. Temporary codes and rate-limit data are short-lived. Legal acceptance records contain the account identifier, acceptance time, IP address, user agent, version identifiers, and SHA-256 fingerprints of the accepted documents. Exact archived copies of published legal versions are retained so we can demonstrate which text was accepted. Community content remains until removed, moderated, or the related account or content is deleted.

Bananaverse cloud profile and progression data is retained while the linked account or game service remains active and is then deleted or anonymised following a valid deletion request, subject to the limited exceptions described in Section 4. Local settings stored only on the headset remain under the user's device controls and are normally removed when app data is cleared or the app is uninstalled. Processor and backup deletion may complete on their normal secure cycles.

Security logs, IP and user-agent records are retained only for the period reasonably needed to investigate abuse, maintain service integrity, and defend legal claims, with longer retention limited to an active incident or legal requirement. Booking, ticket, and payment records are kept for operational, accounting, tax, chargeback, and legal retention periods. Identity records remain while needed for the verification feature and duplicate-fraud prevention. Retention is reviewed when an account is deleted; data that no longer has a valid purpose is deleted or anonymised.

Retention is determined by the account relationship, token or code expiry, security risk, applicable limitation periods, tax and accounting requirements, unresolved disputes, and backup rotation. Stripe's identity retention periods are described in Section 8. A valid request may result in earlier deletion or Stripe redaction unless continued retention is necessary for security, fraud prevention, legal compliance, or legal claims. Published legal-document archives contain the documents themselves; acceptance records linked to an account are retained only for accountability and legal evidence.

12. Your Privacy Rights

Depending on applicable law, you may request access, a portable copy, correction, deletion, restriction, or objection; withdraw consent; and appeal a refused privacy request. You may also complain to the Swiss Federal Data Protection and Information Commissioner or the competent authority where you live. California and other eligible US residents may exercise applicable rights to know, access, correct, or delete data without discriminatory treatment. Because we do not sell or share personal data for targeted advertising, there is no sale or advertising share to opt out of.

EEA and United Kingdom users may complain to the supervisory authority where they live, work, or believe an infringement occurred. Canadian users may contact the Office of the Privacy Commissioner of Canada or the applicable provincial authority. Eligible United States residents may exercise rights provided by their state law, including applicable rights to know, correct, delete, obtain a copy, or appeal. These regional rights apply only where the relevant law covers the processing.

All formal account and privacy requests must be sent to support@chadielsayedworld.com. This includes requests to access or receive a copy of your data; correct, update, or remove account or profile information; recover or change account access; review access to a feature or service; and close or delete an account. Where a secure self-service control is available in Account Settings, support may direct you to use it.

Discord, WhatsApp, social networks, private messages, and in-person conversations are not secure formal channels for authorising access to, disclosure of, correction of, or deletion of account data. If a request is mentioned through one of those channels, we will direct the requester to the official support email. We will not make the requested account or data change until the request is received through the support process and account control is reasonably verified. Urgent safety reports and communications that applicable law requires us to recognise may still be recorded and handled appropriately, but identity verification remains necessary before personal data is disclosed or an irreversible account action is completed.

We may request proportionate information to verify that you control the account before acting or disclosing data. We aim to respond within 30 days and will explain if more time or lawful retention is necessary. Requests involving roles, permissions, moderation decisions, age requirements, or access to restricted services are reviewed under the Terms of Use, eligibility rules, and security requirements; submitting a request does not guarantee that special access will be granted.

To provide accountability and avoid misunderstandings, we keep a limited support record that may include the request date, account reference, request category, verification steps, actions or decision, staff handling the request, and completion time. We do not need or want identity documents sent through social networks. Support records are accessible only to authorised staff and retained only as long as reasonably needed for the request, security, dispute handling, legal compliance, or the establishment, exercise, or defence of legal claims.

13. Children and Teenagers

Accounts are intended only for users aged 13 or older. Users under 13 must not create or use an account, even with parent or guardian permission. If we learn that an account belongs to someone under 13, we may restrict and ban it and take reasonable steps to delete the associated personal data, except for limited records that must or may lawfully be retained for security, legal, dispute, or age-restriction enforcement purposes.

Where local law requires a higher minimum age or additional permission for a user aged 13 to 17, that higher requirement also applies. If you believe we hold personal data from a user under 13, contact us at support@chadielsayedworld.com so we can investigate and take appropriate action.

14. Security and Incident Response

Measures include password hashing, scoped and expiring authentication tokens, secure cookies, request-forgery protection, rate limiting, access controls, audit logging, restricted identity credentials, and data minimisation. No system is perfectly secure. We investigate suspected incidents and notify authorities or affected users when applicable law requires it.

15. Automated Processing

Security tools and Stripe can produce automated risk or verification results. These results can limit access to a protected feature, but Playverse membership is reviewed rather than sold or guaranteed. A document fingerprint match can automatically prevent reuse of the same verified document, while a protected name-and-date-of-birth match is referred for human review. Contact support to express your point of view and request human review when an important result is incorrect.

16. Updates and Contact

We may update this Policy when services, providers, or laws change. Material changes will be highlighted with a new effective date and communicated reasonably when required. We may pause authenticated account access until the complete current legal documents have been reviewed and the required choices have been explicitly confirmed. The service is operated from Switzerland and this Policy also describes additional EEA, United Kingdom, United States, and Canadian rights where those laws apply. Questions, complaints, and rights requests can be sent to support@chadielsayedworld.com .