Mexar 
Mexar 
Last updated 25/10/2026
This notice explains what personal data Mexar Airsoft collects when you use this website and our app, why we use it, the legal reason that allows us to, who else handles it, how long we keep it and the rights you have. Players use Mexar from all over the world. We follow UK data protection law (the UK GDPR and the Data Protection Act 2018, as updated by the Data (Use and Access) Act 2025), and for players in the European Union and the European Economic Area, the EU GDPR as well.
01Who we are
Mexar Airsoft (mexarairsoft.com) is run by ELITE4U LTD (“we”, “us” or “our”), a company registered in England and Wales, company number 14657268, registered office Office 7775, 321-323 High Road, Romford, England, RM6 6AX. We decide how and why your personal data is used, which makes us the controller of that data. For any question about your personal data, email info@mexarairsoft.com.
02What we collect
What you give us: your email address, date of birth, display name, countries, profile, photos, kit, comments, messages, reviews, reports, support requests, footage, enquiries and, for site and shop owners, claim details.
What we record when you use the site: sign-in events, the IP address and device a form or upload came from, the location your device gives when you clock in, hearts, saves and visits, and the payment status our payment providers send us.
What others give us: Stripe, Apple and Google tell us whether a payment went through. Apple and Google tell us your email address if you sign in with them. Other players may mention you in a comment or report something you posted.
03Our lawful bases at a glance
UK law only lets us use personal data when we have a lawful basis. The table shows the basis for each use. Each one is explained in the sections below.
| What we use your data for | Legal reason (lawful basis) |
|---|---|
| Site visit and click figures | Consent |
| Counting clicks on links to shops and sites | Legitimate interests (knowing which links people use) |
| Mailing list | Consent |
| Referral credit | Consent (the Marketing cookie choice) |
| Reviews | Legitimate interests (publishing honest reviews) |
| Player accounts, profiles, comments and teams | Contract |
| Clock-in, XP, game history and UKARA game checks | Contract |
| Site and shop owner accounts | Contract |
| Paid plans | Contract, and legal obligation (tax records) |
| Signing in and two-step sign-in | Contract, and legal obligation (keeping data secure) |
| Footage and sponsor enquiries | Legitimate interests (replying to you and choosing footage) |
| Reports, moderation decisions and appeals | Legitimate interests (keeping the site safe), and legal obligation (Online Safety Act 2023) |
| Safety checks, spam protection and blocks | Legitimate interests (keeping the site safe), including preventing crime and safeguarding |
04Site figures
If you allow Analytics in the cookie panel, our own server counts which pages you open, which page sent you to us and which buttons or links you press. From the request it also notes your device type and your rough location (country and city). Your IP address is turned into a scrambled code that changes every day, and the key used to make it is deleted every day, so we can count visitors without knowing who they are. We never store your IP address with these figures, we set no cookie for them and we never use them for advertising.
When you click one of our links to a shop or an airsoft site, we count the click with your device type, the website you came from and your country. This happens whatever your cookie choice, stores nothing on your device and is not linked to you.
Lawful basis: consent for site figures, which you can withdraw at any time in Cookie settings. Legitimate interests for link clicks, so we know which links are useful to players and partners.
05Our mailing list
If you join our mailing list, we keep your email address, where you signed up, when you agreed, the exact wording you agreed to and your country. If you give a postcode for local news, we keep only the first half of it (for example, RM4) and the rough area it covers, never your full postcode. We use this only to send you giveaways, discount codes, local game days and offers from Mexar Airsoft. We never sell your email address or pass it to brands.
Every email has an unsubscribe link. Once you unsubscribe, we keep your address only on a “do not send” list, so you are never emailed by mistake. You can ask us to delete it completely by emailing info@mexarairsoft.com.
Lawful basis: consent.
06Reviews
When you review a site, we keep your name, email address, star rating, written review and any photos (up to four). Once you confirm the review from the email we send and we have checked it, your name, rating, review and photos are published on the site. Your email address is never published. We only use it to confirm the review is yours. We keep a review for as long as it is published.
Lawful basis: our legitimate interest in publishing honest reviews.
07Player accounts and profiles
When you create a player profile, we keep your email address, date of birth, display name, the country you are from, the country you play in, your home site if you pick one, your bio, your photos, your guns, parts, gear and loadouts, your card design, your XP, rank and achievements, and your plan. We use your date of birth only to check that you are 18 or over. It is never shown to anybody.
Player pages are for signed-in players only. The list of players, the leaderboard and your full profile, with your photos, guns and gear, are shown only to people signed in to an account, and are hidden from search engines. The one exception is the top five of the leaderboard on our public Ranks page, which shows their display name, profile photo, the country they are from (as a flag), rank, level and XP. Your email address is never shown.
When you join, we ask where you heard about us. Answering is optional, the answer is never shown, and we use it only to see what brings players to the site.
If you add a home postcode for local game alerts, we keep it, the rough location it covers and how far you are happy to travel. It is never shown to anybody. We use it only to pick which game days to tell you about. You can remove it at any time from your account. To turn a postcode into a rough location, your browser asks postcodes.io (UK postcodes), and our server asks Zippopotam.us or OpenStreetMap Nominatim (postcodes outside the UK). They are sent the postcode only.
Every photo you add is re-saved by us, which removes the location and camera details hidden inside it (EXIF data). It is then checked automatically before anybody else can see it, and a photo that is turned down is deleted. Photos are kept in private storage and are shown through links that stop working within an hour, so a copied link does not keep working. If you think a photo was turned down by mistake, email us and a person will look at it.
Lawful basis: contract. We need this information to provide the account you asked for.
09Clock-in, XP and game history
When you press clock in at a site, your device asks for your location once, at that moment, and only if you allow it. We keep that location, how accurate your device said it was, how far it was from the site, the site and the date. We use it only to confirm you were at the site on a game day, to award XP and rank, and to build your game history. We never track your location in the background or at any other time.
Your game history (where and when you played), XP and rank appear on your profile. Other players see a game only 24 hours after you clock in, so your profile never shows where you are right now. We can see every clock-in so we can spot and cancel fake ones, and we keep a note of why one was cancelled.
At a site registered for UKARA checks with us, the site's staff can scan your game pass. They see your display name, your photo, whether you are 18 or over (never your date of birth) and the games verified at their site. The first time they check you, they record the kind of ID they looked at, for example a passport. They never record the number on it or a picture of it. Your address for a UKARA form is typed in on the staff member's phone when the form is printed and is never sent to us.
The exact location (the coordinates) is deleted automatically 30 days after the clock-in. After that we keep only the site, the date, the distance from the site and whether the clock-in counted. Those records are kept for as long as your account exists and are deleted with it. If you tell us a site is missing from the list, we keep where you were standing only to about 100 metres, so we can find the site, and delete it 30 days after we have dealt with your suggestion.
Lawful basis: contract. Clock-in and UKARA checks are features you choose to use.
10Teams
If you start or join a team, the team's name, badge, photos and comments, and its members' display names, roles and ranks, are shown on the team's page. The captain decides who is in the team and can block players from it. Team photos are checked automatically in the same way as player photos. Leaving a team removes you from its page.
11Site and shop owner accounts
If you claim a listing for an airsoft site or shop, we keep your name, your town, a contact phone number and any note you send, so we can check the claim is genuine. If you are given access to run a listing, we keep your email address and your role (owner or staff) on that listing.
Lawful basis: contract.
12Paid plans
If you buy any plan on the website, the plan is sold through Link (Onelink), Stripe's checkout service, which is the seller of record and takes the payment. Link uses your payment and billing details as its own controller, under its own privacy notice. In our app, Apple or Google take it. We never see or store your card number. We keep the plan you have, when it renews or ends, whether a payment failed, and the reference numbers that link the payment to your account.
If a paid plan goes back to Free, anything over the Free limits is hidden, not deleted, for six months, so it comes back if you subscribe again. After six months on Free, that hidden content may be deleted.
If your account is closed, your plan is cancelled first and our own plan record is deleted with your account. Stripe, Apple or Google keep the payment and invoice records, which we must keep for as long as UK tax law requires. They hold them under their own privacy notices.
Lawful basis: contract, and our legal obligation to keep tax records.
13Signing in and two-step sign-in
Sign-in is run by Supabase. Your password is stored in a scrambled form (hashed) that nobody can read, including us. If you turn on two-step sign-in, the details your authenticator app needs are stored with your account so the six-digit code can be checked.
Lawful basis: contract, and our legal obligation to keep your personal data secure.
14Footage
When you send us a clip, we keep your email address, your player name if you give one, how you want to be credited (or that you want to stay anonymous), the files and their names, your confirmation that you are 18 or over and own the rights, and the IP address, rough location (country and city) and device type you sent it from.
Each clip is checked automatically before anybody watches it: for viruses, for nudity, to confirm it is a real video, and that it is airsoft. To do this, still frames from the clip are shown to an AI service (Anthropic). A clip that passes goes into our Google Drive folder for us to review. A clip that fails is deleted, and if it was not airsoft we email to tell you.
To keep the site safe, an upload with nudity blocks the email address and IP address it came from. A virus or a file that is not a video counts as a strike, and two strikes block the sender. If a clip appears to show the sexual abuse of a child, we do not open, copy or delete it. We block the sender and report it to the police (CEOP, part of the National Crime Agency) and the Internet Watch Foundation, and we give them what they need.
Footage we use is covered by our footage terms. Footage we do not use is deleted once we no longer need it, or sooner if you ask.
Lawful basis: our legitimate interest in choosing and crediting footage and in keeping the site safe. For suspected child abuse material, preventing crime and safeguarding children, which UK law treats as recognised legitimate interests.
15Sponsor and partner enquiries
If you send a sponsor enquiry, we keep your company, name, email address, website, what you are interested in, your message, your country and whether you asked to join the mailing list. We use it only to reply to you. We delete old enquiries once we no longer need them, or sooner if you ask.
Lawful basis: our legitimate interest in replying to you.
16Keeping the site safe
When you send any form, we use the IP address it came from to stop floods of fake requests. That record is deleted automatically after a short time. A short check from our host, Vercel, also confirms the form was sent by a person and not a bot.
We keep a log of sign-ins and of every upload, with the IP address and device it came from, so we can trace abuse and protect accounts. These logs are deleted automatically after one year. The IP address and device ID kept with a clock-in, a report, a photo check, a referral, a missing-site suggestion or a form you sent are cleared automatically after one year; the rest of that record stays.
After three failed sign-in attempts, a check from Cloudflare (Turnstile) asks you to prove you are a person. If we turn it on, proxycheck.io is sent the IP address of a clock-in to spot a VPN or proxy being used to fake a location.
If someone breaks our rules, we may block their email address, IP address or device and note why. When a referral is credited, we keep a scrambled code made from the IP address so one person cannot credit themselves many times. We also keep a log of important actions on the site, such as moderation decisions, so we can show what happened and why.
Lawful basis: our legitimate interest in keeping the site and its players safe, which includes preventing crime.
17Reports and moderation
When you report something, we keep what you reported, why, your account or email address, and what we decided. If your content is reported, we keep the report and the decision too. Content is checked automatically first (including by an AI service, Anthropic), and a person reviews reports and appeals. You can appeal a decision about you, as set out in our terms.
Reports, decisions and appeals are kept for six years (a reporter's IP address is cleared after one year, but the copy of the sign-in and upload logs we attach to a reported item, IP addresses included, stays with the case for the six years), so we can deal with a repeat problem, answer a complaint or a legal claim and show a regulator what we did. Material we must report to the police or the Internet Watch Foundation is kept, and handed over, only as the law requires.
Lawful basis: our legitimate interest in keeping the site safe, and our legal obligations under the Online Safety Act 2023.
18Under-18s
Player profiles, footage, giveaways and paid plans are for people aged 18 or over. We check your date of birth when you create a profile, and we ask you to confirm you are 18 or over when you send footage. We do not knowingly keep personal data about anybody under 18. If we find that we do, we delete it. Photos of a child that have nothing to do with airsoft are turned down. Photos from a game can show younger players in kit, because sites let them play.
20International transfers
We are based in the UK, so if you live in the European Union your data comes to the UK, which the EU has recognised as giving adequate protection. Some of our providers handle personal data outside the UK, mainly in the European Union and the United States. Where they do, we rely on UK adequacy regulations (which cover the EU, and US companies signed up to the UK Extension to the EU-US Data Privacy Framework) or on the safeguards the law requires, such as the International Data Transfer Agreement, the UK Addendum or the EU Standard Contractual Clauses. Email us for a copy of the safeguard that applies.
21How long we keep your data
Your account, profile, photos, kit, comments, hearts, visits, clock-ins and team membership are kept until your account is closed. You can close it at any time: press Delete my account under Your data in your account settings, which closes it straight away, or email info@mexarairsoft.com from the address you sign in with, which we do within one month. Closing it deletes your sign-in, your profile, every file you gave us (photos, screenshots, clips still being checked and review photos), your support requests, reviews, mailing list entry and clips you sent, and our payment record. We keep only a note that an account was closed and when, with nothing that identifies you. If you captain a team, you need to hand over the captain role, or ask support to close the team, first.
Clock-in coordinates, and the position kept with a missing-site suggestion, are deleted after 30 days. A report that a site's pin is in the wrong place, with the position and device it was sent from, is deleted after 180 days. Sign-in logs and upload logs, with their IP addresses, are deleted after one year, and every other IP address or device ID we keep is cleared after one year, except the copy attached to a report case. Reports, moderation decisions and appeals are kept for six years. Suspected child abuse material is kept and handed over only as the law requires. Mailing list entries are kept until you unsubscribe (then only as a "do not send" record). Reviews are kept while they are published. Hidden paid-plan content is kept for six months, as explained above. Payment records are kept by Stripe, Apple or Google as UK tax law requires. Spam protection records are deleted after a short time. Blocks are kept for as long as they are needed to keep the site safe. Anything else is deleted once we no longer need it for the reason we collected it.
23Your rights
You have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to limit how we use it, to get it in a format you can take elsewhere, to object to how we use it, and to withdraw your consent at any time. You can ask for a copy of your data with Request my data under Your data in your account settings: we email it to you as a file you can open or take elsewhere. To delete your account, press Delete my account in the same place. To use any other right, email info@mexarairsoft.com. We reply within one month. If a request is complex, we may need up to two more months, and we will tell you why within the first month. If we need more information to find your data or confirm who you are, the month starts once we have it.
24How to complain
If you are unhappy with how we have handled your personal data, please complain to us first by emailing info@mexarairsoft.com. We will confirm we have received your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. If you live in the European Union or the European Economic Area, you can complain to the data protection authority in the country where you live or work, or where you think the problem happened.
25Changes to this notice
We will update this notice when what we collect or how we use it changes. The date at the top shows when it last changed.
08Comments, hearts and visits
Comments you leave on a player's or team's profile are public on that profile. We also keep the hearts, likes and saves you give, and any comment you report and why. A player can delete comments on their own profile.
When you are signed in and open another player's profile, we record that you visited, when you last visited and how many times. That player can see this in their own account. Team pages show how many visits they have had, but not who made them.
Lawful basis: contract. These are features of the player community you joined.