Privacy Policy

1. Controller

The controller responsible for the processing of personal data in Ages of Settlement (the "Game") is:

For all privacy questions and requests, write to the email address above or use the contact form.

2. What we process, why, and on which legal basis

Account

Username, display name, email address, a hash of your password and of your recovery code, the public keys of passkeys you add, and sign-in sessions. We need these to create and secure your account and to provide the Game (Art. 6(1)(b) GDPR). We send emails to confirm your address, for sign-in links, about your purchases and about important changes to the Game or these documents.

Security and fraud prevention

When you register, confirm your email, sign in with a link or passkey, change passkeys or restart your settlement, we record the time, your IP address, browser and device information (user agent and browser client hints), preferred language, and the approximate location and network that our hosting provider derives from your IP address (country, region, city, postal code, approximate coordinates, time zone and network operator). We use them to protect accounts, detect and prevent fraud, abuse, multiple accounts and payment misuse, enforce our Terms, and establish, exercise or defend legal claims. The legal basis is our legitimate interest in a secure and fair game and in protecting our business (Art. 6(1)(f) GDPR).

Gameplay and community

Your settlements, progress, resources, Platin balance and history, purchases with Platin, items, quests, guild membership, friends and blocks, trades and auctions, chat messages, private mail and gifts. We need these to provide the Game, including its multiplayer features (Art. 6(1)(b) GDPR), and we review them to moderate content and enforce our Terms (Art. 6(1)(f) GDPR). Your username, display name and settlement are visible to other players; chat and mail are visible to their recipients.

Purchases

Payments are processed by Stripe. Stripe collects your payment details directly on its checkout page; we never receive your full card number. We receive and store the order (pack, price, currency, time), its status, Stripe's identifiers for the checkout, payment and charge, the receipt link, refunds and disputes, and the time at which you agreed to immediate delivery. To show the withdrawal notice where it applies, we use the country that our hosting provider derives from your IP address. We process this to perform the purchase (Art. 6(1)(b) GDPR), to comply with accounting and tax obligations (Art. 6(1)(c) GDPR), and to prevent fraud and handle chargebacks (Art. 6(1)(f) GDPR). Stripe also processes your data as an independent controller under its own privacy policy.

Contact requests

When you use the contact form, we process your name, email address, topic and message, your account if you are signed in, your IP address and browser information. A spam check by Cloudflare Turnstile runs on the form. We use this to answer you and to prevent spam and abuse (Art. 6(1)(b) and (f) GDPR).

Statistics and error reports

We record a small number of events about the Platin store (for example that a pack or product was viewed or a receipt opened) and the days on which you play, together with your account, to improve the Game and the store and to measure purchases. When you register, we also record how you found us: the website that linked to us (its domain only), campaign tags in the link (such as utm_source) and the page you arrived on. If the Game encounters a technical error in your browser, it sends us the error message, the page address (without its parameters) and your browser type, together with your account if you are signed in, so that we can fix it. We use no third-party analytics, advertising or tracking. The legal basis is our legitimate interest in running and improving the Game (Art. 6(1)(f) GDPR).

On the start page, optional first-party statistics record visits and a limited set of interface choices, such as opening the account form or selecting a walkthrough step. These observations contain a random identifier for the current browser tab, an event identifier, an allowed choice and the time received. They do not contain your name, email, account identifier, page parameters, IP address or browser fingerprint, and we do not link the tab identifier to your account. We honor browser Do Not Track and Global Privacy Control signals. Separately, for new accounts, we measure registration, email confirmation, world setup, entry into the Game and the first delivered timber using the server’s account and game records. The private report shows aggregate counts.

3. Cookies and local storage

We use one strictly necessary cookie that keeps you signed in, and your browser's local and session storage for game settings (such as audio), for a device identifier that tells your tabs apart for game control, and to continue an interrupted checkout. These are necessary to provide the service you request and do not require consent. We do not use advertising or tracking cookies.

The optional start-page statistics use a random identifier in this tab’s session storage, with a 30-minute expiry. It is not saved in a cookie or local storage, does not follow you between websites and is removed when a supported privacy signal disables collection. Blocking these statistics does not affect your ability to create an account or play.

4. Recipients and transfers

• Cloudflare, Inc. hosts the Game and its database, delivers our emails, provides the Turnstile spam check and derives approximate location from IP addresses, as our processor.
• Stripe processes payments (as our processor and as an independent controller for its own legal and fraud prevention purposes).
• Other players see the information described in section 2.
• Authorities, courts, advisers and payment providers receive data where we are legally required to disclose it or where it is necessary to establish, exercise or defend legal claims or to prevent fraud.
• A buyer or successor of our business, should our business or the Game be transferred.

Cloudflare and Stripe may process data outside the European Economic Area, including in the United States. Such transfers rely on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.

5. How long we keep data

• Account, game and community data: as long as your account exists. Inactive accounts may be deleted after 24 months (see our Terms). Chat keeps only the most recent messages of each channel and each mailbox keeps its most recent messages; older ones are deleted automatically.
• Security and fraud records: as long as your account exists and for up to 5 years afterwards, the general limitation period for claims under Bulgarian law.
• Purchase and accounting records: 10 years, as required by Bulgarian accounting and tax law. They are kept even if you ask us to delete your account.
• Contact requests: up to 3 years after the matter is resolved.
• Shop, activity and start-page statistics: 90 days, subject to fixed record limits. The account-linked entry and first-delivery observations are also deleted when the account is deleted. Error reports: 30 days after the error last occurred. The sign-up source: as long as your account exists. Technical request records used to prevent duplicate actions: 1 day.

Expired start-page statistics are excluded from reports and removed during subsequent collection or reporting. We may keep other data longer where it is needed to establish, exercise or defend legal claims, or where the law requires it.

6. Your rights

Under the GDPR you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on our legitimate interests. These rights apply within the limits set by law; in particular, we may keep data that we must retain by law or need to establish, exercise or defend legal claims. To exercise them, email us from the address of your account so that we can verify your identity.

You can lodge a complaint with a supervisory authority, in particular the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the authority in your country of residence.

We do not make decisions based solely on automated processing that produce legal effects concerning you. Automated limits, such as rate limits and spam checks, protect the Game against abuse.

7. Children

The Game is not directed to children under 16. If you believe a child under 16 has given us personal data without the consent of a parent or guardian, contact us and we will delete it.

8. Changes

We may update this Privacy Policy. The current version is always available on this page, and we will inform you of material changes by email or in the Game.