SpellBound: Survival

1. Purpose of this Policy

This Privacy Policy explains how we collect, use, store, and protect personal data when you play SpellBound: Survival (the "Game") or use related services — website, account dashboard, leaderboards, guilds, party matchmaking, and community platforms.

We process personal data lawfully, fairly, and transparently in compliance with:

• The Swiss Federal Act on Data Protection (FADP)
• The EU General Data Protection Regulation (GDPR)

Havoc Interactive is the Data Controller for the personal data we process.

2. Data Controller

Rayane Benabdeljalil (Havoc Interactive)
Registered in: France
Email: rog.dev.business@gmail.com

3. Data We Collect

We collect only what is necessary to operate the Game and your account.

Account Data

• Username / in-game alias
• Email address
• Password (hashed with industry-standard algorithms — never stored in plain text)
• Optional region/country information

Technical & Usage Data

• IP address and device identifiers
• Browser type, OS, and referring URL
• Login timestamps and session activity
• In-game progress, run statistics, leaderboard entries
• Crash/error logs and anti-cheat telemetry

Payment & Transaction Data

If you make a purchase we store:

• Transaction amount, currency, date, and status
• Payment provider identifier (Stripe or PayPal)
• Partial billing metadata (we never store full card numbers)

All payments are processed by PCI-DSS-compliant third-party processors.

Cookies and Local Storage

We use cookies and local browser storage to:

• Maintain your session and keep you logged in
• Save gameplay preferences and settings
• Monitor performance and detect abuse

4. How We Use Your Data

5. Legal Basis for Processing (GDPR Art. 6)

• Contract performance: operating the Game and your account.
• Legal obligation: tax, accounting, and regulatory compliance.
• Legitimate interest: security, anti-cheat, fraud prevention, product improvement.
• Consent: only where explicitly requested (e.g., optional newsletters).

6. Data Retention

Data no longer required for the purposes above is deleted or anonymised.

7. Data Sharing

We do not sell personal data. We share data only with:

• Server hosting and infrastructure providers
• Payment gateways (Stripe, PayPal)
• Security, anti-fraud, and anti-cheat services
• Regulatory or judicial authorities where legally required

All processors are contractually bound to GDPR/FADP-equivalent security standards.

8. International Data Transfers

Your data may be processed outside your country of residence. Where transfers occur we rely on adequacy decisions, Standard Contractual Clauses (SCCs), or equivalent legally-recognized safeguards.

9. Your Rights (GDPR & FADP)

You have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion ("right to be forgotten").
• Restriction — limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — where processing relies on consent.

To exercise these rights email rog.dev.business@gmail.com.

10. Security Measures

• Encrypted transport (HTTPS/TLS everywhere)
• Hashed and salted passwords
• Row-level security on all user data
• Server-authoritative validation for economy and progression
• Access controls, audit logging, and monitoring

No system is 100% secure. Use a strong unique password and enable additional authentication factors when available.

11. Children's Privacy

The Game is not directed at users under 16. We do not knowingly collect data from children. If we discover such data has been submitted, we will delete it promptly.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date changes with each revision; material changes are additionally announced in-game or by email.

13. Contact & Complaints

For privacy questions or to exercise your rights, contact rog.dev.business@gmail.com.

You may also lodge a complaint with your local data protection authority:

• EU: EDPB member list
• Switzerland: FDPIC

See also our Terms of Service and Refund Policy.