Privacy Policy

1. Controller and data protection channel

The controller of the personal data processed in the Service is EVERHEID STUDIOS LTDA, a Brazilian limited liability company registered under CNPJ no. 68.343.520/0001-30, with its registered office at Rua Doutor Amadeu da Luz, 132, sala 202, Centro, Blumenau/SC, CEP 89010-160, Brazil.

For privacy matters and for exercising the rights set out in this Policy, we maintain the support channel contato.everheidstudios@gmail.com, through which we receive and answer data subject requests.

We are a small-scale processing agent and, in that capacity, we disclose this communication channel instead of appointing a person as Encarregado (data protection officer), as permitted by Resolução CD/ANPD nº 2, of 27 January 2022.

2. Data we collect

We process the following categories of personal data:

• · Registration data: e-mail address, username, password (stored encrypted), and date of birth;
• · Pre-registration data: e-mail address, date of birth, and acceptance of the Terms of Use and of this Policy, collected before the game launches so that the sign-up can be converted into an account;
• · Consent records: the date, the time, the IP address from which the acceptance was sent, and which version of each document you accepted;
• · Game usage data: your progress, your heroes, the actions performed in the Service, and your preferences;
• · Payment data: the confirmation and status of transactions — we do not receive your full card details;
• · Technical data: IP address, device and browser identifiers, access logs, and cookies.

3. Where the data comes from

Most of the data is provided by you, when you pre-register, when you create your account, and when you use the Service.

When you choose to sign in with “Continue with Google”, we receive from Google your verified e-mail address and your account identifier, to the extent necessary to authenticate you.

From payment providers we receive the confirmation and status of the transactions you carry out in the Service.

4. Purposes and legal bases

Each processing operation we carry out has a defined purpose and a corresponding legal basis, under article 7 of the LGPD:

• · Creating and maintaining your account and providing the Service — performance of a contract to which you are a party (art. 7, V);
• · Verifying compliance with the minimum age and recording acceptance of the Terms of Use and of this Policy — compliance with a legal obligation and regular exercise of rights (art. 7, II and VI);
• · Ensuring the security of the Service, preventing fraud, and improving the game — legitimate interest (art. 7, IX);
• · Sending communications you choose to receive — consent (art. 7, I);
• · Complying with a determination of a competent authority or a court order — compliance with a legal obligation (art. 7, II).

5. Cookies and similar technologies

We use cookies and similar technologies, such as browser local storage, to keep your session active, remember your preferences, and understand how the Service is used.

You can manage or delete cookies in your browser settings. Some of them are essential to the operation of the Service; without them, parts of the game may stop working correctly.

6. Sharing and processors

We do not sell your personal data.

We share only what is necessary with the processors below, which process data on our behalf and according to our instructions, and with public or judicial authorities, when required by law or by court order:

• · Google/Firebase — account authentication and Service infrastructure;
• · Payment providers — processing of purchases made in the game;
• · Cloud hosting provider — hosting of the application and of the databases.

7. International data transfers

Some of the processors we engage handle data outside Brazil, notably in the United States, as is the case with the Google/Firebase infrastructure.

For those transfers we adopt safeguards compatible with article 33 of the LGPD, so that your data remains protected to a degree equivalent to that required by Brazilian law.

8. Retention and deletion

We keep your account data for as long as the account exists.

Consent and transaction records are kept for 5 (five) years counted from the closure of the account, for the regular exercise of rights and compliance with legal obligations.

Access logs (technical logs) are kept for 6 (six) months.

Once the account is closed and those periods have elapsed, the data is deleted or anonymized.

9. Your rights

The LGPD grants you, as a data subject, the rights listed below over your personal data (art. 18). To exercise any of them, write to contato.everheidstudios@gmail.com; we answer requests within 15 (fifteen) days counted from receipt.

• · Confirm that processing exists and access your data;
• · Correct incomplete, inaccurate, or outdated data;
• · Request the anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in breach of the law;
• · Request the portability of your data to another provider;
• · Be informed about the public and private entities with which we share your data;
• · Withdraw consent, where the processing is based on it;
• · Request the review of decisions taken solely on the basis of automated processing.

10. Adolescents and minimum age

The Service is intended for people who are 16 (sixteen) years of age or older.

The data of adolescents aged 16 and 17 is processed in their best interest and with the consent and assistance of their parents or legal guardian, under article 14 of the LGPD.

We do not knowingly collect data from people under 16. If we identify such collection, we will delete the data.

11. Security and incident response

We adopt technical and organizational measures to protect your personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication, or dissemination.

No system is completely secure. We work continuously to reduce risks and to respond to incidents promptly.

Should a security incident occur that may entail relevant risk or harm to data subjects, we will report it to the Brazilian National Data Protection Authority (ANPD) and to the affected data subjects, under article 48 of the LGPD.

12. Automated decisions

We use automated processing to detect cheating, fraud, and improper display names. These mechanisms may lead to the restriction of features, to the display name being reset, or to the suspension of the account.

You may request the review of these decisions through the contact channel given in section 1, under article 20 of the LGPD.

13. Changes to this Policy

We may update this Policy to reflect changes in the Service, in the law, or in our processing practices.

The update date shown at the top of this page identifies the version currently in force.

Material changes will be communicated to you and, where they involve new processing that depends on your acceptance, it will be requested.

14. Contact and prevailing version

Questions, requests, and complaints regarding this Policy and the processing of your personal data may be sent to contato.everheidstudios@gmail.com.

The Portuguese version of this Policy is the official one and prevails over any translation. Versions in other languages are provided as a courtesy and do not alter the content of the Portuguese version.