Privacy Policy

This Privacy Policy explains how [COMPANY LEGAL NAME] (“Vastopia”, “we”, “us”) collects, uses, shares, and protects personal data when you use the Vastopia platform — our websites, the Vastopia game client and launcher, the Vastopia Editor, our servers and APIs, and the games and services available through them (collectively, the “Services”).

[COMPANY LEGAL NAME], [COMPANY MAILING ADDRESS], is the “data controller” for the personal data described in this policy, except where Section 8 describes Creators’ own responsibilities. This policy should be read together with our Terms of Service.

The short version: we collect what we need to run a game platform — your account details, purchases, chat messages, and gameplay activity. We use Stripe for payments (we never see your full card number), Clerk for login, and we don’t sell your personal data or use it to train AI models. Chat and gameplay are logged for safety and moderation. You can access or delete your data — see Section 11.

We collect data from three sources: directly from you, automatically as you use the Services, and from the third-party providers described below (for example, your OAuth provider or Stripe).

Account data you give us. Username, email address, and password (passwords are handled by our authentication provider, Clerk — we never store them ourselves). Optionally: your first and last name, avatar image, country, bio, and social media links. If you sign in with a third-party provider (OAuth), we receive your basic profile information from that provider.

Payment and payout data. Payments are processed by Stripe. We do not receive or store your full card number. We store records of your purchases (amount, coin bundle, timestamp, billing country, and payment status, including refunds and disputes), your V-Coin balance and transaction ledger, and a Stripe customer reference. If you are a Creator receiving payouts, Stripe collects identity-verification data from you directly (legal name, date of birth, address, tax ID, bank account) under its own privacy policy; we store your earnings history, payout status, and country.

Content and social data. Games and assets you create or upload, your friends list and friend requests, direct messages you send and receive, in-game chat messages, and reports you file or that are filed about you.

Gameplay and activity data. Play sessions (which games, when, for how long), in-game events and character positions, in-game purchases, and per-game save data held on behalf of the Creator whose game you play.

Technical and log data. IP address, device and browser information (user agent), timestamps, and actions taken, collected in server logs, security audit logs, and rate-limiting systems. Basic, privacy-respecting web analytics on our site (see Section 9). Session tokens are stored on your device (in browser local storage on the website, and on disk for the game client) so you stay signed in.

Data from AI features. If you use our AI asset tools, the prompts and reference images you submit are processed to generate assets (see Section 5 for the providers involved).

Support and communications. Emails and messages you send us, and your newsletter subscription status if you opt in.

We do not intentionally collect special categories of data (such as health, religion, or precise geolocation), and we ask that you not share them in chat or your profile.

• Providing the Services — operating accounts, hosting and delivering games, syncing your progress, powering friends, chat, and notifications.
• Payments and payouts — processing purchases, maintaining V-Coin balances, paying Creators, handling refunds and disputes, and meeting tax and financial-reporting obligations.
• Safety and moderation — enforcing our Terms and community rules, reviewing reports, investigating fraud and abuse, applying sanctions (warnings, mutes, bans), and protecting minors, including mandatory reporting of child sexual abuse material to NCMEC and law enforcement.
• Security and reliability — authentication, rate limiting, audit logging, debugging, and diagnosing outages and game issues.
• Improving the Services — aggregate analytics about how games and features are used (game discovery, retention, revenue dashboards shown to Creators are aggregated or de-identified except as described in Section 8).
• Communicating with you — service announcements, security notices, and, only if you opt in, marketing emails (every marketing email includes an unsubscribe link).
• Legal compliance — responding to lawful requests and establishing, exercising, or defending legal claims.

We do not use your personal data to train AI models, and we do not sell it or share it for cross-context behavioral advertising.

If you are in the EEA, UK, or a similar jurisdiction, we process your data on these bases:

• Contract — most processing (accounts, game hosting, chat, purchases, payouts) is necessary to provide the Services you signed up for.
• Legitimate interests — security logging, fraud prevention, moderation, service analytics, and defending legal claims, balanced against your rights. You can object to processing based on legitimate interests (Section 11).
• Legal obligation — tax and financial record-keeping, responding to lawful orders, and mandatory child-safety reporting.
• Consent — marketing emails and any non-essential cookies or analytics that require it. You can withdraw consent at any time without affecting prior processing.

We do not sell your personal data. We share it only as follows:

• Service providers (processors) acting on our instructions under data-processing agreements: Clerk (authentication), Stripe (payments and payouts), MongoDB Atlas (database hosting), Cloudflare (content delivery and asset storage), Vercel (website hosting and analytics), our game-server hosting providers (such as DigitalOcean and Heroku), Mailchimp (newsletter, only if you subscribe), and AI providers used for asset generation (Anthropic for content review, and 3D-generation services that process the prompts you submit).
• Other users — your username, avatar, bio, presence, and published games are visible to others; your messages are visible to their recipients; your in-game character and actions are visible to players in the same game.
• Creators — as described in Section 8.
• Legal and safety — when required by law or legal process, or when we believe in good faith that disclosure is necessary to protect users (especially minors), the public, or Vastopia, including reports to NCMEC and law enforcement. Where legally permitted, we will notify you before disclosing your data in response to legal process.
• Business transfers — in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply to your data until changed per Section 17.

Chat is not private from the platform. Direct messages and in-game chat are stored on our servers and may be reviewed — by automated filters and by authorized personnel — for moderation, safety investigations, fraud prevention, and compliance with law. Do not share sensitive personal information (yours or anyone else’s) in chat.

In-game activity — including chat, movement, and purchases — is logged and retained for a limited period (see Section 10) to power moderation tools, diagnose issues, and provide Creators with aggregate analytics about their games.

If you are sanctioned (warned, muted, kicked, or banned) in a game or on the platform, we keep a record of the sanction, the reason, and related evidence for enforcement consistency and appeals. If you report another user, we keep the report and may share its substance (not your identity, unless legally required) with moderators handling it.

We use automated systems for rate limiting, fraud and abuse detection, content filtering, and quality review of AI-generated assets. These systems can restrict actions in real time — for example, throttling messages, declining a suspicious transaction, or holding content for review.

We do not make decisions with legal or similarly significant effects about you based solely on automated processing without human involvement. Significant enforcement actions (such as account termination or withholding earnings) involve human review, and you can contest any automated restriction and request human review by contacting [PRIVACY CONTACT EMAIL] or using the appeal process in our Terms.

If you are a Creator. Stripe collects and verifies your identity data (KYC) directly under the Stripe Privacy Policy. We receive verification status, payout eligibility, and country — not your underlying identity documents. Where required, earnings are reported to tax authorities (for example US 1099 reporting or EU DAC7).

If you play creator games. Creators can see analytics about their own games and moderation tools covering their own players (usernames, sanction history, reports, and game save data). Before a Creator can view player save data through our dashboards, we automatically redact sensitive fields such as IP addresses, emails, device identifiers, and payment references. Creators must use player data only to operate their games and must not attempt to re-identify, harvest, or export it, or use it to contact players outside the Services.

For data their Games collect through their own game design (for example, information players type into a Game), Creators are responsible for complying with privacy laws that apply to them. Report suspected misuse of player data to [PRIVACY CONTACT EMAIL].

We use cookies, local storage, and similar technologies that are strictly necessary for the Services to work — keeping you signed in, remembering preferences, and protecting against fraud and abuse.

Our website uses Vercel Analytics to understand aggregate site usage (page views, country-level location, device type). It is cookieless: it does not store cookies or other identifiers on your device, does not track you across sites, and does not build advertising profiles — which is why you do not see a cookie-consent banner for it. If we ever add analytics that store identifiers on your device, we will ask for consent first where the law requires it.

We do not use third-party advertising cookies or cross-context behavioral advertising. Because we do not track you across other sites, there is nothing for a Do Not Track signal to disable; we treat a Global Privacy Control (GPC) signal as a valid opt-out of any “sale” or “sharing” of personal information under US state law (we do neither).

We keep personal data only as long as needed for the purposes above. Current retention periods:

Aggregated or de-identified data (for example, game-level statistics) may be kept indefinitely. When retention periods differ from the above because of a legal hold, investigation, or dispute, we keep only what that purpose requires.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy in a portable format;
• Correct inaccurate data (most profile data you can edit yourself in account settings);
• Delete your data (see below);
• Object to or restrict certain processing, including direct marketing (which we only send with your opt-in anyway);
• Withdraw consent where processing is based on consent;
• Appeal a decision we make on your request (Section 15);
• Complain to your local data protection authority. We’d appreciate the chance to address your concern first at [PRIVACY CONTACT EMAIL].

Account deletion. You can delete your account in account settings or by emailing [PRIVACY CONTACT EMAIL]. When you delete your account, we delete or de-identify your personal data, with these exceptions: purchase and payout records we must keep for tax, accounting, and fraud-defense purposes; content inseparable from other users’ data (for example, messages you sent remain visible to recipients in de-identified or attributed-to-a-deleted-account form); sanction records needed to prevent ban evasion; and data we must retain by law. Published games are unpublished on account deletion unless you transfer them first.

Verification. To exercise any right, email [PRIVACY CONTACT EMAIL] from the address on your account; if you cannot, include enough information for us to verify you (we may ask you to confirm control of your account email or to provide details only the account holder would know — we will not ask for more data than verification requires). Authorized agents may submit requests with proof of authorization. We respond within the time required by applicable law (30 days in most cases, 45 days for California requests, extendable where the law allows). We will not discriminate against you for exercising your rights.

The Services are not directed to children under 13, and children under 13 are not permitted to create accounts or use the Services. We do not knowingly collect personal data from children under 13. If we learn that a user is under 13, we will terminate the account and delete its personal data. If you believe a child under 13 is using the Services, contact us at [PRIVACY CONTACT EMAIL].

Users aged 13–17 must have parental or guardian permission under our Terms of Service. Parents and guardians may contact us to review, correct, or delete their teen’s data where local law provides that right.

We protect your data with technical and organizational measures including encryption in transit (TLS), delegated credential handling (passwords held by Clerk, card data by Stripe — never on our servers), scoped API keys, role-based access controls, audit logging of administrative access, and automatic redaction of sensitive fields in creator-facing tools.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law. Help us keep your account safe: use a strong, unique password and never share your credentials or API keys.

We operate from the United States, and our service providers process data in the US and other countries. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where our providers are certified, the EU–US Data Privacy Framework. You can request more detail about transfer safeguards at [PRIVACY CONTACT EMAIL].

If you live in California or another US state with a comprehensive privacy law, the rights in Section 11 apply to you (access/know, correct, delete, portability, and non-discrimination).

We do not “sell” personal information and do not “share” it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes requiring a right to limit. We do not knowingly sell or share the personal information of anyone under 16. We honor Global Privacy Control signals as described in Section 9.

Categories of personal information we collect are described in Section 2 (identifiers; commercial information; internet activity; audio/visual information you upload; user content; and, for Creators via Stripe, professional and financial information), from the sources described there, for the purposes in Section 3, shared with the categories of recipients in Section 5, and retained per Section 10. You may exercise your rights via [PRIVACY CONTACT EMAIL], including through an authorized agent.

Appeals. If we decline a request, we will explain why, and residents of states that provide an appeal right (such as Virginia, Colorado, and Connecticut) may appeal by replying to our decision with “Appeal” in the subject line. If your appeal is denied, you may contact your state attorney general.

If your local law grants privacy rights beyond those described here (for example, in Canada under PIPEDA, in Brazil under the LGPD, or in Australia under the Privacy Act), we honor those rights to the extent they apply to us. Contact [PRIVACY CONTACT EMAIL] and tell us where you are located so we can handle your request under the correct law.

We may update this policy as the Services and the law evolve. If we make material changes, we will notify you — by email, in-app notice, or a prominent notice on the site — before the changes take effect. The “Last updated” date above reflects the current version. Your continued use of the Services after the effective date means the updated policy applies. We will not materially reduce your rights under this policy without seeking your consent where the law requires it.

Questions, requests, or concerns about privacy? Contact us at [PRIVACY CONTACT EMAIL].

[COMPANY LEGAL NAME]
[COMPANY MAILING ADDRESS]
Operator of the Vastopia platform