Cup Code Studio Privacy Policy

Introduction

Welcome to Cup Code, a Saudi game development studio based in Madinah. This policy explains the categories of data we collect when you use our games, website, products, and digital services, how we use and protect that data, and how long we retain it. By using our services, you acknowledge that you have read and understood this policy.

1. Legal Framework

Personal data is processed in accordance with laws and regulations applicable in the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its implementing regulations, in addition to any sector-specific requirements relevant to the service.

2. Data We Collect

2.1 Data You Provide Voluntarily

• Account data: username, email address, password, date of birth, and country (where account systems are available).
• Profile data: avatar, bio, and any additional information you choose to submit.
• Communication data: support requests, survey responses, and messages sent through official contact forms.
• Transaction data: purchase-related information processed by authorized payment providers, without storing full card details on our systems.

2.2 Data Collected Automatically

• Device data: IP address, device type, operating system, language and regional settings, and crash diagnostics.
• Usage and gameplay data: in-game progress, session duration, feature interactions, and performance indicators.
• Approximate location data: inferred city or country based on IP address for compliance and localized service delivery.

2.3 Data from Third Parties

• Identity and social sign-in providers (such as Apple or Google, when enabled), subject to your settings and consent.
• Analytics and advertising partners (when enabled) to measure campaign effectiveness and improve content relevance.

3. Lawful Bases for Processing

• Consent: for example, when subscribing to newsletters or receiving marketing communications.
• Contractual necessity: to provide requested services and operate gameplay and related features.
• Legal obligation: to satisfy applicable legal and regulatory requirements or valid governmental requests.
• Legitimate interest: to improve service security and performance, prevent fraud, and conduct internal analytics without overriding user rights.

4. How We Use Your Data

• Operate services, create accounts, and maintain user progress.
• Improve gameplay experience and personalize in-game or website content.
• Send operational communications, including security alerts, policy updates, and support responses.
• Detect and prevent cheating and fraud, resolve disputes, and enforce platform rules.
• Comply with legal obligations and support analytics and strategic planning.

5. Data Sharing and Disclosure

We do not sell your personal data.

We may share data on a limited basis with:

• Contracted service providers (hosting, analytics, cloud infrastructure, and technical support) under binding data protection agreements.
• Advertising and analytics partners when those services are enabled and legally permitted.
• Competent authorities when required by law or a valid legal order.
• A successor entity in case of merger, acquisition, or transfer of assets, with notice when a material change occurs.

6. Your Privacy Rights

Subject to applicable law, you may have the right to:

• Be informed about the purpose and legal basis of processing.
• Access your personal data and request a copy.
• Request correction or update of inaccurate data.
• Request deletion or destruction where legally applicable.
• Withdraw consent when processing is based on consent.

To exercise your rights, contact us at: privacy@cupcodestudio.com

7. Data Security and Retention

We apply appropriate technical and organizational safeguards, including encryption, access controls, environment isolation, and access monitoring. We retain personal data only for as long as needed for the purposes described in this policy or to meet legal obligations, then securely delete or anonymize it.

8. Children, International Transfers, and Updates

• Our services are not directed to children under 13, and we observe applicable child protection requirements.
• Some data may be processed in infrastructure outside your country of residence with appropriate safeguards in place.
• When material changes are made, we publish an updated version with a new effective date and may provide advance notice where required.

9. Data Protection Contact