Privacy Notice

This Privacy Notice (the “Notice”) sets out, in a single place, what Pyrekin OÜ(the “Company”, “we”, “our” or “us”) does with information relating to identifiable individuals, and the entitlements you hold in respect of that information.

It applies whenever you visit our website, register or hold an account, make a purchase, request a refund, undergo account verification, or otherwise deal with us. Using our services signifies that this Notice has been made available to you and that you are aware of its contents; it is not, and does not operate as, your consent to any processing described below, save where a section expressly states that consent is the legal basis relied upon.

References to data protection law mean Regulation (EU) 2016/679 (the “GDPR”) and any national legislation, guidance or successor instrument giving effect to it.

Pyrekin OÜ, company registration № 17573421, registered office: Tartu mnt 84a, 10112 Tallinn, Estonia, is the controller of the personal data described in this Notice.

No data protection officer has been designated as mandatory under Article 37 of the GDPR; enquiries are handled by the contact route in section 3.

Any question, request or objection concerning this Notice or your data may be directed to hello@pyrekin.com. Where a request concerns the exercise of a right under section 13, please describe what you are asking for; we may need to satisfy ourselves of your identity before we act.

Information about you reaches us by three routes:

• From you directly. What you provide on registration, at checkout, in your account settings, in a refund request, during account verification, or in correspondence with our support team.
• From your use of our systems. Data generated as you play — run state, run history, purchases — and basic technical data (HTTP request metadata) captured for security and debugging.
• From third parties. Our payment provider (confirmation of payment, the outcome of 3-D Secure authentication, limited payment metadata such as card brand and last four digits, and notices of refunds and chargebacks) and, where we verify your account, our identity-verification provider.

Certain items we cannot do without: without them we are unable to open an account, process a purchase or refund, complete a verification required by our Terms, or discharge a duty imposed on us by law. Those items are marked as required at the point of collection, and withholding them will mean the relevant service cannot be supplied.

Everything else — such as an optional display name — is discretionary, and may be supplied, altered or removed at will through your account settings.

Depending on how you interact with us, we may hold and use the following:

• Account data — email address, optional display name, and a hash of your password (we never store your password in plain text).
• Gameplay data — your active run state, run history, achievements, and leaderboard entries.
• Purchase data — records of ember packs, cosmetic items, and other purchases linked to your account, including order confirmations, refunds and chargeback disputes.
• Payment data— payment confirmation records received from our payment provider: transaction reference, amount, date, card brand, the last four digits of the card number and the outcome of 3-D Secure authentication. Your full card number, expiry date and security code are entered on the payment provider's secure page and are held by that provider, not by us; Pyrekin OÜ never stores your card number.
• Verification (KYC) data — where we verify your identity, age or country of residence under the Terms (to prevent fraud, multi-accounting and underage access, and to comply with sanctions obligations): a government-issued ID and, optionally, a selfie holding it.
• Device and technical data — IP address and basic HTTP request metadata, logged for security and debugging and, at checkout, used by the payment provider and your card issuer for payment authentication and fraud screening.
• Support data — the record of your correspondence with us, including how it was resolved.

We do not seek out special category data within the meaning of Article 9, nor criminal offence data under Article 10, and ask that you do not volunteer any.

No processing takes place without a lawful basis. The table below pairs each objective with the categories of data engaged and the ground under Article 6 on which we rely. Where the ground is legitimate interests, we have weighed those interests against your rights and freedoms and concluded that ours do not override yours.

We do not sell personal data and we do not disclose it beyond what the purposes in section 7 require. The recipients fall into the following groups:

• Our hosting provider,which stores Pyrekin's data on our behalf.
• Our payment provider, a PCI DSS compliant payment service provider which processes card payments, authenticates them with 3-D Secure together with your card issuer, and processes refunds to your original payment method. Your card details are entered on its secure page and never pass through our systems. For a 3-D Secure check, transaction and device data (such as the amount, your e-mail address, country, IP address and browser information) are shared with the payment provider and your card issuer so that they can confirm you are the legitimate cardholder. Each such supplier is bound by a written processing agreement containing confidentiality and security undertakings and is permitted to use the data only as we direct.
• Our identity-verification provider, where we use one to carry out the verification described in section 6, on the same contractual footing.
• Google, as the provider of the analytics that tell us which pages are used and where players give up. This applies only if you have consented to analytics cookies; what is set, and how to withdraw, is in our Cookie Notice. No advertising identifiers are involved and we do not build cross-site profiles.
• Public authorities, regulators, courts and law enforcement, where disclosure is compelled by law or is necessary to protect the rights, property or safety of the Company, our players, or others.

If our business or any part of it changes hands, personal data may pass to the acquirer, which will remain bound by protections no less favourable than those set out here.

Pyrekin's own infrastructure is located within the EU, so account, gameplay, and purchase data described in section 6 does not routinely leave the EU/EEA on that account. Some of our suppliers and partners — including, potentially, our payment provider, any identity-verification provider we use, and our analytics provider — may nonetheless operate from, or process data in, a country outside the EEA. The legal regime there may fall short of the standard the GDPR requires.

Where that happens, the transfer is made on one of the following footings:

• the destination is covered by an adequacy decision of the European Commission; or
• the Standard Contractual Clauses adopted by the European Commission are in place; or
• the recipient is certified under an approved framework, such as the EU–U.S. Data Privacy Framework, where that framework covers the transfer in question.

We recognise that contractual protection has limits. Residual exposure may include access to your data by foreign public authorities on terms broader than EU law would permit, practical difficulty in enforcing your rights or obtaining a remedy, or the absence in the destination country of rights and redress mechanisms equivalent to those you enjoy at home. We therefore assess the risk before relying on any of the mechanisms above and apply supplementary measures where warranted, including minimising what is sent, encrypting it in transit and at rest, and confining access to named personnel.

Details of the mechanism used for a particular transfer, and a copy of the safeguards, may be obtained from hello@pyrekin.com.

Data is kept for as long as the purpose that justified collecting it subsists, and thereafter only for as long as a statutory, regulatory, tax, or accounting rule requires. In practice this means:

• Account and gameplay data: for as long as your account is active, and deleted immediately upon a confirmed account-deletion request (see section 13), except to the extent retention is separately required below.
• Purchase and payment records (including refund and chargeback records): for the period required by applicable accounting and tax law, and in any event for as long as a payment can still be disputed under the card scheme rules.
• Verification (KYC) data: for as long as needed to complete the verification and to evidence our compliance with the Terms and with applicable sanctions and age-verification obligations, and thereafter for the period required by law. This may mean that, unlike other account data, verification documentation is not deleted immediately upon review or account deletion, but is retained for the legally mandated period and then deleted.
• Security and technical logs: for a limited period appropriate to their security and debugging purpose.
• Material relevant to actual or anticipated legal claims: until the relevant limitation period has run.

Once no basis for retention remains, the data is deleted or irreversibly anonymised so that it can no longer be associated with you.

We treat the integrity and confidentiality of your data as an obligation, not an aspiration, and maintain technical and organisational measures proportionate to the risk, including:

• encryption of stored verification (KYC) data, both in transit and at rest;
• access to verification data limited to personnel who need it to review a request;
• role-based access control for internal systems;
• a documented incident response procedure, including assessment of any personal data breach and notification to the competent supervisory authority and, where required, to you.

Card payments and 3-D Secure.Card payments are processed by our PCI DSS compliant payment provider and are authenticated with 3-D Secure (Visa Secure / Mastercard Identity Check). Your card issuer may ask you to confirm a payment, for example in your banking app or with a one-time code. Your full card number, expiry date and security code are entered on the payment provider's secure page and are never collected or stored by Pyrekin OÜ; we receive only a payment confirmation, the transaction reference, the card brand and the last four digits of the card number, which we use for order records, refunds and dispute handling. No cardholder data is stored on our systems.

Security is shared. You can materially reduce the risk to your own data by:

• using a long, unique password for your account and changing it if you suspect compromise;
• treating unexpected messages asking for credentials or payment as suspect until verified independently;
• keeping your device and browser patched and running reputable security software;
• reviewing your account activity periodically and telling us at once about anything you do not recognise.

Subject to the conditions and exceptions the legislation itself imposes, you are entitled to:

• be told what data we hold about you and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have data erased where it is no longer needed for the purpose, where consent has been withdrawn and no other basis applies, or where it has been processed unlawfully;
• have processing restricted while a dispute about accuracy or lawfulness is resolved;
• object to processing founded on our legitimate interests;
• receive data you have provided in a structured, commonly used and machine-readable form, where the processing rests on consent or contract and is carried out by automated means;
• withdraw consent at any time where consent is the basis on which we act.

You can exercise the right to erasure directly at any time using the “Delete my account” button in your profile, which erases your account, run history, cloud save, and purchase records immediately and irreversibly — except for records we are required by law to retain, such as payment records and verification (KYC) data during the periods described in section 10.

For any other request, write to hello@pyrekin.com. We reply within one month of receipt, extendable by two further months for requests that are complex or numerous, in which case we will tell you within the first month. There is no charge unless a request is manifestly unfounded or excessive. We may ask for information reasonably needed to confirm that you are who you say you are, and will not act until we are satisfied on that point.

No decision producing legal effects for you, or otherwise significantly affecting you — including the review of a refund request or of an account verification — is taken by us by automated means alone; such requests are reviewed manually. The authentication and fraud screening of card payments (including 3-D Secure) is carried out by our payment provider and your card issuer and may involve automated checks; if a payment is declined, you may retry it or contact your card issuer. We do not use your data for automated profiling for marketing purposes.

The services are directed at adults. We neither seek nor knowingly process data relating to anyone under 18 (a “Minor”), and by using the services you confirm that you are not one. If you have reason to think a Minor's data has reached us, write to hello@pyrekin.com and we will investigate and delete what should not be held.

If something about our handling of your data troubles you, raise it with us first at hello@pyrekin.com; we would rather resolve it directly. That route does not displace your statutory right to complain to a supervisory authority.

If you live in another EEA country, you may also complain to the supervisory authority of the Member State in which you live or work. A list of the national authorities is maintained by the European Data Protection Board at edpb.europa.eu.

This Notice will be revised as our processing, our suppliers, or the law change. The date at the head of the document always identifies the current version. Where a revision is material — a new purpose, a new legal basis, a new category of recipient — we will draw it to your attention before it takes effect, by notice on the website or by writing to you directly. Continuing to use the services after a revision has taken effect means the revised Notice governs our relationship; it does not, of itself, constitute consent to any processing for which consent is legally required.

For the cookies and localStorage entries we set, see our Cookie Notice.