Privacy Policy

M3GA Studios LLC (“M3GA,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use a Service covered by this Policy, and how you can exercise available privacy choices and rights.

This Policy is intentionally written to cover multiple types of Services. A feature or provider described below applies only when the Service you use includes that feature or provider. We do not collect a category of information merely because it appears in this Policy.

Important summary. We do not sell personal information for money. Some advertising disclosures may nevertheless be treated as a “sale,” “sharing,” or targeted advertising under certain privacy laws. Where required, we provide consent or opt-out controls. Apple, Google, gaming platforms, storefronts, and other providers also process information under their own privacy notices.

1. Scope and Who Is Responsible

This Policy applies to M3GA websites, domains, subdomains, mobile applications, games, software, online services, stores, communities, and other digital products that link to or expressly adopt this Policy (collectively, the “Services”). This includes, where applicable, m3gastudios.com, lethalhavoc.com, and official M3GA applications and game experiences.

This Policy does not apply to a third-party website, storefront, platform, or service merely because a Service links to it. It also does not apply to workforce or employment records, which may be covered by a separate notice if those activities arise.

M3GA Studios LLC, an Ohio limited liability company, is the entity responsible for the personal information described in this Policy unless a Service-specific notice identifies another controller. Arctic Fox Collective, LLC (“AFC”) is under common ownership with M3GA and may process limited information when it provides funding administration, accounting, security, hosting, legal, technical, or other operational support to M3GA. M3GA and AFC will use information consistently with this Policy when acting in those roles. This statement does not mean that AFC receives every user’s information.

A Service may provide a short-form, just-in-time, regional, or feature-specific notice. That additional notice supplements this Policy and controls for the specific feature if there is a direct conflict.

2. Information We Collect

The information we collect depends on the Service, the features you use, your device and platform, your settings and permissions, and what you choose to provide.

2.1 Information You Provide

We may collect the following information when you provide it to us:

• Contact information: name, email address, telephone number, mailing or shipping address, and communication preferences.
• Account and profile information: username, display name, password or authentication credential in protected form, age or age range, country or region, avatar, profile settings, linked-account choices, and other profile details.
• Transactions and customer records: products or services ordered, cart and order details, billing and shipping details, transaction or receipt identifiers, subscription or entitlement status, refund status, and customer-service history. Except where a specific checkout clearly states otherwise, payment card details are entered directly with a platform or payment provider, and M3GA does not receive or store the complete card number or security code.
• Gameplay and product information: saved progress, inventory, characters, loadouts, preferences, scores, achievements, match and session history, multiplayer or party information, competition entries, and feedback.
• Communications and user content: support requests, emails, survey responses, contest submissions, reviews, forum posts, chat, reports, screenshots, files, voice communications, and other content you choose to send, upload, publish, or make available through a Service.
• Marketing information: email subscriptions, event registrations, promotion entries, and choices about marketing or advertising.
• Rights-request information: the request, communications about it, and information reasonably necessary to verify identity, authority, residency, or account ownership.

Please do not provide sensitive information that a Service does not request. Do not send passwords, full payment-card numbers, government identification, or other highly sensitive documents by email unless we specifically request a secure method.

2.2 Information Collected Automatically

When you access a Service, we and providers acting for us may automatically collect:

• Device and network information: IP address, device or console type, device and app identifiers, advertising identifier when permitted, operating system, browser, language, internet service provider or carrier, screen characteristics, app version, time zone, and general location inferred from IP address.
• Usage and gameplay information: pages or screens viewed, referring and exit pages, clicks, feature use, session time, game mode, inputs and interactions, matchmaking and gameplay events, progression, ad impressions and interactions, and dates and times of activity.
• Diagnostics and performance: crash reports, error logs, launch time, hang rate, frame or network performance, energy use, and related technical information.
• Security and integrity information: authentication events, suspicious activity, fraud signals, rule violations, moderation events, and information reasonably necessary to protect accounts, Services, users, and M3GA. If a Service uses specialized anti-cheat technology that collects additional system information, we will identify that technology in the Service or an additional notice.
• Cookie and similar-technology information: cookie identifiers, local storage, software development kit (“SDK”) signals, pixels, tags, consent status, and privacy preference signals.

We generally infer only an approximate location from an IP address. We do not collect precise GPS location unless a feature clearly requests it, explains why, and obtains any device or legal permission required.

2.3 Information from Platforms and Other Sources

We may receive information from another service when you access, purchase, install, authenticate, link, or interact with a Service through that provider. Depending on your settings and the integration, this may include:

• platform or player identifiers, display name, avatar, country or region, friends or related-player information, and account-link status;
• ownership, license, purchase, subscription, refund, and entitlement information;
• achievements, scores, leaderboards, multiplayer, presence, lobby, invite, and gameplay information;
• fraud, security, moderation, or account-status signals;
• information that an advertising, analytics, hosting, commerce, or support provider processes for the Service; and
• information another user provides when sending an invitation, reporting conduct, or interacting with you.

Your settings with the other provider usually determine what it makes available. The other provider processes information under its own terms and privacy notice.

2.4 Deidentified and Aggregated Information

We may create information that is aggregated, deidentified, or otherwise not reasonably capable of being associated with you. We may use and disclose that information for lawful purposes, including analytics, research, Service improvement, security, and business planning. We will not attempt to reidentify deidentified information except to test whether our deidentification process is effective or as otherwise permitted by law.

3. Mobile Advertising, Consent, and Tracking

3.1 Google AdMob and the Google Mobile Ads SDK

Some mobile Services may display advertising through Google AdMob or the Google Mobile Ads SDK. When enabled, Google and participating advertising partners may collect or receive information such as:

• IP address, which may be used to infer general location;
• device advertising identifier or other app- or developer-scoped identifiers;
• app identity and version;
• ads requested, displayed, viewed, clicked, or otherwise interacted with;
• app-launch and other product-interaction information;
• crash logs, diagnostics, and performance information; and
• consent, opt-out, or restricted-data-processing signals.

This information may be used to provide, limit, personalize where permitted, measure, secure, and improve advertising and related services. Contextual or non-personalized ads may still use limited information for ad delivery, frequency capping, fraud prevention, security, and aggregated reporting.

Google explains how it uses information from apps and sites that use Google services at How Google uses information from sites or apps that use our services and in the Google Privacy Policy.

If a Service uses AdMob mediation or another advertising network, the current partners may be identified in the Service’s privacy-choices interface, consent message, or an additional provider list. Advertising partners can change as integrations change; we will update required disclosures before enabling a materially different data practice.

3.2 Google User Messaging Platform (UMP)

An ad-supported Service may use Google’s User Messaging Platform (“UMP”) to request and manage privacy choices. UMP may determine whether a privacy message is required, present available choices, store or retrieve consent status, and communicate consent or opt-out signals to Google and participating advertising partners.

UMP is a consent-management tool; its appearance does not mean every optional purpose is active, and it does not replace rights available under this Policy. Where required, we will request consent before requesting ads or accessing storage for purposes that require consent. You may reopen the Service’s “Privacy Choices,” “Manage Consent,” or equivalent control when available to change a choice. Withdrawal does not affect processing that was lawful before withdrawal.

3.3 Apple App Tracking Transparency (ATT)

On Apple devices, a Service will use Apple’s App Tracking Transparency framework before accessing the advertising identifier or engaging in activity that Apple defines as tracking across apps or websites owned by other companies. If you decline ATT permission, we will not access the Identifier for Advertisers (IDFA) or use another identifier to circumvent your choice for tracking prohibited by Apple. Declining does not prevent processing needed to provide the Service, measure it in a nontracking manner, prevent fraud, honor consent choices, or display contextual or otherwise permitted ads.

ATT permission is separate from UMP and other legal consent. We will honor each applicable choice. You can change ATT permission in Apple device settings under Privacy & Security > Tracking.

3.4 Sale, Sharing, and Targeted Advertising Choices

We do not sell personal information for money. However, disclosing online identifiers, device activity, or advertising information to an advertising partner for cross-context behavioral advertising may be defined as a “sale,” “sharing,” or targeted advertising under certain laws.

Where those laws apply, you may opt out through any privacy message shown in the Service, the Service’s privacy-choices control, a legally recognized opt-out preference signal where supported, or by emailing [email protected]. Opting out may make ads less relevant but should not remove ordinary access to a Service unless advertising is necessary to provide a clearly described, legally permitted version of it.

We do not knowingly sell or share for cross-context behavioral advertising the personal information of users under 16. We do not use sensitive personal information to infer characteristics for advertising.

4. Apple Platform Features

4.1 Game Center

If you use Game Center features, Apple may provide us with information needed to authenticate and operate those features, such as a Game Center player identifier, alias or nickname, avatar, achievement and score information, leaderboard activity, multiplayer or challenge activity, and, only where Apple and you permit it, friends or related-player information.

We use this information to authenticate you, connect gameplay, submit or display scores and achievements, enable multiplayer and invitations, prevent abuse, restore progress or entitlements where supported, and provide support. Other players may see information that the Game Center feature or your Apple settings makes visible, such as an alias, avatar, score, achievement, or multiplayer presence.

Apple separately processes Game Center information under Game Center & Privacy and the Apple Privacy Policy. Changing or deleting M3GA information does not automatically delete information controlled by Apple.

4.2 Messages and iMessage Features

If a Service includes a Messages extension, sticker pack, share sheet, invitation, or interactive-message feature, the feature may process the text, sticker, media, link, app-specific payload, or other content you choose to compose or share. Depending on the feature and Apple API, it may also process conversation-scoped identifiers or the selected interactive message to provide the requested experience.

We do not use a Messages integration to read unrelated conversations or your general message history. We do not access your address book through a Messages feature unless a separate feature clearly requests Contacts permission. Apple handles delivery through Messages under Apple’s privacy terms. After you send content, recipients may save, copy, forward, capture, or disclose it, and we cannot control their actions.

4.3 StoreKit, In-App Purchases, and Subscriptions

Apple processes App Store and StoreKit payments. M3GA does not receive your complete payment-card number or card security code from Apple. We may receive or generate information necessary to validate and administer a purchase, such as:

• product and offer identifier;
• transaction and original transaction identifiers;
• purchase, renewal, expiration, revocation, or refund status and dates;
• subscription or entitlement status;
• storefront, country, region, or currency information;
• signed transaction or receipt information; and
• an app-account token or internal account reference, if the Service uses one to connect a purchase to an M3GA account.

We use this information to deliver digital content, maintain entitlements, restore purchases, prevent fraud, provide support, process or assist with refund issues, and meet accounting or legal obligations. Apple processes App Store purchase data under App Store & Privacy.

Deleting an app from your device or deleting an M3GA account does not automatically cancel an Apple subscription. You must manage or cancel subscriptions through your Apple account settings. A later restore-purchases request may cause Apple to send valid transaction information to the Service again.

4.4 Apple Permissions and App Privacy Information

A Service may request device permissions only when needed for a feature, such as notifications, microphone, camera, photos, Bluetooth, local network, or tracking. The operating-system prompt describes the immediate purpose. You can change permissions in device settings, although disabling a permission may prevent the related feature from working.

The App Store privacy label for a specific app describes information collected by that app and its integrated SDKs. Because this Policy covers multiple Services, the app-specific label may be narrower. If a label and this universal Policy appear different, the label should reflect the data collected by the currently distributed app version, while this Policy describes the broader universe of practices that may apply across M3GA Services.

5. Websites, Analytics, Commerce, Hosting, and Gaming Platforms

The providers below apply only when the Service uses them.

5.1 Google Analytics and Google Site Kit

M3GA websites may use Google Analytics to understand visits and interactions. Google Analytics may process cookie or device identifiers, IP address, general location, browser and device information, referral information, pages viewed, events, session activity, and similar usage data. We use this information to measure traffic, diagnose problems, understand content performance, and improve websites and marketing.

Google Site Kit may be used in WordPress as an administrative integration to connect Google services and display reports. Site Kit’s presence does not itself mean that every supported Google module is active. Visitor data collection depends on the Google services and tags that M3GA actually enables.

Where consent is required for analytics or advertising storage, we will use a consent mechanism and configure tags to respect the available choice. Do not submit names, email addresses, or other direct identifiers in fields that are not designed to collect them, and we do not intentionally send direct identifiers to Google Analytics.

5.2 Shopify and Online Commerce

If a Service uses Shopify, Shopify may process contact, account, device, browsing, cart, order, shipping, billing, payment, fraud-prevention, and customer-service information to host and operate the store and checkout. M3GA receives information needed to fulfill orders, provide support, prevent fraud, process returns, maintain records, and understand store performance. Payment providers may process complete payment credentials directly.

Shopify may act as a service provider for M3GA and may also process certain information for its own purposes under the Shopify Consumer Privacy Policy. Storefront cookie details may be provided in a cookie banner or Shopify’s then-current cookie notice.

5.3 Cloudflare

M3GA websites and network services may use Cloudflare for domain services, content delivery, performance, bot management, availability, and security. Cloudflare may process IP addresses, request headers, URLs, timestamps, device and browser details, security signals, cookies such as challenge or clearance cookies, and traffic or error logs. Cloudflare’s handling is described in the Cloudflare Privacy Policy.

5.4 Amazon Web Services and Lightsail

M3GA may host websites, applications, databases, backups, or logs using Amazon Web Services, including Amazon Lightsail. Information stored or transmitted through those systems may include account, content, transaction, gameplay, support, security, and technical information described in this Policy. AWS generally processes customer content for M3GA under the applicable service terms; information AWS collects for its own services is described in the AWS Privacy Notice.

5.5 Epic Online Services and Epic Account Services

If a game uses Epic Online Services (“EOS”) or Epic Account Services (“EAS”), M3GA and Epic may process platform or product user identifiers, Epic account information you authorize, display name, linked accounts, friends or social graph where authorized, presence, lobbies, matchmaking, sessions, achievements, player and game data, reports, and technical or security information.

EAS requests access by permission scope, and you can review the permission request before authorizing access. We use the information to authenticate users, connect accounts, provide cross-platform or multiplayer features, save data, operate social features, and protect the Service. Epic’s own processing is described in the Epic Games Privacy Policy.

5.6 Valve Steamworks and Steam

If a game uses Steamworks or is distributed through Steam, Valve may provide or make available a Steam identifier, profile name, avatar, country or region, friends information where permitted, ownership and entitlement status, achievements, statistics, lobbies, multiplayer or workshop activity, and transaction or platform information. We use it to authenticate, deliver the game and entitlements, operate Steam features, support users, prevent abuse, and understand performance. Valve processes Steam information under the Steam Privacy Policy.

5.7 Sony Interactive Entertainment and PlayStation

If a game is distributed on or connects to PlayStation, Sony Interactive Entertainment may provide or make available a PlayStation Network identifier or online ID, profile or country information, friends or social information where permitted, ownership and entitlement status, achievements or trophies, multiplayer, presence, invitation, gameplay, transaction, device, security, and moderation information. We use it to authenticate, deliver entitlements, enable platform features, provide support, and protect the Service. Sony’s processing is described in the applicable PlayStation Privacy Policy.

5.8 Platform Independence

Apple, Google, Shopify, Cloudflare, AWS, Epic, Valve, Sony, and other identified providers may act as M3GA’s processor or service provider for some activities and as an independent business or controller for others. Their privacy notices govern their independent activities. Privacy requests about information controlled only by a platform should be directed to that platform; we will reasonably assist with requests concerning information we control.

6. How We Use Information

We may use information for the following purposes:

• Provide and operate Services: create and authenticate accounts; provide websites, apps, gameplay, multiplayer, social, cloud-save, support, purchases, subscriptions, entitlements, and requested features; remember settings; and maintain continuity across devices where supported.
• Process transactions: validate purchases, fulfill physical or digital orders, administer subscriptions, restore purchases, process returns or refunds, maintain transaction records, and prevent payment fraud.
• Communicate: send service messages, security notices, purchase confirmations, support responses, policy updates, and, with the required choice, marketing messages.
• Personalize: remember preferences and tailor content, gameplay, recommendations, or ads when permitted.
• Analyze and improve: understand use, test features, diagnose errors, measure performance, conduct research, and develop or improve Services.
• Advertise and measure: provide contextual or permitted personalized advertising, cap frequency, attribute campaigns, and measure ad effectiveness.
• Protect users and Services: secure accounts and systems; detect, investigate, prevent, and respond to fraud, cheating, abuse, harassment, harmful content, unauthorized access, technical attacks, or violations of terms and policies; and enforce rules.
• Comply and defend: satisfy legal, tax, accounting, reporting, audit, and regulatory duties; respond to valid legal process; and establish, exercise, or defend legal claims.
• Corporate operations: support internal administration, financing, insurance, audits, professional advice, restructuring, and an actual or proposed business transaction.
• With your direction or consent: carry out another purpose that we explain when requesting information or consent.

We may combine information collected through different M3GA Services or from linked platforms when reasonably necessary for these purposes and permitted by law.

7. Legal Bases for International Users

Where the laws of the European Economic Area (“EEA”), United Kingdom (“UK”), Switzerland, or another jurisdiction require a legal basis, we rely on one or more of the following:

• Contract: processing necessary to provide a Service or feature you request, administer an account, deliver a purchase, or perform applicable terms.
• Legitimate interests: operating, securing, supporting, analyzing, improving, and promoting Services; preventing fraud and abuse; maintaining records; and conducting ordinary corporate operations, after considering the impact on your rights.
• Consent: personalized advertising, certain analytics or device storage, marketing, access to optional platform information, or another purpose for which we ask consent. You may withdraw consent at any time.
• Legal obligation: tax, accounting, consumer-protection, sanctions, age-assurance, safety, law-enforcement, and other duties.
• Vital interests or public interest: only in unusual circumstances where processing is necessary to protect a person or perform a task recognized by law.

If we ask for information needed to perform a contract or comply with law and you do not provide it, the affected Service or feature may be unavailable. Where we rely on legitimate interests, you may object as described in Section 13.

8. When We Disclose Information

We may disclose information as follows:

• Affiliates and common-ownership entities: to AFC or another future affiliate for the limited operational purposes described in this Policy.
• Vendors and service providers: to hosting, security, analytics, advertising, consent-management, payment, commerce, communications, customer-support, moderation, anti-fraud, professional-advice, and other providers that perform services for us.
• Platforms and storefronts: to Apple, Google, Epic, Valve, Sony, Shopify, or another platform as needed for authentication, purchases, entitlements, multiplayer, social features, support, security, compliance, and user-directed account links.
• Other users and the public: when you join a multiplayer experience, publish content, use a public profile or leaderboard, communicate with others, or otherwise choose to share. Visible information may include a display name, avatar, status, scores, achievements, gameplay, content, or communications.
• User-directed recipients: when you ask us to share information, link accounts, send an invitation, use Messages, or interact with an external service.
• Legal and safety recipients: to courts, regulators, law enforcement, government bodies, affected parties, or advisors when we reasonably believe disclosure is required or permitted to comply with law, protect rights or safety, investigate wrongdoing, or enforce terms.
• Business transactions: to actual or prospective investors, lenders, insurers, purchasers, successors, and advisors in connection with financing, due diligence, reorganization, merger, acquisition, sale, bankruptcy, or transfer of all or part of a business or asset, subject to appropriate confidentiality and legal safeguards.

We require service providers to protect information and limit processing to authorized purposes through contracts or other safeguards appropriate to their role. A platform acting independently may use information under its own notice.

9. Cookies and Similar Technologies

Websites and apps may use cookies, local storage, SDKs, pixels, tags, and similar technologies for:

• Strictly necessary purposes: security, fraud prevention, load balancing, network routing, account authentication, shopping carts, consent records, and core functionality.
• Preferences and functionality: language, region, display, saved settings, and optional features.
• Analytics and performance: traffic, usage, errors, and Service improvement.
• Advertising: ad delivery, frequency, measurement, attribution, and personalization where permitted.

Available controls may include a cookie banner, UMP message, privacy-choices page, browser controls, device settings, and legally recognized opt-out preference signals. Blocking strictly necessary storage may cause a Service to malfunction. Browser “Do Not Track” signals are not interpreted consistently across the industry; we honor Global Privacy Control and other opt-out preference signals where applicable law requires and our technology can reasonably associate the signal with the relevant browser or device.

10. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing Services, maintaining security and continuity, complying with law, resolving disputes, and enforcing agreements. We consider the amount, nature, sensitivity, purpose, legal requirements, and risk of harm when selecting a period.

Unless a Service-specific notice, platform requirement, or law requires a different period, our target retention periods are:

• Account, profile, and saved progress: while the account is active, then deleted or deidentified within 30 days after a valid deletion request or account closure, except for information that must be retained.
• Backups: removed through normal backup rotation, generally within 90 days after deletion from active systems, unless a backup is preserved for security, disaster recovery, or legal reasons. Restored backup data will remain subject to the deletion request.
• Purchase, order, tax, and accounting records: generally seven years after the transaction or longer if required by law, while excluding complete payment-card data we do not receive.
• Consent and privacy-choice records: generally five years after the choice, withdrawal, or account closure, or longer when reasonably necessary to demonstrate compliance.
• Privacy-rights requests: generally five years after completion to document the request and prevent unauthorized disclosure or repeat processing.
• Support and ordinary correspondence: generally three years after the matter closes.
• Crash, diagnostic, and performance records: generally up to 24 months, unless aggregated or needed to investigate an ongoing issue.
• Raw web, access, and security logs: generally up to 12 months; records tied to fraud, abuse, cheating, a security incident, enforcement, or legal claim may be retained for up to five years after the matter closes or as legally necessary.
• Advertising and analytics: user-level or event-level analytics retained under our configured provider settings, generally no longer than 14 months where configurable; campaign, aggregated, or deidentified reports may be retained longer. Advertising partners maintain their own retention periods.
• User content and communications: until deleted by you, account closure, or the end of the feature, subject to moderation, legal, safety, and backup exceptions. Content preserved with a report or enforcement matter may be retained for up to five years after closure.

Deletion may be delayed or denied to the extent information is necessary to complete a requested transaction, preserve an entitlement, detect or prevent fraud, secure a Service, exercise speech or another legal right, comply with law, maintain a required business record, establish or defend legal claims, or satisfy another lawful exception.

Deleting the app from a device does not itself delete a server account or cancel a platform subscription. Deleting an M3GA account does not delete information independently controlled by Apple, Google, Epic, Valve, Sony, Shopify, or another provider.

11. Security

We use administrative, technical, and physical safeguards designed for the nature of the information and the size and circumstances of our operations. Measures may include encryption in transit, access controls, least-privilege practices, authentication protections, logging, backups, vendor review, software updates, and incident-response procedures.

No system, transmission, or storage method is completely secure. You are responsible for maintaining the confidentiality of account credentials and for notifying us if you suspect unauthorized use. If a breach affecting personal information occurs, we will investigate and provide notice when required by applicable law.

12. Children and Teens

Unless a Service-specific notice says otherwise, M3GA Services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information from a child under 13 without verifiable parental consent or another lawful basis.

If a Service is directed to children, knowingly collects age information indicating a user is a child, or enables a child account through a platform, we will apply age-appropriate settings, obtain parental consent where required, limit data and advertising as required, and provide an additional children’s privacy notice if necessary.

Users who are under the age of legal majority should use Services only with the involvement of a parent or guardian where required. We do not knowingly use personal information of users under 18 for targeted advertising when prohibited. Apple may prevent ATT requests for child accounts and certain users under 18, and we will honor that platform restriction.

A parent or guardian who believes a child provided personal information without required permission may email [email protected] with the subject Child Privacy Request. We may verify the requester’s identity and relationship before providing access or deletion.

13. Your Choices and Privacy Rights

Depending on your location and the Service, you may have the right to:

• confirm whether we process your personal information and access it;
• request correction of inaccurate information;
• request deletion;
• receive a portable copy of certain information;
• opt out of sale, sharing, targeted advertising, or certain profiling;
• limit or withdraw consent for processing, including certain sensitive information;
• object to or restrict certain processing;
• appeal our denial of a request;
• designate an authorized agent where permitted; and
• complain to a regulator or supervisory authority.

You will not receive unlawful discriminatory treatment for exercising a privacy right. Rights are subject to applicable definitions, thresholds, exceptions, and verification requirements.

13.1 How to Exercise a Right

Email [email protected] with the subject Privacy Rights Request and state the right you wish to exercise, the Service involved, the country and state where you reside, and the email address or platform identifier associated with the Service. Use the in-product account-deletion or privacy control when one is available.

We may ask for information reasonably necessary to verify identity, account ownership, residency, or an agent’s authority. We will not ask for more information than reasonably necessary. If we cannot verify a request, we may deny or limit it and explain why. We generally respond within the period required by law, such as 45 days for qualifying California requests or one month for many EEA and UK requests, subject to lawful extensions.

To appeal a denial, email the same address with the subject Privacy Appeal within 60 days of our decision and explain why you believe the decision should be reconsidered. If applicable law gives you a right to contact an attorney general or regulator after an appeal, our response will provide available instructions.

13.2 Account Deletion

If a mobile app allows creation of an M3GA account, it will provide a way to initiate deletion from within the app. You may also use the email method above. We may require reauthentication or verification to protect the account. Deletion may permanently remove progress, content, virtual items, and access that cannot be restored, except for platform-managed purchases or records we must retain.

13.3 Consent and Device Controls

You can withdraw or change consent through a UMP or cookie message, a Service privacy control, Apple ATT settings, platform settings, or by contacting us. You can also manage notifications, camera, microphone, photos, local-network access, and other device permissions in operating-system settings.

13.4 Marketing

You may unsubscribe from promotional email through the link in the message or by emailing us. We may still send non-promotional communications about accounts, transactions, security, legal notices, or requested support. We do not treat a reply containing “STOP” as an SMS opt-out unless the message was sent through an SMS program that instructs you to reply STOP.

13.5 Linked Accounts

You can disconnect a linked account through the applicable M3GA or platform settings where available. Disconnecting stops future sharing through the link but does not automatically delete information already processed or information the other platform controls. Submit a deletion request to each relevant controller when needed.

14. United States State Privacy Notice

This section supplements the rest of the Policy for residents of U.S. states with comprehensive consumer privacy laws. It applies only to the extent the relevant law applies to M3GA and the information at issue.

14.1 Categories Collected and Disclosed

During the preceding 12 months, depending on the Services used, we may have collected and disclosed for a business purpose:

• Identifiers and customer records, including name, contact details, account or platform ID, online identifiers, shipping information, and protected authentication data. Sources include you, devices, platforms, and commerce providers. Recipients may include affiliates, hosting, security, support, commerce, payment, platform, analytics, and advertising providers.
• Commercial information, including products, purchases, subscriptions, entitlements, and transaction history. Sources include you, storefronts, and payment or platform providers. Recipients may include commerce, payment, accounting, fulfillment, support, and platform providers.
• Internet, device, and gameplay activity, including IP address, browser, device, pages, interactions, gameplay, ads, diagnostics, and logs. Sources include devices, cookies, SDKs, games, platforms, and network providers. Recipients may include hosting, security, analytics, advertising, platform, and support providers.
• Approximate geolocation, generally inferred from IP address. Recipients may include hosting, security, analytics, advertising, and platform providers.
• Audio, visual, electronic, or communications information, when you submit media, use voice or chat, contact support, or use a social feature. Recipients may include other users you select, moderation, communications, hosting, platform, security, and support providers.
• Characteristics or demographic information, such as age or age range, country, language, or voluntarily provided gender information, when a Service requests it. Recipients may include age-assurance, account, support, analytics, and platform providers as permitted.
• Inferences, such as preferences, likely interests, fraud risk, or gameplay patterns derived from activity. Recipients may include analytics, advertising, security, and platform providers.
• Sensitive personal information, potentially including protected account credentials, precise location only if a feature specifically requests it, or communications/content that qualifies as sensitive under a particular law. We use sensitive information only for disclosed and permitted purposes and do not use it to infer characteristics for advertising.

We collect these categories for the purposes in Section 6 and retain them as described in Section 10.

14.2 Sale, Sharing, and Targeted Advertising

We have not sold personal information for money. If advertising is enabled, we may have disclosed device identifiers, online activity, advertising data, approximate location, and related inferences to Google or another identified advertising partner in a manner that some laws define as sale, sharing, or targeted advertising. You may opt out as described in Sections 3.4 and 13.

We do not knowingly sell or share personal information of consumers under 16. We do not offer a financial incentive or loyalty program in exchange for personal information unless we first provide a separate notice required by law.

14.3 California-Specific Information

If the California Consumer Privacy Act (“CCPA”) applies, California residents may request to know, access, correct, delete, and receive information about categories of sources, purposes, and recipients; opt out of sale or sharing; and limit certain uses or disclosures of sensitive personal information. We do not use or disclose sensitive personal information for purposes that require a right-to-limit link unless a notice says otherwise.

M3GA operates its covered consumer Services online and designates [email protected] as the method for California requests. An authorized agent may submit a request, but we may require proof of authorization and direct verification with the consumer. California residents may also have rights under Civil Code section 1798.83 concerning certain disclosures for direct marketing; we do not disclose customer personal information to unaffiliated third parties for their own direct marketing without consent.

15. EEA, UK, Switzerland, and Other International Rights

For individuals in the EEA, UK, or Switzerland, M3GA is generally the controller for processing described in this Policy. You may have rights of access, correction, erasure, restriction, portability, objection, and withdrawal of consent. You may object to direct marketing at any time. You may also object to processing based on legitimate interests; we will stop unless we demonstrate compelling lawful grounds or need the information for legal claims.

We do not intentionally make decisions based solely on automated processing that produce legal or similarly significant effects without providing notices and rights required by law. We may use automated signals to identify fraud, cheating, harmful behavior, or security risks. Where such a system materially restricts an account, you may contact us for review, subject to measures needed to protect detection methods and other users.

You may complain to the data-protection authority where you live, work, or believe a violation occurred. Contact us first if you would like us to try to resolve the concern.

Residents of Brazil, Canada, Australia, and other jurisdictions may have comparable rights under local law. Submit a request through Section 13, and we will apply the rights and response process required for your location.

16. International Data Transfers

M3GA is based in the United States, and our providers and platforms may operate in the United States and other countries. Those countries may have privacy laws different from those where you live.

Where required, we use legally recognized safeguards for international transfers, which may include adequacy decisions, standard contractual clauses, the UK addendum or international data transfer agreement, contractual and technical safeguards, or a provider’s valid certification under an applicable data privacy framework. A provider’s certification does not mean M3GA itself is certified. You may request information about applicable safeguards by contacting us.

17. Third-Party Links, Social Features, and Public Information

Services may include links, embedded content, platform overlays, or integrations operated by others. Their collection and use are governed by their own notices. Review those notices before providing information.

Information you make public through profiles, leaderboards, multiplayer, forums, chat, reviews, streams, screenshots, or shared content may be seen, recorded, copied, or redistributed by others. Use care when disclosing personal information. If you report another user, information from the report may be used to investigate and may be disclosed as reasonably necessary for fairness, safety, enforcement, or law.

18. Changes to This Policy

We may update this Policy to reflect changes in Services, providers, law, or business operations. We will revise the “Last Updated” date and post the updated Policy at the same public location. If a change materially affects how we use personal information, we will provide additional notice through the Service, website, account email, or another appropriate method. We will request new consent where required rather than relying solely on continued use.

This version replaces the M3GA Studios LLC Privacy Policy dated July 23, 2023. Prior versions may be requested by email.

19. Dispute Resolution and Individual Arbitration – U.S. Users

Important: This section applies only when you have affirmatively agreed to M3GA Terms of Use that incorporate this Policy, or have otherwise affirmatively agreed to this arbitration provision. Merely viewing this Policy does not by itself create an agreement to arbitrate. Privacy rights, regulator complaints, and remedies that cannot lawfully be waived remain available.

19.1 Informal Resolution

Before filing arbitration or a lawsuit, the party asserting a dispute must send an individualized written notice describing the claimant, account or contact information, facts, legal basis, and requested relief. Send a notice to [email protected] with the subject Notice of Dispute. M3GA will send its notice to the email associated with the account. The parties will attempt in good faith to resolve the dispute for 30 days after receipt. A limitations period is tolled during that 30-day period to the extent permitted by law.

19.2 Binding Individual Arbitration

Except for excluded claims below, a dispute arising out of or relating to this Policy, privacy or data practices, a Service, or the relationship between you and M3GA will be resolved by binding arbitration on an individual basis. The Federal Arbitration Act governs the interpretation and enforcement of this section. Arbitration will be administered by the American Arbitration Association (“AAA”) under its Consumer Arbitration Rules then in effect, as modified by this section. If AAA is unavailable and the parties cannot agree on an administrator, a court may appoint one under 9 U.S.C. section 5.

The arbitration may occur by documents, telephone, video, or in the county where you reside, as the applicable rules permit. The arbitrator may award the same individual remedies a court could award, but only to the extent necessary for the individual claimant. M3GA will pay arbitration fees to the extent required by the AAA rules or applicable law. Each party bears its own attorneys’ fees unless a statute, rule, or award permits otherwise.

19.3 Exceptions

Either party may bring an individual claim in small-claims court if it qualifies and remains individual. Either party may seek temporary or preliminary court relief necessary to protect intellectual property, confidential information, system security, accounts, or safety while arbitration is pending. Nothing prevents you from reporting a concern to a regulator, attorney general, law-enforcement agency, or data-protection authority. A request for public injunctive relief that applicable law makes nonwaivable may proceed in court after arbitrating arbitrable individual issues, unless law requires a different sequence.

19.4 Class and Jury Waivers

To the fullest extent permitted by law, disputes must be brought only in an individual capacity and not as a plaintiff or class member in a class, collective, consolidated, mass, or representative proceeding. The arbitrator may not combine claims or preside over a representative proceeding without the written consent of all parties. For any dispute permitted to proceed in court, each party knowingly waives trial by jury to the fullest extent permitted by law.

19.5 Thirty-Day Opt-Out

You may opt out of this arbitration section within 30 days after first accepting the Terms that incorporate it. Email [email protected] with the subject Arbitration Opt-Out and include your name, the email or account identifier used with the Service, the Service name, and a clear statement that you opt out of arbitration. Opting out of arbitration does not opt you out of the Terms or this Policy and will not affect access to a Service.

19.6 Severability and Survival

If a part of this arbitration section is unenforceable, it will be severed to the minimum extent necessary, except that if the prohibition on class or representative arbitration is unenforceable as to a particular claim, that claim will proceed in court and not class arbitration. This section survives account closure and termination of the Service or Terms.

20. Contact Us

M3GA Studios LLC does not maintain a public-facing office for privacy inquiries. Email is the designated contact method for privacy questions and requests.

M3GA Studios LLC

Email: [email protected]

Use Privacy Rights Request in the subject line for access, correction, deletion, portability, consent, sale/sharing, targeted-advertising, or other privacy rights. Use Privacy Appeal to appeal a decision. We may direct you to a secure method if identity documents or sensitive information are necessary.