Your personal data is processed by FAYZ Game Studios (Fayz Game Studios) as data controller under the EU General Data Protection Regulation (GDPR) where it applies and the Turkish Personal Data Protection Law No. 6698 (KVKK). Email: support@ulgara.com.
Data we process
Account: email address, player name, a one-way hash of your password (the password itself is never stored), your Google account ID if you sign in with Google, language preference.
Game: in-game progress, messages and alliance chat, session sign-in and sign-out times.
Technical: IP address (briefly, in memory, to prevent abuse; in addition, to detect multiple accounts and cheating, an irreversible hash of the address, not the address itself, is kept for at most 90 days), browser and device type.
Purchases: product, amount, currency and Paddle transaction number. Your card and billing details are processed by Paddle and never reach us.
Purposes and legal bases
Creating your account, running the game and delivering what you buy (performance of a contract).
Keeping financial and legal records (legal obligation).
Preventing cheating and abuse, securing the Service, and aggregate statistics to improve the game (legitimate interest).
Sending account confirmation and password reset emails (performance of a contract). We do not send marketing emails.
Sharing
We share your data only as far as needed to run the Service, with these providers: Paddle.com Market Ltd. (payments, United Kingdom), Resend (email delivery, USA), Google (optional sign-in) and the provider hosting our servers. Transfers outside your country rely on appropriate safeguards such as standard contractual clauses. We do not sell your data or share it for advertising.
Cookies and local storage
We use no advertising or tracking cookies. Your session, language and settings are kept in your browser's local storage; these are needed for the game to work. Paddle may use its own cookies during checkout.
How long we keep data
Guest accounts are deleted after 30 days without use.
Registered accounts are kept until you ask for deletion; after that, data we are not required by law to keep is deleted.
Purchase records are kept for as long as tax and commercial law requires (up to 10 years in Turkey).
Children
We do not allow children under 13 to create an account. If we learn that such an account exists, we delete it.
Your rights
You have the right to access, copy, correct and delete your data, to object to processing and to data portability. Send your request from your account email to support@ulgara.com; we reply within 30 days. You may also complain to your data protection authority.
Security
Connections are encrypted (HTTPS), passwords are stored with strong hash functions and access to data is limited to authorised people.