Supervillain Labs
Privacy Policy
Created: 01-31-2024
Last update: 09-06-2024
1. Introduction
Welcome to Supervillain Labs!
This Privacy Policy explains the when, how and why when it comes to the processing of your personal information in connection with our official website ("Website"), our games ("Games") and other online services that we provide (collectively, the "Services"), and sets out your choices and rights in relation to that information. SVL may share your personal information with its affiliates and subsidiaries (collectively "SVL", "we", "us", or "our") to the extent necessary to provide the Services to you. Please read it carefully – it will allow you to understand how we collect and use your information, and how you can control it.
Please note that this Privacy Policy only applies to the Website, Games and Services. If you use any other products or services please refer to the privacy policy for that particular product or service.
If you do not agree to the processing of your personal information in the way this Privacy Policy describes, please do not provide your information when requested and stop using the Website, Games and Services. By using the Website, Games and Services you are acknowledging how we process your personal information as described in this Privacy Policy.
We also use cookies and other similar technologies ("Cookies") to enhance your experience using the Website. Cookies are small files which, when placed on your device, enable us to provide certain features and functionalities. For more information about our Cookies policy, click here.
2. Children
Children must not use our Website, Games and Services for any purpose, except where their parent or legal guardian has provided lawful consent (to the extent this option is available in your jurisdiction). If you are a parent or legal guardian of a child who has signed up with your consent and you would like to understand more about the Service or how you can revoke your consent, please carefully read this Privacy Policy.
By children, we mean users under the age of 18 years old; or in the case of a region where the minimum age for processing personal information differs, such different age. For users located in certain regions we have listed the relevant minimum age as of the date of this policy in the table below. You should in any case refer to the laws in your jurisdiction to ensure you are above the relevant legal minimum age.
Other than as provided above, we do not knowingly collect personal information from children under these ages for any purpose. If you believe that we have personal information of a child under these ages without lawful consent, or if you are the parent or guardian of the user and wish to withdraw consent, please contact us.
| Region in which the user is located | Minimum age of the user |
|---|---|
| Australia | 18 |
| Brazil | 18 |
| Colombia | 18 |
| Canada | 13 |
| European Economic Area | 16 |
| Japan | 18 |
| Mexico | 18 |
| New Zealand | 16 |
| Philippines | 18 |
| Singapore | 13 |
| South Africa | 18 |
| South Korea (Mobile and Website) | 14 |
| South Korea (PC) | 18 |
| Switzerland | 16 |
| Thailand | 20 |
| United Kingdom | 13 |
| United States | 13 |
3. How We Process Your Personal Information
This section provides more detail on the types of personal information we collect from you, and why.
For users who live in Brazil, the European Economic Area, Switzerland, Thailand or the United Kingdom, it also identifies the legal basis under which we process your data.
| Personal Information | Use | Duration of use |
|---|---|---|
| For the Website | ||
| Device information: whether you use an iOS or Android device, and device model, IP address | We use this information to:
| 1 year from the date your account is closed (members) or the date of collection (non-members) |
Social Media Information (if you choose to sign up and log in via your social media account):
| We use this information to create SVL member account. | 1 year from the date your account is closed |
Personal Information for Customer Service:
| We use this information to:
| 1 year from the date of collection |
| Email address (optional) | For sending news, events and promotions related to the Game. | Until you withdraw your consent. |
| Vir Account ID (if you created SVL member account) | We use this information to create SVL member account. | 1 year from the date your account is closed |
| Account Inventory ID (if you created SVL member account) | We use this information to:
| 1 year from the date your account is closed |
| Wallet Address | We use this information to:
| 5 years from the date your account is closed |
| Transaction Information | We use this information to:
| 5 years from the date your account is closed |
| Country/Region (if you provide your location) | We use this information to comply with regional regulations related to game usage, payments, and other services. | 1 year from the date your account is closed |
| Account deletion/restoration information (Website): email address, social media information, contact name, nickname, user id, email address | We use this information to allow you to delete/restore your account upon your request. | 1 year from the date your account is closed |
| Data automatically collected by our servers(which may be hosted by third-party service providers): browser type, operating system, Internet Protocol ("IP") address (a number automatically assigned to your computer when you use the internet, which may vary from session to session), referring/exit pages, domain name, visit date/time stamps. | We use this information to:
| 1 year from the date your account is closed |
| Other session data linked to your Account | We use this information to create your Website account in accordance with your request. | Until your account is closed |
| For the PC Version, Mobile Version and Website Version of the Game | ||
| Information you provide to us (either directly or through a third party) | ||
| Guest log-in information: guest ID | We use this information to create your Game account in accordance with your request. | 1 year from the date your account is closed |
| Identification information used to identify users across all game servers: Vir Game Account ID | We use this information to create your Game account in accordance with your request. | 1 year from the date your account is closed |
| Identification information used to identify players (characters) within the game server: UID, nickname | We use this information to:
| 1 year from the date your account is closed |
Social Media information (if you choose to log in via your social media account with these networks):
| We use this information to create your account for the Game in accordance with your request. | 1 year from the date your account is closed |
| Hashed Information: Nickname, email address | If your account is determined to breach our Terms of Service or otherwise is found to be undertaking activity which is illegal, defamatory, damaging to the platform or similar, and your account is consequently suspended, we may publish a hashed version of your nickname and email address on our Website and in the Game (including via in-Game pop-up). | 1 year from the date your account is closed |
| Email delivery information: email address | We use this information to send you notifications to facilitate creation of your account for the Game (such as verification codes) and to obtain parental consent to participate in the Game (if applicable). | 1 year from the date your account is closed |
Customer support information:
| We use this information to provide support and troubleshooting, such as addressing and remediating technical issues and bugs, and improve our services. | 1 year from the date your account is closed |
| User Report Information: information of reporting user and reported user, report descriptions, game match data, punishment or gaming restrictions, in-game chat information (to the extent raised in relation to the report), report processing time, report processing results and reasons | We use this information to review reports and complaints, and determine whether reported users have cheated in the Game or otherwise violated the Terms of Service. | 5 years from the date of collection |
Crash-related information:
| We use this information to locate and resolve crash issues. | 5 years from the date of collection |
| Information generated as part of the Game | ||
| IP address | We use this information to allow you to use the Game and connect to our servers. | 1 year from the date your account is closed |
| Common data reporting information: game ID, client source, session ID, event time, client IP, country, province, city, carrier ID, Vir Game Account ID, event name, OS, OS version, SDK version, network type, bundle ID, app version, login channel ID, device model, device brand, screen width, screen height, CPU name, CPU core, CPU frequency, GPU name, total ROM, system language | We use this information for data analytics purposes. | 1 year from the date of collection |
| In-game notifications / announcements information: UID | We use this information to send you in-game notifications and announcements relating to the Game. | Until your account is closed |
| Data monitoring information: error code, error message, SDK name, SDK version, request URL, response body, sequence ID, stage, log, common information for data reporting | We use this information to fix bugs, and to understand the performance and interaction of our SDKs. | 1 year from the date of collection |
| System notification information: device token and FCM (Firebase Cloud Message) token (Not applicable to Website Version) | We use this information to provide you with notifications on your device about the Game. | 1 year from the date of collection |
Game data (including log information):
| We use this information:
| 1 year from the date of collection |
Crash information (SENTRY, Firebase Crashlytics):
| We use this information to solve crashes and optimize compatibility. | 5 years from the date of collection |
| Chat data (free text): Chat data: UID | We use this information to facilitate the posting of your communications with other users. | 1 year from the date of collection |
| Analytics service (APAS) information: User region (country, province, city, carrier ID, region, IP address); device information (application version, application ID, battery information, WiFi strength, available space, network type, OS version, OS name, carrier, country code, device language, device resolution, brand, manufacturer, device model, RAM, ROM and CPU information, GPU information, game frame information, mobile signal strength, network round trip time, network bytes received/sent, login/pay step event information, network delay, packet lost rate, count of android app) | We use this information for feedback and gameplay analytics to improve the Game experience. | 1 year from the date of collection |
| Data analytics to report key statistics from the processes of log-in and game updates: event name, stage number, stage name, stage status, stage error code, extra json, stage time | We use this information to understand the success rate of the log-in and update process. | 1 year from the date of collection |
| Account deletion information (H5): email address, region, Vir Game Account ID, user token | We use this information to allow you to delete your account upon your request. | 1 year from the date of collection |
| Payment information: Vir Game Account ID, country, UID, CPU model, device model, currency, SDK version, application version, network type, IDFV, purchase amount Not applicable to Website Version. | We use this information to enable you to use the payment function in the Game. | 3 years from the date of collection |
| For Mobile Version and Website Version only | ||
Data analytics/profiling information (Adjust):
| We use this information for ad attribution. If you live in the European Economic Area: We collect this information with your consent. If you do not live in the European Economic Area: It is in our legitimate interest to carry out data analytics and profiling for ad attribution purposes to understand how our users interact with advertisements. We use the Google Advertising ID with your consent. It is in our legitimate interest to use the Firebase Instance ID to increase in-game purchase rate of new users through Google platforms | 1 year from the date of collection |
Data analytics/profiling information (Firebase):
| We use this information for app performance analytics. We use the Firebase Instance ID to increase in-Game purchase rates of new users through Google platforms. If you live in the European Economic Area: We collect this information with your consent. If you do not live in the European Economic Area: It is in our legitimate interest to use this information to monitor the effectiveness of our advertisements and to provide a better gaming experience. | 1 year from the date of collection |
Data analytics/profiling information (Facebook):
| We use this information for user acquisition purposes and to monitor the effectiveness of our advertisements. If you live in the European Economic Area: We collect this information with your consent. If you do not live in the European Economic Area: It is in our legitimate interest to use this information to monitor the effectiveness of our advertisements so as to provide better gaming experience | 1 year from the date of collection |
| Data analytics to analyse user acquisition statistics (Google): hashed email address | We use this information for user acquisition purposes and to monitor the effectiveness of our advertisements. | 1 year from the date of collection |
| Security-related information (Mobile and Website Versions): list of hack or cheating software, in-game screen information, device operation system settings, device information including mobile phone brand, model, CPU structure, CPU model, kernel version, resolution, application package of hack software, available memory, wifi access point, list of installed APK and running apps, jailbreak status (iOS) | We use this information to ensure the security and safety of the services of the Game (such as through anti-cheat functions). | 5 years from the date of collection |
4. Processing and Sharing Personal Information with Third Parties
We may transfer personal information we collect from you to the other region for the purposes set forth in this Privacy Policy.
We do not share or sell your personal information with any independent third parties without your consent.
Only where necessary will we share your personal information with third parties. Situations where this occur are:
- Third parties that provide services in support of the Website and the Game, including providers of cloud services that process information identified in this policy on their servers for the purpose of providing the Game, for the purpose of processing support ticket ID and support communication, for the purpose of processing gameplay and game rendering data to provide game analytics to improve gameplay, and for the purpose of providing marketing and advertisements and monitoring the success of our marketing and advertising programs. All companies providing services for us are prohibited from retaining, using, or disclosing your personal information for any purpose other than providing us with their services.
- Companies within our corporate group who process your personal information solely for the purpose of providing the Game to you. All such group companies may only use your personal information in accordance with this Privacy Policy.
- Regulators, judicial authorities and law enforcement agencies. There are circumstances in which we may be legally required to disclose information about you, such as to comply with legal obligations or processes. In complying with the terms of valid legal processes, such as a subpoena, or search warrant, unfortunately we may not be able to seek your consent to or notify you in advance of such disclosure.
- Third parties to ensure safety, security, or compliance with laws. We may disclose your information to:
- enforce our terms and conditions and other agreements, including investigation of any potential violation thereof;
- detect, prevent or otherwise address security, fraud or technical issues; or
- protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law (such as exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction).
- A third party that acquires all or substantially all of us or our business. We may also disclose your information to third parties if we either: (a) sell, transfer, merge, consolidate or re-organise any part(s) of our business, or merge with, acquire or form a joint venture with, any other business, in which case we may disclose your data to any prospective buyer, new owner, or other third party involved in such change to our business; or (b) sell or transfer any of our assets, in which case the information we hold about you may be sold as part of those assets and may be transferred to any prospective buyer, new owner, or other third party involved in such sale or transfer. If you have more questions about our business partners, please contact us at cs@supervlabs.io.
Some portions of our Services are provided by third-party service providers. To the extent necessary to provide the Services to you, they may collect and record information about your use of our Services. However, we cannot control their activities and cannot guarantee that they will adhere to the privacy and security practices same or similar to ours. If you have any questions about their use of the information you should contact them directly.
5. Opt Out Options
We may send local or push notifications to your device or applications to make you aware of game updates, promotional events, new game information, and other relevant messages regarding the Service. You can manage push notifications from the "options" or "settings" page within the game, or your device's settings page for the relevant game.
We may send email to make you aware of newsletters, promotional event information, promotional invitations, updates on new games or services, and other relevant messages regarding the Service. If you wish to opt out of receiving commercial email messages or interest-based ads from us, please disable email notifications on the settings page of the Supervillain Labs official website.
Please note that if you opt out of receiving marketing related emails from us, we may still send you important administrative messages, from which you cannot opt out.
6. Retention of Personal Information
We will only retain your personal information as long as you continue to use the Services, or for as long as is necessary to fulfill the purposes outlined in this Privacy Policy.
Personal information in electronic file form will be permanently deleted in a way that cannot be recovered, and personal information in document form will be shredded or incinerated using a document shredder.
Please note that even if you delete your personal information from us, we may retain a copy of your personal information to comply with laws and for other purposes described in Section 4(d) of this Privacy Policy.
7. Rights to Access, Correction, and Deletion of Personal Information
You may have legal rights to request access, correct, restrict, port, copy, or delete your personal information, or withdraw your consent. Upon your request to withdraw consent, we will stop processing your personal information. However, such withdrawal will not affect the processing of personal information previously covered by your consent. A request to withdraw consent, restrict or stop processing your information, or delete your account or information may result in your inability to access the Services or some of its features. Please note that even if you delete your personal information from us, we may retain your personal information to comply with laws and for other purposes described in Section 4(d) of this Privacy Policy.
If you wish to exercise your legal rights or any parents or legal guardians wish to exercise the rights on behalf of their children, you may submit a verifiable request to cs@supervlabs.io. If verified, we will provide the information unless doing so proves impossible or would involve a disproportionate effort. You might be asked to provide additional information to verify that the person making the request is the same person about whom we collected information. This additional information will be used solely for verification purposes.
8. Protection Measures of Personal Information; International Transfer
We take appropriate technical security safeguards to protect your information from unauthorized access, destruction, use, modification or disclosure. However, we cannot guarantee the absolute security of your information we collect from you, as the Internet by its nature is not a secure environment. If you choose to share your information with us, please be reminded of such risk.
By using our services or otherwise providing us with personal information, you agree to send and process your information internationally. When transferring personal information outside, we implement technical, organizational and physical protection to protect your personal information.
9. For California Residents
For California residents, your rights under the California Consumer Privacy Act (CCPA) are: right to request disclosure of personal information, right to request deletion of personal information, right to prevent the sale of personal information, and protection against discrimination.
9.1 Categories of Personal Information We Collect and Share
Please see Section 3 of this Privacy Policy.
Some portions of our Services are provided by third-party service providers. To the extent necessary to provide the Services to you, they may collect and record information about your use of our Services. However, we cannot control their activities and cannot guarantee that they will adhere to the privacy and security practices same or similar to ours. If you have any questions about their use of the information you should contact them directly.
9.2 Right to Opt-Out (DO NOT SELL MY PERSONAL INFORMATION)
California residents may opt out of the sale of your personal information at any time. Under the CCPA, "Sale" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration. We do not sell California residents' personal information to third parties. We may transfer your personal information to our affiliates that is necessary to provide the Services to you pursuant to this Privacy Policy. Otherwise, we do not further use your personal information. If we will sell personal information about you in the future, we will provide an option to opt out through our Services.
You may opt-out of receiving promotional communications, such as marketing push notifications from us by following the instructions in Section 5.
9.3 Right to Know
California residents have rights to request and receive a copy of your personal information we collected in the past 12-month period, including all of the following:
- The categories of personal information we have collected about you.
- The specific pieces of personal information we have collected about you.
- The categories of sources from which personal information is collected.
- The business or commercial purpose for collecting or selling personal information.
- The categories of third parties with whom we disclose or share personal information and the categories of personal information that we disclosed or shared.
You may submit a request to us but no more than twice in a 12-month period. To find out contact details please refer to Section 9(g) below.
9.4 Right to Delete
California residents also may delete your personal information that we collected. If you wish to have any of your personal information deleted, please submit a request to us pursuant to Section 9(g) below. However, we may retain your personal information even after you delete personal information from us to comply with legal obligations, regulatory requirements, to enforce legal rights or resolve disputes, to detect security incidents, or to prevent fraud or illegal activities. To find out more, please see Section 4(d) of this Privacy Policy.
9.5 Right to Correct
California residents have the right to request correction of inaccurate personal information. Please submit a verifiable request to correct inaccurate personal information in accordance with Section 9(g) below.
9.6 Right to Non-Discrimination
We will not discriminate against any California residents because you exercised any of your rights under the CCPA, such as denying goods or services, providing a different level or quality of goods or services, or suggesting that you will receive a different price or rate or different level or quality of goods or services.
9.7 Submitting Requests
If you wish to exercise any of your rights under the relevant laws, you may submit a verifiable request to cs@supervlabs.io. If verified, we will provide the information unless doing so proves impossible or would involve a disproportionate effort. You might be asked to provide additional information to verify that the person making the request is the same person about whom we collected information. This additional information will be used solely for verification purposes.
9.8 Your Rights Under California's Shine-the-Light Law
We do not share personal information with unaffiliated third parties for their own direct marketing purposes. Also, we will not do so unless you agree to such disclosure. You may still request this information to us.
10. For Nevada Residents
Nevada residents may opt out of selling your "covered information" to third parties under the Nevada law. "Covered information" means any one or more of the following items of personally identifiable information about a consumer collected by an operator through an Internet website or online service and maintained by the operator or a data broker in an accessible form. It includes a first and last name, a home or physical address, an electronic mail address, a telephone number, a social security number, and an identifier that allows a specific person to be contacted either physically or online.
11. Contact Us
If you have any questions or concerns related to your use of Our Services or this Privacy Policy, please feel free to contact us at:
E-mail : cs@supervlabs.io
Supervillain Labs Co., Ltd.
B1F Portier Office D, 304, Hyoryeong-ro, Seocho-gu, Seoul, 06720, Republic of Korea
12. Modification
This Privacy Policy may change from time to time, so please check back periodically to ensure that you are aware of any changes. If we make a material change to this Privacy Policy, we will notify you by posting the change within our Services or in this Privacy Policy, and, if necessary, give you additional choices regarding such change prior to the change becoming effective.
Your continued use of the SVL Services will signify your acceptance of these changes.
Data Protection Officer, DPO
| Location | Name | Address |
|---|---|---|
| Republic of Korea | Kyusang Lee | B1F Portier Office D, 304, Hyoryeong-ro, Seocho-gu, Seoul, 06720, Republic of Korea |
Data Provided to Third Parties
We may provide your personal information to third parties as described below:
| Name of Recipient (and contact information) | Types of Personal Information provided | Purpose of Use by Recipient | Duration of Use |
|---|---|---|---|
| Adjust GmbH | Advertising information | User acquisition and advertisement effectiveness monitoring | For the duration specified in Section 3 |
| Facebook Analytics | Contact information, event data and hashed data | User acquisition and advertisement effectiveness monitoring | For the duration specified in Section 3 |
| Google Analytics (Firebase) | Analytics data | Data analytics | For the duration specified in Section 3 |
| Hashed email address | User acquisition and advertisement effectiveness monitoring | For the duration specified in Section 3 | |
| Google reCAPTCHA | IP Address, cookie data, browser and device information, mouse and keyboard activity, and page interaction data | Bot detection, prevention, security maintenance, and suspicious activity analysis | For the duration specified in Section 3 |
| Sentry | Error logs, anonymized identifiers, user metadata (user session information, device information, browser information) | Error monitoring, debugging, and application performance improvement | For the duration specified in Section 3 |
| Datadog | IP address, browser type, operating system, pages viewed, time spent on pages, and other diagnostic data | Performance and usage monitoring and analysis of our website and services, and error information | For the duration specified in Section 3 |
You may refuse to provide your personal information to third parties by contacting our Data Protection Department. If you refuse the provision of your personal information, your personal information will not be provided. However, you may not be able to use our services for which such provision of personal information is necessary.
For the performance of the services detailed in this Privacy Policy, we delegate the processing of your personal information to the following professional service providers
| Delegatee | Description of Delegated Services |
|---|---|
| Google Cloud | Data storage and processing operations |
| Snowflake | Data warehousing and analytics |
| Amazon Web Services Inc. (USA) | Infrastructure hosting, cloud services, and monitoring and management |
Overseas Transfer of Personal Information
We may transfer personal information to third parties overseas as follows:
| Recipient (Contact Information of Information Manager) | Country to which Your Personal Information is to be Transferred | Date and Method of Transfer | Types of Your Personal Information to be Transferred | Purposes of Use by Recipients |
|---|---|---|---|---|
| Adjust GmbH | Germany unless otherwise described in the service provider's privacy policy | Transferred via information and communications network at the time of service use | Advertising information | User acquisition and advertisement effectiveness monitoring |
| Facebook (Analytics) | United States unless otherwise described in the service provider's privacy policy | Transferred via information and communications network at the time of service use | Contact information, event data and hashed data | User acquisition and advertisement effectiveness monitoring |
| Google Analytics (Firebase) | United States unless otherwise described in the service provider's privacy policy | Transferred via information and communications network at the time of service use | Error logs, anonymized identifiers, user metadata (user session information, device information, browser information) | Data analytics |
| United States unless otherwise described in the service provider's privacy policy | Transferred via information and communications network at the time of service use | Advertising information | User acquisition and advertisement effectiveness monitoring | |
| Google reCAPTCHA | United States unless otherwise described in the service provider's privacy policy | Transferred via information and communications network at the time of service use | IP Address, cookie data, browser and device information, mouse and keyboard activity, and page interaction data | Bot detection, prevention, security maintenance, and suspicious activity analysis |
| Sentry | United States unless otherwise described in the service provider's privacy policy | Transferred via information and communications network at the time of service use | Contact information, event data and hashed data | Error monitoring, debugging, and application performance improvement |
| Datadog | United States unless otherwise described in the service provider's privacy policy | Transferred via information and communications network at the time of service use | IP address, browser type, operating system, pages viewed, time spent on pages, and other diagnostic data | Performance and usage monitoring and analysis of our website and services, and error information |
| Google Cloud | United States unless otherwise described in the service provider's privacy policy | Transferred via information and communications network at the time of service use | All personal information collected | Data storage and processing operations |
| Snowflake | United States unless otherwise described in the service provider's privacy policy | Transferred via information and communications network at the time of service use | All personal information collected | Data warehousing and analytics |
| Amazon Web Services Inc. (USA) | United States unless otherwise described in the service provider's privacy policy | Transferred via information and communications network at the time of service use | All personal information collected | Infrastructure hosting, cloud services, and monitoring and management |
You may refuse the overseas transfer of your personal information by contacting our Data Protection Department. If you refuse the overseas transfer of your personal information, your personal information will not be transferred overseas. However, you may not be able to use our services for which overseas transfer of personal information is necessary
Data Destruction
With the exception of the personal information set out below, personal information, which has fulfilled the purpose for which it was collected or used, and has reached the period of time during which personal information was to be possessed, will be destroyed in an irreversible way. Personal information stored in electronic files will be deleted safely in an irreversible way by using technical methods, and printed information will be destroyed by shredding or incinerating such information
| Act on the Consumer Protection in Electronic Commerce, Etc. | Article 6 of the Act on the Consumer Protection in Electronic Commerce | In an electronic commerce or a mail-order sale:
|
| Protection of Communications Secrets Act | Article 41 of the Decree of the Act, Article 15-2 of the Protection of Communications Secrets Act |
|