Privacy Policy

1. Information We Collect

InvestGame provides a virtual stock, cryptocurrency, and foreign exchange trading simulation platform for educational and entertainment purposes. We adhere to the principle of data minimization and collect only the information necessary to provide, secure, and manage our services.

1.1 Information You Provide Directly

When you register an account, participate in games, or contact us, we collect:

• Account Identifiers: Your email address (used for account verification, password recovery, transactional receipts, and essential platform notices) and your chosen username (displayed on leaderboards and multiplayer lobbies).
• Authentication Credentials: Passwords are cryptographically salted and hashed using industry-standard bcrypt algorithms; if you authenticate via third-party OAuth (such as Google or Microsoft), we receive basic profile identifiers permitted by that provider.
• Simulation Gameplay Data: Virtual cash balances, simulated trade histories, portfolio holdings, room configurations, and leaderboard statistics.
• Support Communications: Inquiries, billing tickets, or feedback submitted through our contact forms or email channels.

1.2 Subscription and Billing Information (Handled by Creem.io)

If you purchase a paid subscription (InvestGame Premium or InvestGame Education), your checkout, payment processing, tax calculation, and invoicing are handled directly by our Merchant of Record provider, Creem.io ("Creem").

• Payment Instrument Data (Processed by Creem.io): Sensitive payment details—such as your credit or debit card number, CVV, bank account details, billing street address, and tax/VAT identification numbers—are collected and processed directly by Creem.io in accordance with PCI-DSS security standards. InvestGame does not collect, process, or store your full credit card numbers or raw payment credentials on our servers.
• Subscription Metadata (Stored by InvestGame): To provision your account entitlements and manage your plan status, InvestGame receives and stores limited subscription records from Creem.io via secure API calls and cryptographically signed webhooks. This metadata includes your Creem Customer ID, Subscription ID, Checkout ID, Order ID, Product ID, active plan tier (Free, Premium, or Education), subscription status (e.g., active, trialing, scheduled cancellation, canceled, expired, or past due), billing currency, and current billing period end date.

1.3 Automatically Collected Technical Data

When you access InvestGame, our servers automatically record standard technical and diagnostic data, including:

• Log and Network Data: IP address, request timestamps, requested URLs, HTTP status codes, and rate-limiting metrics to defend against automated abuse, credential stuffing, and DDoS attacks.
• Device and Browser Metadata: Browser type, operating system, device category, and viewport dimensions to ensure responsive rendering and platform compatibility.
• Usage Analytics: Aggregated interaction patterns and session metrics used to diagnose errors and improve platform performance.

2. How We Use Your Information and Legal Bases

Under the European Union General Data Protection Regulation (GDPR) and applicable data protection laws, we process your personal data on the following legal bases and for the following purposes:

• Performance of a Contract (GDPR Art. 6(1)(b)): Creating and authenticating your account, executing simulated trades, computing multiplayer leaderboards, provisioning InvestGame Premium and InvestGame Education entitlements, and facilitating checkout and self-service billing portal sessions with Creem.io.
• Compliance with Legal Obligations (GDPR Art. 6(1)(c)): Maintaining required transactional, accounting, and tax compliance records in coordination with our Merchant of Record, and responding to lawful requests from public authorities.
• Legitimate Interests (GDPR Art. 6(1)(f)): Securing our infrastructure, enforcing our Terms of Service, preventing fraud and API abuse, and improving platform stability.
• Consent (GDPR Art. 6(1)(a)): Sending optional product updates or weekly performance digests, from which you may unsubscribe at any time, and placing non-essential analytics or advertising cookies where applicable.

No Commercial Sale of Personal Data: InvestGame does not sell, rent, or trade your personal data to data brokers or third-party marketers under any circumstances.

3. Data Sharing, Processors, and Merchant of Record

We share personal data only with trusted third-party service providers and partners to the extent necessary to operate the Service:

• Merchant of Record (Creem.io): When you initiate a subscription checkout or open the customer billing portal, we transmit your InvestGame User ID, username, registered email address, and selected plan metadata to Creem.io. As Merchant of Record, Creem acts as an independent controller and/or processor for payment processing, fraud prevention, tax calculation and remittance, invoicing, and subscription lifecycle management. We encourage you to review Creem.io's Privacy Policy when completing a purchase.
• Infrastructure and Transactional Providers: Cloud hosting providers, managed database clusters, and transactional SMTP email providers bound by strict data processing and confidentiality obligations.
• Analytics and Advertising Partners: We use Google Analytics (configured with privacy safeguards) to understand aggregate site traffic, and Google AdSense may serve contextual or personalized advertisements on certain public pages subject to your browser and cookie preferences.
• Legal and Safety Disclosures: We may disclose information if required to do so by law, court order, or governmental regulation, or if necessary to investigate fraud, security breaches, or violations of our Terms of Service.

4. Data Storage and Security

We implement technical and organizational security measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction. All communication between your browser, InvestGame, and Creem.io's APIs is encrypted in transit using HTTPS/TLS cryptographic protocols. Passwords are stored exclusively as irreversible cryptographic hashes, webhook payloads from Creem.io are verified using HMAC-SHA256 signatures, and production databases are protected by strict access controls. While we follow industry best practices, no method of transmission over the Internet or electronic storage is 100% secure.

5. Cookies and Local Storage

InvestGame uses essential first-party cookies and browser local storage to maintain your authenticated login session (such as access and refresh tokens), remember interface preferences, and protect against cross-site request forgery (CSRF). We also utilize analytics and advertising scripts (such as Google Analytics and Google AdSense) that may set cookies to measure site engagement and deliver relevant advertisements. You may control or disable cookies through your browser settings, though disabling essential cookies may prevent you from logging in or executing simulated trades.

6. Data Retention

We retain your account profile and simulation gameplay data for as long as your account remains active. If you delete your account or submit a verified erasure request, we will delete or anonymize your personal account identifiers and solo gameplay data within thirty (30) days.

Retention of Billing and Tax Records: Notwithstanding account deletion, limited subscription and transaction records (including records maintained by Creem.io as Merchant of Record) may be retained for the mandatory retention periods required by applicable tax, accounting, anti-fraud, and financial reporting laws.

7. Your Privacy Rights (GDPR and Global Protections)

Depending on your jurisdiction (including residents of the European Economic Area, the United Kingdom, and applicable US states), you have the following rights regarding your personal data:

• Right of Access: The right to request confirmation of whether we process your personal data and to receive a copy of that data.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data (you may also update your username directly in your account settings).
• Right to Erasure ("Right to Be Forgotten"): The right to request the deletion of your personal data, subject to statutory retention obligations for financial and security records.
• Right to Restriction and Objection: The right to restrict or object to processing based on legitimate interests or direct marketing.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Lodge a Complaint: If you are located in the EU/EEA, you have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or your local supervisory authority.

To exercise any of these rights, please contact us via our Online Contact Form or email us at [email protected]. We respond to all verified requests within thirty (30) days and do not charge a fee for standard requests.

8. Account Deletion and Multiplayer Anonymization

When you request complete deletion of your account, we permanently remove your email address, username, password hashes, authentication tokens, and solo simulation games. In shared multiplayer game rooms where other players are present, your historical virtual trade entries may be anonymized so that leaderboard calculations for remaining participants remain intact without retaining your personal identifiers. If you hold an active paid subscription, please ensure your subscription is canceled prior to or in conjunction with your deletion request.

9. Children's Privacy

InvestGame is not directed to children under the age of 13 (or the higher minimum age of digital consent applicable in your jurisdiction), and we do not knowingly collect personal data from children under 13. Paid subscriptions may only be purchased by adults or with verifiable parental or institutional authorization. If we become aware that we have inadvertently collected personal data from a child under the applicable minimum age without required consent, we will promptly delete the account and associated data. Where InvestGame Education is used by a school or instructor, the subscribing institution or educator is responsible for ensuring appropriate student disclosures and consents are obtained in compliance with applicable educational privacy laws.

10. International Data Transfers

InvestGame is operated from Hungary (European Union), and our infrastructure providers as well as our Merchant of Record (Creem.io) may process data in the European Economic Area, the United States, and other jurisdictions. Where personal data is transferred outside the European Economic Area, we rely on recognized legal safeguards, such as European Commission adequacy decisions or Standard Contractual Clauses (SCCs), to ensure your data remains protected.

11. Third-Party Websites and Services

The Service may contain links to external websites or redirect you to third-party services, including the hosted checkout and customer billing portal operated by Creem.io. This Privacy Policy applies solely to InvestGame. We are not responsible for the privacy practices or content of external websites, and we encourage you to read the privacy policies of any third-party services you interact with.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our platform features, subscription architecture, third-party processors, or legal requirements. Any updates will be posted on this page with an updated "Effective Date." Your continued use of the Service after the Effective Date constitutes your acknowledgment of the updated Privacy Policy.

13. Data Controller and Contact Information

The data controller responsible for your personal data on InvestGame is Barnabás Richter (Sole Proprietor, Hungary). For any questions, privacy inquiries, or data subject requests, please reach out to us via our Online Contact Form or by email at [email protected].