Privacy Policy

This Privacy Policy explains how AppTycoon ("AppTycoon", "Company", "we", "us", or "our") collects, uses, shares, and protects personal data in connection with the AppTycoon website and white-label entertainment gaming platform (the "Service").

AppTycoon provides a business-to-business platform for branded entertainment-only gaming apps. Optional in-app purchases may be available for gameplay. AppTycoon does not operate real-money gambling and does not use personal data to provide wagering, casino banking, or payout-of-winnings services.

This Policy is designed to align with core requirements and expectations under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable Information Technology rules; the EU/EEA General Data Protection Regulation ("GDPR") and UK GDPR; and US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA ("CCPA"), where applicable. Local rights and obligations may vary.

1. Who this Policy covers

This Policy applies to:

• Website visitors who browse app-tycoon.com or contact us;
• Customers and Customer personnel (account admins, billing contacts, agency users) who use the Service; and
• Limited technical processing of end-user datainside Customer deployments that we host on a Customer's behalf.

Important role split:For personal data of players / end users inside a Customer's branded app, the Customer is generally the data controller / data fiduciary. AppTycoon generally acts as a data processor / service providerprocessing that data only to provide the platform. End users should read the Customer's privacy notice. This Policy describes AppTycoon's practices and processor role.

2. Who we are and how to contact us

Controller / Data Fiduciary for AppTycoon website and Customer-account data: AppTycoon (update this page with your registered legal entity name, registered office address, and company identification numbers before public launch).

• Privacy requests: privacy@app-tycoon.com
• Legal notices: legal@app-tycoon.com
• India grievance contact: grievance@app-tycoon.com (Grievance Officer / designated contact for India-related complaints)
• Website: https://app-tycoon.com

If we appoint a Data Protection Officer (where required), contact details will be published on this page or provided on request.

3. Personal data we collect

3.1 Data you provide

• Identity and contact data (name, business email, phone, company name, role);
• Account credentials and authentication data;
• Billing and transaction data (plan selection, invoices, partial payment details as provided by payment processors; we do not store full payment card numbers when processed by a PCI-compliant provider);
• Branding and onboarding materials (logos, colour preferences, domain information, app metadata);
• Support communications and feedback; and
• Any other information you choose to submit through forms or email.

3.2 Data collected automatically

• Device and log data (IP address, browser type, operating system, referring URLs, timestamps, diagnostic logs);
• Usage data (feature interactions, approximate location derived from IP, performance metrics); and
• Cookies and similar technologies (see Section 8).

3.3 End-user data in Customer apps (processor context)

When we host a Customer deployment, we may process end-user data on Customer instructions, which can include account identifiers, gameplay activity, device identifiers, in-app purchase status/entitlements, and support tickets. Categories are determined by the Customer's configuration and privacy notice. AppTycoon does not use end-user data to operate real-money gambling.

3.4 Data we do not intentionally seek

We do not require special-category data (such as health, biometric templates for identification, or precise religious data) to provide the core Service. Please do not submit sensitive personal data unless we expressly request it for a lawful purpose.

4. Purposes and legal bases

We process personal data to:

• provide, configure, host, secure, and support the Service (contract / legitimate use);
• create and manage Customer accounts and deployments (contract);
• process payments and prevent fraud (contract / legitimate interests / legal obligation);
• communicate service notices, onboarding, and (where permitted) product updates (contract / legitimate interests / consent where required);
• improve reliability, security, and product quality (legitimate interests);
• comply with law, respond to lawful requests, and enforce Terms (legal obligation / legitimate interests); and
• process end-user data solely on documented Customer instructions as a processor / service provider (contract with Customer).

Under the GDPR/UK GDPR, our bases are typically Article 6(1)(b) (contract), 6(1)(c) (legal obligation), 6(1)(f) (legitimate interests), and 6(1)(a) (consent) where required (for example, certain cookies or marketing). Under the DPDP Act, we rely on consent and/or other lawful grounds recognised for providing the requested service, ensuring security, meeting legal obligations, and related permitted uses. Where consent is required, you may withdraw it without affecting prior lawful processing.

5. How we share personal data

We may share personal data with:

• Infrastructure and subprocessors (cloud hosting, email delivery, analytics, error monitoring, customer support tools) under contractual confidentiality and data-protection terms;
• Payment processors to complete transactions;
• Professional advisers (legal, accounting) under confidentiality;
• Authorities when required by law or to protect rights, safety, and the Service; and
• Successor entities in connection with a merger, acquisition, or asset transfer, subject to appropriate safeguards.

We do not sellpersonal information as that term is commonly understood under the CCPA, and we do not knowingly "sell" or "share" personal information for cross-context behavioural advertising. If that practice ever changes, we will provide required notices and opt-out mechanisms.

We do not share personal data with gambling operators for wagering purposes, because AppTycoon does not provide gambling services.

6. International transfers

Personal data may be processed in India, the United States, the European Union / EEA / UK, or other countries where we or our subprocessors operate. Where we transfer personal data out of the EU/EEA/UK, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (and UK addenda where required), plus supplementary measures as needed. Where required under Indian law, we will comply with DPDP cross-border transfer rules and any applicable government notifications or blacklist restrictions.

7. Retention

We retain personal data only as long as needed for the purposes described in this Policy, including to provide the Service, maintain secure backups, resolve disputes, enforce agreements, and meet legal, tax, and accounting requirements. When Customer accounts end, we delete or anonymise Customer and hosted end-user data within a reasonable period after the retention needed for backups, legal holds, or Customer-authorised export, unless law requires longer retention.

8. Cookies and similar technologies

We use essential cookies to operate the website and Service (security, authentication, load balancing). We may use analytics cookies or similar technologies to understand aggregate traffic and improve the site. Where required by EU/UK ePrivacy rules or other laws, non-essential cookies will be used only with consent. You can control cookies through browser settings; disabling essential cookies may break the Service.

9. Security

We implement commercially reasonable administrative, technical, and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration. No method of transmission or storage is completely secure. Customer is responsible for safeguarding admin credentials and configuring Customer-side access appropriately.

If a personal-data breach occurs that requires notification under applicable law (including GDPR or DPDP), we will notify regulators and affected parties as required, and we will notify affected Customers without undue delay where they act as controller / data fiduciary.

10. Your privacy rights

10.1 General

Subject to applicable law, you may have the right to request access, correction, updating, deletion, restriction, portability, withdrawal of consent, and objection to certain processing. To exercise rights for data we control, contact privacy@app-tycoon.com. We may need to verify your identity. If you are an end user of a Customer's app, please contact that Customer first; we will support the Customer as processor where appropriate.

10.2 India (DPDP Act and related rules)

Where the DPDP Act applies, Data Principals may have rights to obtain information about processing, seek correction and erasure, withdraw consent, nominate another individual in case of death or incapacity (as implemented), and grievance redressal. You may contact our India grievance contact at grievance@app-tycoon.com. If unresolved, you may escalate to the Data Protection Board of India as provided under applicable law once operational procedures apply.

10.3 European Union / EEA / United Kingdom (GDPR / UK GDPR)

Where GDPR/UK GDPR applies, Data Subjects may request access, rectification, erasure, restriction, portability, and objection, and may withdraw consent at any time. You may lodge a complaint with your local supervisory authority. For EU/UK users, you may also contact us at privacy@app-tycoon.com. Where we act as processor for a Customer, we will redirect or support requests in line with our contract and the law.

10.4 United States (including California / CCPA-CPRA)

If you are a resident of California or another US state with a comprehensive privacy law, you may have rights to know/access, correct, delete, and obtain a portable copy of certain personal information, and to opt out of sale or sharing of personal information and certain targeted advertising. AppTycoon does not sell personal information and does not share it for cross-context behavioural advertising in the ordinary course of the Service. We will not discriminate against you for exercising privacy rights. Submit requests to privacy@app-tycoon.com. Authorised agents may submit requests where legally permitted, subject to verification.

Categories of personal information we collect (for CCPA-style disclosures) may include identifiers, commercial information, internet/electronic activity, and professional information, as described in Section 3, collected for the business purposes in Section 4.

11. Children's privacy

The AppTycoon marketing website and Customer admin Service are directed to businesses and adults, not to children. We do not knowingly collect personal data from children under 13 (or under 16 where GDPR-equivalent rules require a higher age for consent) via the AppTycoon marketing site or admin accounts.

Customers who make entertainment apps available to minors are solely responsible for age-rating, parental-consent mechanisms, store policies, and child-privacy laws (including COPPA in the United States and applicable EU/UK/India rules). If we learn we have collected personal data from a child contrary to law through our controlled properties, we will delete it.

12. In-app purchases and payment data

Optional in-app purchases in Customer apps are for entertainment gameplay and digital features only. Payment card data is typically processed by Apple, Google, or other payment providers under their privacy policies. AppTycoon may receive limited transaction metadata (such as entitlement status) needed to operate the platform. Virtual items and play balances have no real-world cash value and are not treated as bank deposits or wagering wallets.

13. Automated decision-making

We do not use personal data for automated decision-making that produces legal or similarly significant effects about individuals without human involvement, except limited fraud/security automated signals used to protect accounts and the Service.

14. Customer processor terms (summary)

When AppTycoon processes end-user personal data for a Customer, AppTycoon will: (a) process only on documented instructions; (b) require confidentiality from personnel; (c) implement appropriate security; (d) engage subprocessors under written terms and remain responsible for them toward the Customer as required by law/contract; (e) assist with data-subject requests and breach notices reasonably required; (f) delete or return personal data at the end of the engagement subject to legal retention; and (g) make available information reasonably necessary to demonstrate compliance. A separate Data Processing Addendum (DPA) may be executed on request for GDPR Article 28 / equivalent compliance.

15. Third-party links and stores

The Service may link to third-party sites or rely on app stores. Their privacy practices are outside our control. Review their policies before providing data.

16. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date and, where appropriate, by additional notice. Continued use of the Service after an update constitutes acceptance where permitted by law; where consent is required, we will request it.

17. Grievance redressal (India)

If you have a complaint about personal-data handling or content/ intermediary issues related to our Indian operations, contact:

Grievance Officer / Designated Contact
Email: grievance@app-tycoon.com
We aim to acknowledge and address grievances within timelines required under applicable Indian law and rules.

18. Contact

Privacy questions and rights requests: privacy@app-tycoon.com

General legal: legal@app-tycoon.com

This Privacy Policy is a multi-jurisdiction template for a B2B entertainment gaming platform. It is not legal advice. Have qualified privacy counsel in India, the US, and the EU review and complete entity details, addresses, subprocessors list, cookie banner implementation, and any required DPA before production use.