Merge Sword - Pixel Forge
Privacy Policy

1. Purpose of Processing Personal Information

The Company processes personal information for the following purposes:

• Providing and operating game services
• User identification and verification for account linking
• Analyzing game usage statistics to improve services (e.g., bug fixing, balancing content)
• Providing customized advertising services
• Handling customer inquiries and complaints
• Fulfilling legal obligations

Legal Basis for Processing (for EU/EEA users)

For users in the EU/EEA, our legal basis for processing personal information under GDPR is as follows:

• Performance of a contract (GDPR Art. 6(1)(b)): We process personal information necessary to provide the game services you have requested, such as your Google Account Identifier, Player ID, and game progress data.
• Explicit Consent (GDPR Art. 6(1)(a)): We process certain personal information, such as your Advertising Identifier (GAID), for providing personalized advertising only after receiving your explicit consent. We obtain this consent through Google's User Messaging Platform (UMP) SDK, and you can withdraw it at any time.
• Legitimate Interests (GDPR Art. 6(1)(f)): We process data for service improvement, bug fixing, and analyzing game usage statistics based on our legitimate interests, provided these interests are not overridden by your rights and freedoms.
• Compliance with a legal obligation (GDPR Art. 6(1)(c)): We may process personal information where required to do so by law, such as in response to a court order or request from a law enforcement agency.

2. Items of Personal Information Collected

2-1. Information Collected Directly

2-2. Information Collected Automatically

3. Processing and Retention Period of Personal Information

4. Provision of Personal Information to Third Parties

In principle, the Company does not provide users' personal information to external parties. However, the following cases are exceptions:

4-1. Provision Essential for Service Delivery

4-2. Provision by Law

• When necessary for the performance of duties prescribed by law
• When required by a court order or warrant
• When requested by an investigative agency for investigation purposes in accordance with procedures prescribed by law

5. Data Processors (Entrustment of Personal Information Processing)

The Company entrusts the processing of personal information as follows to provide its services. In accordance with GDPR Art. 28, we have signed Data Processing Agreements (DPAs) with these processors to ensure they protect your data.

6. User Rights and How to Exercise Them

You have rights concerning your personal information. Users residing in the EU/EEA are guaranteed the following rights under GDPR:

• The right to access: You have the right to request copies of your personal data.
• The right to rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• The right to erasure ('right to be forgotten'): You have the right to request the erasure of your personal data under certain conditions. You can exercise this right directly through the in-game account deletion feature.
• The right to restrict processing: You have the right to request the restriction of the processing of your personal data under certain conditions. You may request this by contacting the DPO.
• The right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, in a structured, commonly used, and machine-readable format. To request your data, please contact the DPO.
• The right to object to processing: You have the right to object to our processing of your personal data, where we are relying on legitimate interests as the legal basis.
• The right to withdraw consent: You have the right to withdraw your consent at any time where we relied on your consent to process your personal information (e.g., for personalized advertising).

How to Exercise Your Rights

You can exercise these rights through the following methods:

• Account management through the in-game settings menu
• Account deletion or management through the Google Play Games service
• Managing advertising consent through the in-game consent management settings provided by Google UMP
• Contacting our Data Protection Officer at [email protected] for any requests, including data portability and restriction of processing.

7. Destruction of Personal Information

7-1. Destruction Procedure

• When the user requests account deletion or discontinues using the service
• When the personal information retention period has expired
• When the purpose of processing personal information has been achieved

7-2. Destruction Method

• Electronic files are deleted using technical methods that make recovery impossible.
• Data processed by third-party services is destroyed in accordance with the destruction policies of each service provider.

8. Measures to Ensure the Security of Personal Information

• Administrative Measures: Minimizing staff access to personal information and providing regular training.
• Technical Measures: Encrypting personal information where applicable and using access control systems.
• Third-Party Service Security: Utilizing the security systems of reliable providers such as Google and Unity.
• Privacy by Design and by Default: We strive to incorporate data protection principles into our service design and ensure that, by default, only personal data which is necessary for each specific purpose is processed.
• Consent Management: We manage and record your consent choices through Google's consent management solution to ensure we can demonstrate your consent where required.

9. Installation, Operation, and Rejection of Automatic Personal Information Collection Devices

9-1. Managing Advertising Identifiers

You can reset your advertising ID or opt-out of personalized ads through your device settings:

• Android: Settings > Google > Ads > Reset advertising ID / Opt out of Ads Personalization

9-2. Managing Consent for Personalized Ads & Analytics

• For EU/EEA users, you can manage your consent for personalized ads and analytics through the consent settings presented in the game (via Google UMP).
• You can refuse data collection in the in-game settings where available.

10. Protection of Children's Personal Information

• The Company does not knowingly collect personal information from children under the age of 13 to comply with COPPA (Children's Online Privacy Protection Act).
• For users in the EU/EEA, we do not knowingly collect personal information from children under the age of 16 (or the age of consent in your country of residence) without parental consent.
• If we learn that we have collected personal data from a child without verification of parental consent, we will take steps to delete that information.
• Advertising targeted at children is provided on a limited basis in accordance with relevant laws.

11. Data Protection Officer (DPO)

The Company has designated a Data Protection Officer to oversee all tasks related to personal information processing and to handle user complaints and remedy damages.

12. Changes to the Privacy Policy

1. This Privacy Policy will be effective from August 12, 2025.
2. If the Privacy Policy is changed, we will announce it through in-game notices.
3. In the case of significant changes, we will provide prior notice 30 days in advance.
4. The amended Privacy Policy will take effect from the date of the notice.

13. International Transfer of Personal Information

To provide our services, your personal information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

When we transfer personal information from the EU/EEA to countries outside the EU/EEA, we ensure a similar degree of protection is afforded to it by implementing appropriate safeguards:

• USA: For transfers to companies in the United States, such as Google and Unity, we rely on the European Commission's Standard Contractual Clauses (SCCs).
• Israel: For transfers to companies in Israel, such as IronSource, we rely on the European Commission's adequacy decision for Israel, which recognizes the country's data protection laws as providing an adequate level of protection.

14. Dispute Resolution

For users in Korea

You can apply for personal information infringement reports, consultations, and dispute resolution through the following Korean institutions.

For users in the EU/EEA

If you have a concern about our processing of your personal information that we are not able to resolve, you have the right to lodge a complaint with the Data Protection Authority in your country of residence.

15. Miscellaneous

• The Company values your personal information and complies with relevant data protection laws.
• Matters not specified in this policy shall be governed by relevant laws and regulations.
• If you have any opinions or complaints regarding personal information, please contact our DPO at any time.