1. Children's Privacy (COPPA & GDPR-K)
Our Services are directed to children under the age of 13. We do not require a child to disclose more information than is reasonably necessary to participate in our activities. For children under the applicable age of digital consent, personal data is processed exclusively on the basis of verifiable parental consent, collected during account creation or subscription activation.
Parental Control: Parents can review the personal information collected, ask for its deletion, and refuse further collection by contacting us at [email protected].
No Behavioral Ads: We do not display targeted advertising to children within our apps.
2. Detailed Information on the Processing of Personal Data
We use third-party services to ensure the functionality, maintenance, and improvement of our Services. Below is the technical breakdown of the data processed:
A. Analytics & Tracking
- Google Analytics 4 (GA4): Misura traffico, sessioni e pagine visitate. Attivato solo previo consenso esplicito. (Luogo: US/Irlanda)
B. Infrastruttura & Pagamenti
- Hosting sito web: Cloudflare Pages — hosting e CDN globale per marshmallow-games.com.
- Infrastruttura app mobile: Amazon Web Services (AWS) — storage e backend sicuro. (Luogo: Germania)
- Modulo di contatto: Zapier (US) — i dati inviati tramite il modulo di contatto (nome, cognome, email, messaggio) vengono trasmessi via webhook a Zapier per l'inoltro al team interno. I dati sono trattati secondo le condizioni DPA di Zapier.
- Pagamenti: RevenueCat, Adapty, Stripe e Paddle. Riceviamo notifiche di pagamento ma non conserviamo i dati della carta di credito.
- Autenticazione: Sign in with Apple, Firebase Authentication e Facebook Authentication.
D. Engagement & Testing
- Beta Testing: TestFlight (Apple) and Crashlytics (Google).
- Messaging: Firebase Cloud Messaging and CleverTap for parental notifications.
3. Cookie Policy
I nostri siti web usano cookie per distinguerti dagli altri utenti. I cookie di marketing e analitici sono attivati solo previo consenso esplicito tramite il cookie banner.
- Strettamente necessari: Indispensabili per la navigazione del sito.
- Funzionali/Analitici: Google Analytics 4 (con IP anonimizzato, attivato solo dopo consenso).
- Opt-out: Gli utenti possono gestire le preferenze tramite le impostazioni del browser o attraverso iniziative come YourOnlineChoices.
4. Specific Provisions for US Residents (CCPA/State Laws)
If you reside in the U.S. (California, Virginia, Colorado, etc.), you have specific rights:
- Right to Know & Access: You can request a list of personal information categories we collect.
- Right to Delete: You can request the deletion of your data.
- Right to Opt-Out: You can opt-out of the "sale" or "sharing" of personal information for targeted advertising.
- Sensitive Data: We only process sensitive information (like payment info) to provide the requested service.
5. Specific Provisions for Brazilian Residents (LGPD)
In compliance with the "Lei Geral de Proteção de Dados" (LGPD), Brazilian users have the right to confirmation of processing, access, rectification, and portability of their data. For requests, please contact our Data Controller.
6. International Data Transfers
Personal data processed through our Services may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, Israel, Ireland, and the Czech Republic, where some of our service providers are located. Where such transfers occur, we ensure that appropriate safeguards are in place to protect personal data, in accordance with Articles 44–49 of the GDPR. In particular, transfers are carried out on the basis of:
- Adequacy decisions adopted by the European Commission, where applicable; or
- Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented where necessary by additional technical and organizational measures.
We take all reasonable steps to ensure that personal data receives an equivalent level of protection as required under applicable data protection laws, including GDPR and GDPR-K provisions for children's data.
7. Retention and Security
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, including the provision of the Services, compliance with legal obligations, and the management of subscriptions and payments. We implement appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, alteration, or disclosure, taking into account the nature of the data processed, particularly when it concerns children's data.
8. Contact Us
For any questions regarding this policy or to exercise your rights:
Marshmallow Games SRL
Email: [email protected]
Address: Via G. Di Cagno Abbrescia, 17/B-C – 70126 Bari (Italy)