Privacy Policy
Last updated September 15, 2026
This privacy policy for Phantom Gamelabs Oy ("Company," "we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you download and use our mobile application (gameapp), or any other application of ours that links to this privacy notice, engage with us in other related ways, including any sales, marketing, or events.
Privacy Policy explains how Phantom Gamelabs collects, stores, uses, or otherwise processes the personal data of end users of our Services. Please make sure that you have read and understand our Terms of Service.
Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you still have any questions or concerns, please contact us. The controller responsible for the processing described in this Privacy Policy is:
Phantom Gamelabs Oy
Business ID: 3282823-2
Fredrikinkatu 60 A 22
00100 Helsinki
Finland
Email: info@phantomgamelabs.com
1. WHAT INFORMATION DO WE COLLECT?
The personal data we process depends on which Services you use and how you interact with them. We may process the following categories of personal data.
Account and Player Information
Depending on the Service, this may include:
player ID or account ID;
username, player name or tag;
account creation date and status;
linked platform or third-party account identifiers; and
other information associated with your game account.
Contact and Support Information
If you contact us, we may process:
your name, where provided;
email address;
information contained in your message;
support tickets;
attachments or screenshots you provide; and
our communications with you.
Device and Technical Information
When you use the Services, we may automatically receive technical information such as:
IP address;
device type and model;
operating system and version;
application version;
device or application identifiers;
language and regional settings;
network and mobile carrier information; and
technical logs.
Gameplay and Usage Information
We may process information concerning how you interact with our Services, such as:
game progress;
gameplay events;
session information;
game settings;
interactions with game features;
virtual items and virtual currency;
purchase and transaction events;
performance and crash information; and
other information about use of the Services.
Purchase Information
If you make purchases, we may process information relating to the transaction, such as:
product or virtual item purchased;
transaction identifier;
purchase date and time;
price and currency;
purchase status; and
platform or payment provider.
Payments may be processed by third-party platforms or payment providers, such as an application store. We generally do not receive your full payment-card details where payment is handled entirely by the relevant provider.
Advertising and Analytics Information
Where applicable and permitted by law, we may process information used for analytics, attribution or advertising, such as:
advertising identifiers;
application identifiers;
IP address;
device information; and
information concerning use of the Services.
Where consent is required by applicable law, we use advertising or similar tracking technologies requiring consent only after obtaining valid consent. You may withdraw your consent at any time through the relevant privacy or consent settings where available.
Information from Third Parties
We may receive personal data from third parties where you interact with their services in connection with our Services.
These may include:
application stores;
gaming platforms;
authentication providers;
analytics providers;
advertising and attribution providers;
social platforms, where you choose to connect an account; and
other service providers.
The information received depends on the third-party service and your settings with that provider.
2. WHY WE PROCESS PERSONAL DATA AND OUR LEGAL BASES
We process personal data only where we have an appropriate legal basis under applicable law.
Providing the Services
We process account, technical, gameplay and transaction information where necessary to:
create and maintain your account;
provide gameplay and game functionality;
save game progress;
provide purchased digital content;
authenticate users;
process game transactions; and
otherwise provide features you request.
Legal basis: performance of a contract or taking steps at your request before entering into a contract.
Operating, Maintaining and Improving the Services
We may process technical, diagnostic and usage information to:
maintain the Services;
diagnose bugs and crashes;
measure performance;
understand how features are used;
improve game functionality and user experience; and
develop our Services.
Legal basis: our legitimate interests in operating, maintaining and improving our Services, where those interests are not overridden by your interests, rights or freedoms. Where required, we carry out an assessment before relying on legitimate interests.
Security, Fraud Prevention and Enforcement
We may process account, device, technical and gameplay information to:
detect cheating and abuse;
prevent fraud;
protect accounts;
detect security incidents;
investigate violations of our Terms of Service;
enforce our rules; and
protect Phantom Gamelabs, our users and third parties.
Legal basis: our legitimate interests in maintaining the security and integrity of our Services and protecting users and our business, and, where applicable, compliance with legal obligations.
Customer Support
We process contact, account and technical information to respond to questions, investigate problems and provide support.
Legal basis: performance of our contract with you, taking steps at your request, and/or our legitimate interest in providing customer support, depending on the circumstances.
Legal and Regulatory Obligations
We may process personal data where necessary to:
comply with applicable laws;
comply with accounting and tax obligations;
respond to legally valid requests from public authorities;
establish, exercise or defend legal claims; or
comply with regulatory requirements.
Legal basis: compliance with a legal obligation and, where applicable, our legitimate interests in establishing, exercising or defending legal claims.
Analytics
We may use analytics to understand how our Services perform and how they are used. Depending on the technology and data involved, the legal basis may be:
our legitimate interests in measuring and improving the Services; or
your consent where consent is required by law
3. CHILDREN AND MINORS
Our Services are not targeted but may be accessible to younger users. Under Finnish law, where consent under Article 6(1)(a) GDPR is relied upon for an information-society service offered directly to a child, a child who is at least 13 years old may provide the relevant consent in accordance with applicable law. We recognise that children's personal data requires particular protection. Where we know or can reasonably determine that a user is a minor, we apply appropriate protections taking into account the nature of the Service, the processing involved and applicable law.
If you believe that we have processed a child's personal data contrary to applicable law, please contact us at info@phantomgamelabs.com.
4. COOKIES AND SIMILAR TECHNOLOGIES
Our websites and Services may use cookies, software development kits (“SDKs”), pixels, local storage and similar technologies. Some technologies are necessary for the operation, security or functionality of the Services. Others may be used for analytics or advertising. Where required by applicable law, non-essential technologies are used only after you have provided consent.
You can withdraw or change your consent through the relevant consent-management mechanism where available. More information about technologies used on our website is available in our Cookie Policy.
5. INTERNATIONAL DATA TRANSFERS
Some of our service providers may process personal data outside Finland or elsewhere outside the European Economic Area. Where personal data is transferred outside the EEA, we ensure that the transfer complies with applicable data-protection law.
Depending on the destination and recipient, we may rely on:
an adequacy decision adopted by the European Commission;
the European Commission's Standard Contractual Clauses;
another transfer mechanism recognised under the GDPR; and
supplementary technical, contractual or organisational safeguards where appropriate.
You may contact us for further information about safeguards applicable to international transfers of your personal data.
6. HOW LONG WE RETAIN PERSONAL DATA
We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy applicable legal, accounting, security and dispute-resolution requirements. Retention periods vary according to the type of data and purpose of processing.
For example:
Account and gameplay information may generally be retained while your account remains active;
Customer-support communications are retained for the period reasonably necessary to resolve the request and manage related claims;
Transaction and accounting records may be retained for the period required under applicable accounting and tax legislation;
Security and anti-fraud information may be retained for an appropriate period necessary to detect, investigate and prevent abuse;
Analytics data is retained according to the applicable analytics configuration and business need; and
Consent records may be retained as necessary to demonstrate compliance with legal requirements.
When personal data is no longer required, we delete or anonymise it unless continued retention is required or permitted by law.
Data contained in backups may remain for a limited period until backups are overwritten or deleted according to our normal backup cycle.
7. DATA SECURITY
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are selected taking into account factors such as the nature of the processing, available technology, implementation costs and the risks to individuals. However, no online service or information system can guarantee absolute security.
If a personal-data breach occurs, we will assess and handle it in accordance with applicable data-protection law, including notification to the competent supervisory authority and affected individuals where legally required.
8. AUTOMATED DECISION MAKING AND PROFILING
We may use automated systems for purposes such as fraud detection, security, game integrity, analytics or advertising. We do not use automated anti-cheat or moderation systems to suspend or ban accounts. Where we carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR, we will provide the information and safeguards required by applicable law.
These may include, where applicable, information about the logic involved and the significance and envisaged consequences of the processing, as well as applicable rights to obtain human intervention, express your point of view and contest the decision.
9. YOUR DATA-PROTECTION RIGHTS
Subject to the conditions and limitations provided by applicable law, you may have the following rights.
Right of Access: You may request confirmation of whether we process your personal data and request access to that data and related information.
Right to Rectification: You may request correction of inaccurate personal data and completion of incomplete personal data.
Right to Erasure: You may request deletion of your personal data in circumstances provided by law. The right to erasure is not absolute. We may retain information where processing remains necessary, for example, to comply with a legal obligation or establish, exercise or defend legal claims.
Right to Restriction of Processing: You may request that processing of your personal data be restricted in circumstances provided by the GDPR.
Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller.
Right to Object: Where we process your personal data based on legitimate interests, you have the right to object to that processing on grounds relating to your particular situation. We will then cease the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims. You have the right to object at any time to processing of your personal data for direct-marketing purposes.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Rights Relating to Automated Decision-Making: Where Article 22 GDPR applies, you have rights concerning decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
10. HOW TO EXERCISE YOUR RIGHTS
You can submit a data-protection request by contacting:
Where available, you may also be able to submit certain requests directly through the settings within the relevant game.
We may need to verify your identity before fulfilling a request. We will request only information reasonably necessary for verification.
We generally respond to requests within one month as required by the GDPR. In cases involving complex or numerous requests, this period may be extended by up to two additional months where permitted by law. If an extension is necessary, we will inform you.
Exercising your data-protection rights is generally free of charge. However, where a request is manifestly unfounded or excessive, particularly because of its repetitive character, the GDPR permits us in certain circumstances to charge a reasonable fee or refuse to act on the request.
11. RIGHT TO LODGE A COMPLAINT
If you believe that our processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with a supervisory authority.
Our lead supervisory authority in Finland is:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Finland. Website: https://tietosuoja.fi/en/home
You may also have the right to lodge a complaint with another competent supervisory authority, particularly in the EU or EEA country where you live, work or where the alleged infringement occurred.
We encourage you to contact us first if you have concerns so that we can try to resolve them.
12. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time, for example because our Services, processing practices or applicable legal requirements change. When we update the Privacy Policy, we will update the “Last updated” date above. Where changes materially affect how we process your personal data, we will provide additional notice where required by applicable law.
Where processing requires consent, a change to this Privacy Policy does not itself constitute consent to a new processing purpose.
13. CONTACT US
If you have questions, concerns or requests concerning this Privacy Policy or our processing of personal data, please contact:
Phantom Gamelabs Oy
Business ID: 3282823-2
Fredrikinkatu 60 A 22
00100 Helsinki
Finland
Email: info@phantomgamelabs.com