Privacy Policy

Effective: July 2026

1. Introduction & Data Controller

This Privacy Policy describes how Tyga.Cloud Ltd (company number 14643275), registered in England and Wales ("we", "us", "our"), collects, uses, and protects personal data when you play ORBSTONIA or use orbstonia.com (together, the "Service"). ORBSTONIA is a division of Tyga.Cloud Ltd. All rights reserved.

Data Controller: Tyga.Cloud Ltd, Ground Floor, Unit 2 Mallard Court, Mallard Way, Crewe Business Park, Crewe, Cheshire, CW1 6ZQ, United Kingdom.

Data Protection Officer: dpo@tyga.cloud

2. Information We Collect

Information you provide:

• Account details (email address, password, display name)
• Purchase information for in-game currency and cosmetics (processed securely via Stripe on the web, or Apple/Google on mobile — we do not receive your full card number)
• Content you submit, such as in-game chat messages
• Communications with our support team

Information collected automatically:

• IP address and approximate location
• Device type, operating system, and platform
• Gameplay data — matches played, rounds, progress, and cosmetics owned or equipped
• Usage and session data, and, on the website, cookies and similar technologies (see our Cookie Policy)

Real-time multiplayer traffic (presence, chat, and game state) is carried by our OddSockets realtime service; accounts, wallet, and cosmetics are handled by our backend at api.orbstonia.com. In-game chat is visible to other players — please do not share personal information in chat.

3. How We Use Information

We use your personal data to:

• Provide, operate, and maintain the game and its real-time multiplayer
• Create and secure your account and sync your progress and cosmetics
• Process purchases and grant in-game currency and items
• Respond to your enquiries and support requests
• Send service notices and important updates
• Analyse usage to balance and improve the game
• Detect, prevent, and address cheating, fraud, or security issues
• Comply with legal obligations

4. Legal Basis for Processing (GDPR Article 6)

Purpose	Legal Basis
Providing the game and multiplayer	Performance of a contract (Art. 6(1)(b))
Processing purchases	Performance of a contract (Art. 6(1)(b))
Service notices and anti-cheat/security	Legitimate interest (Art. 6(1)(f))
Analytics and game improvement	Legitimate interest (Art. 6(1)(f))
Marketing communications	Consent (Art. 6(1)(a))
Legal compliance	Legal obligation (Art. 6(1)(c))

5. Data Sharing & Third Parties

We share personal data only with parties necessary to deliver the Service:

Provider	Purpose	Data Shared
Stripe	Payment processing (web top-ups)	Payment and transaction data
Apple App Store / Google Play	App distribution and in-app purchases	Purchase and receipt data
OddSockets (Tyga.Cloud Ltd)	Real-time multiplayer transport	Presence, chat, and game-state data in transit
MongoDB Atlas	Database hosting	All stored account data (encrypted)
Email provider	Transactional email delivery	Email address, message content

We do not sell your personal data. We may disclose data if required by law, court order, or to protect the rights and safety of Tyga.Cloud Ltd and its users.

6. International Transfers

Some of our service providers are based outside the United Kingdom and European Economic Area (EEA). Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office.

7. Data Retention

We retain your personal data for as long as your account is active and as needed to provide the Service. When you delete your account:

• You may request a data export within 30 days of deletion
• Account data is deleted within 90 days
• Purchase and transaction records may be retained for up to 6 years to comply with tax and accounting regulations
• Anonymised and aggregated data may be retained indefinitely for analytics

8. Your Rights (GDPR)

If you are located in the UK or EEA, you have the following rights under the General Data Protection Regulation:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time where processing is based on consent

To exercise these rights, contact our Data Protection Officer at dpo@tyga.cloud. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. CCPA Rights (California)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to know — what personal information we collect, use, and share
• Right to delete — request deletion of your personal information
• Right to opt-out — opt out of the sale of personal information (we do not sell personal data)
• Right to non-discrimination — we will not discriminate against you for exercising your rights

To exercise CCPA rights, contact us at dpo@tyga.cloud.

10. Children's Privacy

ORBSTONIA can be enjoyed by players of all ages, but you must be at least 13 years old — or 16 where required by local law (including parts of the UK and EEA) — to create an account, make purchases, or use in-game chat. We do not knowingly collect personal data from children below these ages without verifiable parental consent. If we become aware that we have done so, we will delete it promptly. Parents or guardians who believe their child has provided us personal data should contact dpo@tyga.cloud.

11. Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Hashed passwords and access controls
• Regular security assessments and vulnerability scanning
• Regular backups and disaster recovery procedures

While we take reasonable precautions, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Cookies

Our website uses cookies and similar technologies to operate and improve the Service. For details and how to manage your preferences, see our Cookie Policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or in-app notification. The "Effective" date above indicates when the policy was last revised.

14. Contact & DPO

For questions about this Privacy Policy or to exercise your data rights, contact our Data Protection Officer:

Data Protection Officer
Tyga.Cloud Ltd
Ground Floor, Unit 2 Mallard Court, Mallard Way
Crewe Business Park, Crewe, Cheshire, CW1 6ZQ
Email: dpo@tyga.cloud