Privacy Policy

1. What we collect

Account data

Email address, display name, password hash, locale and country, and your communication preferences.

Transaction data

What you bought, when, the amount and currency, tax country, the last four digits and brand of the card, and the payment processor’s transaction reference. We never receive or store your full card number or CVC.

Product and usage data

For games: entitlements in your library, launches, playtime, crash reports, in-game settings and, where a title has them, save files synced at your request. For our applications: the content you put into them, your configuration, and access logs recording who did what and when.

Support data

The content of your emails to us and our replies.

Technical data

IP address, approximate location derived from it, device and browser type, operating system, referring page and pages viewed. Collected as server logs and by our own analytics.

We do not knowingly collect personal data from children under 13. If you believe a child has given us data, write to support@haku-core.com and we will delete it.

2. Why we use it, and our legal basis

To provide the services

Creating your account, delivering what you bought, syncing saves, and running the applications you use. Legal basis: performance of a contract.

To take payment and prevent fraud

Processing charges and refunds, screening for stolen cards and chargeback abuse, meeting tax and accounting obligations. Legal basis: contract, legal obligation, and our legitimate interest in preventing fraud.

To support you

Answering your questions and fixing your problems. Legal basis: contract and legitimate interest.

To improve our games

Diagnosing crashes and understanding which features are used. Legal basis: legitimate interest, and consent where local law requires it for analytics.

To send you messages

Service emails such as receipts and security notices, which you cannot opt out of while you hold an account; and marketing emails, which are opt-in and unsubscribable at any time. Legal basis: contract, and consent for marketing.

To comply with the law

Tax records, sanctions screening, and responding to lawful requests. Legal basis: legal obligation.

3. Generative AI and your data

• We do not use your personal data, gameplay data, chat logs, save files or support emails as training data for any model, ours or a third party’s.
• Where a product feature sends text to a language model at run time, we send only the state that feature needs for that step. We instruct our providers not to retain it for training and we do not include your account identity in the prompt.
• Generated output is not a decision about you. We do not use automated processing to make decisions with legal or similarly significant effects, and we do not use it to set your price.

4. Who we share data with

We use service providers who process data on our instructions under a written contract. The categories are:

• Payment processing and fraud screening.
• Hosting, content delivery and edge compute.
• Email delivery for receipts and notifications.
• Error monitoring and product analytics.
• Customer support tooling.
• Accounting, tax and audit.
• Language model providers, for the limited run-time purpose described above.

We also disclose data where the law requires it, to protect our rights or someone’s safety, and to a buyer or successor in a merger or acquisition, on notice to you. We do not sell personal data and we do not disclose it for money or for cross-context behavioural advertising.

5. International transfers

We operate from the United States and our providers may process data in the United States and elsewhere. Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, together with additional safeguards where needed. You can ask us for a copy of the mechanism we rely on.

6. How long we keep it

• Account data: while your account exists, then up to 90 days after closure so you can change your mind.
• Transaction records: seven years, because tax and accounting law requires it.
• Support correspondence: three years.
• Server and security logs: up to 12 months.
• Crash and analytics data: up to 24 months, in aggregated or pseudonymised form thereafter.

7. Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, take a portable copy, object to or restrict processing, withdraw consent, and not be discriminated against for exercising a right. Residents of California, Colorado, Connecticut, Virginia and other US states with privacy statutes have equivalent rights, including the right to opt out of sale or targeted advertising — which for us is already the default, because we do neither.

To exercise a right, email support@haku-core.com. We verify that you control the account, then respond within 30 days, or 45 days where the law allows an extension and we tell you why. Using an authorised agent is fine; we will ask for proof of authority.

If you are in the EEA or the UK you may complain to your supervisory authority. If you are in Taiwan, the Personal Data Protection Act gives you rights of enquiry, review, copy, correction, deletion and cessation of processing, which you can exercise at the same address.

8. Security

• Data in transit is encrypted with TLS. Data at rest is encrypted by our hosting providers.
• Passwords are stored only as salted hashes; we cannot read them.
• Access to production data is limited to the people who need it and is logged.
• We will notify you and the relevant regulator without undue delay if a breach affects your personal data and the law requires it.

9. Cookies

Our Cookie Policy lists every cookie and similar technology we use, what it does and how long it lasts, and explains how to change your choices.

10. Changes to this policy

We update this policy when our practices change. If a change is material we notify account holders by email at least 30 days in advance. The effective date at the top always reflects the current version.