Relics Shinobi Hunter

1. INTRODUCTION

1.1 This Privacy Policy (“Policy”) describes how ROKSTUDIO, a developer established in the Republic of Chile (“we”, “us”, or “our”), collects, uses, discloses, and otherwise processes personal data of users in connection with our mobile game Relics Shinobi Hunter and related services (collectively, the “Services” or the “Game”). We are committed to protecting your privacy in compliance with applicable data protection laws, including:

the Chilean Law No. 19.628 on the Protection of Private Life (Ley 19.628), as amended by Law No. 21.719 (the “New Data Protection Law”), which takes effect on December 1, 2026;

the EU General Data Protection Regulation (GDPR), where applicable to users in the European Economic Area;

other applicable privacy laws (collectively, “Privacy Laws”).

1.2 “User”, “you” or “your” means an individual who registers an account or otherwise accesses or uses the Services.

1.3 This Policy explains:

What personal data we collect and when;

The purposes and legal bases for processing;

Use of cookies and third-party SDKs;

How we share, transfer, and disclose your data;

Your rights and how to exercise them;

Data retention periods;

Children’s data;

International data transfers;

Changes to this Policy, dispute resolution, and contact information.

2. WHEN WE COLLECT PERSONAL DATA

2.1 We collect personal data only when:

(a) you voluntarily provide it to us directly or through an authorized representative, after being informed of the purposes and, where required, giving consent;

(b) it is necessary for the performance of a contract with you (e.g., account registration);

(d) processing is based on our legitimate interests, provided these are not overridden by your rights and freedoms (e.g., security, analytics, marketing within permitted limits).

2.2 Specifically, we may collect personal data when:

(a) you register to use the Services (including nickname and profile data imported from social networks like Facebook or Google);

(b) you log in as a “guest” (nickname);

(d) you carry out transactions through our Services or authorized payment partners;

(e) you link your account with social media or other external accounts;

(f) you use the Services and interact with other users and/or with us (including data collected via cookies, SDKs, and similar technologies).

3. WHAT PERSONAL DATA WE COLLECT

3.1 We may collect the following categories of personal data:

(a) name;

(b) generated username and public identifier;

(d) transaction information;

(e) age, gender, date of birth;

(f) photograph;

(g) usage and transaction data;

(h) location information, including geographic location and IP address;

(i) survey content and responses;

(j) advertising identifier;

(k) customer support ticket IDs and correspondence;

(l) gameplay statistics (level, scores);

(m) device information (app version, network type, OS);

(n) marketing and communication preferences;

(o) chat data;

(p) security-related information.

3.2 Data from partners:

(a) if you link a third-party tool (e.g., Facebook, Google), we may access information you have voluntarily provided to that provider in accordance with its policies;

(b) demographic data (to determine approximate location from IP);

(d) data from platforms where the Game is distributed (e.g., payment verification);

(e) data for advertising and analytics purposes to improve our Services.

3.3 Third-Party SDKs and Similar Technologies

Our Services integrate tools provided by third parties that may collect and process certain data according to their own privacy policies. These include:

Facebook SDK – advertising, analytics, and attribution;

Firebase (Analytics & Crashlytics) – usage analytics, crash reporting;

AppsFlyer – install attribution and marketing analytics;

We encourage you to review the privacy policies of these providers.

4. LEGAL BASES FOR PROCESSING

We process your personal data on the following legal bases:

your explicit consent (Art. 6(1)(a) GDPR; Art. 12 of the New Data Protection Law);

necessity for the performance of a contract with you (Art. 6(1)(b) GDPR);

compliance with our legal obligations (Art. 6(1)(c) GDPR);

protection of your vital interests or those of another natural person (Art. 6(1)(d) GDPR);

our legitimate interests (Art. 6(1)(f) GDPR), e.g., security, analytics, service improvement, and direct marketing where permitted.

5. COOKIES

We use cookies and similar technologies to enhance your experience. You can control cookie settings through your device. Disabling cookies may affect Game functionality.

6. HOW WE USE YOUR PERSONAL DATA

6.1 We use your personal data for the following purposes:

creating and administering your account;

storing game progress and data;

communicating with you (email, SMS, etc.) regarding your account and our Services;

maintaining transaction history;

providing, operating, and improving the Services;

identification and verification;

research, analysis, and development (including surveys, usage analytics, and profiling to improve customer experience);

enabling in-game communication (audio and text chat);

security, bug fixing, compatibility optimization, and anti-fraud measures;

enabling interaction among users;

hosting, backup, and disaster recovery;

conducting due diligence and checks required by law or our risk management procedures;

complying with legal obligations, court orders, or government requests;

marketing and advertising (with your consent where required). You can opt out of marketing communications at any time using the “unsubscribe” function;

other purposes notified to you with your consent if required by law.

7. HOW WE SHARE, TRANSFER, AND DISCLOSE PERSONAL DATA

7.1 We do not sell your personal data. We may share data with third parties only:

(a) with your explicit consent;

(b) as necessary to provide the Services (e.g., payment processors, hosting providers, analytics, SDK providers);

(d) to protect the rights, property, or safety of us, our users, or the public;

(e) to our affiliates, provided they comply with this Policy;

(f) in connection with a merger, acquisition, bankruptcy, or similar corporate reorganization.

7.2 All partners processing data on our behalf must maintain confidentiality and implement security measures in accordance with our instructions and the law.

7.3 Public disclosure may only occur with your consent or as required by law.

8. INTERNATIONAL DATA TRANSFERS

8.1 Your personal data may be processed on servers located in Chile and in other jurisdictions where the Company or its service providers operate infrastructure. For users in the European Economic Area (EEA), such transfers are carried out with appropriate safeguards, such as the European Commission’s standard contractual clauses or other mechanisms under Chapter V of the GDPR. For transfers from Chile, we implement safeguards in accordance with the New Data Protection Law, including standard contractual clauses and adequacy decisions where applicable. You may request a copy of the applicable safeguards by contacting us.

9. YOUR RIGHTS

9.1 Subject to applicable law, you have the following rights regarding your personal data:

Under the Chilean Law No. 19.628 and the New Data Protection Law, you have the rights of access, rectification, cancellation (deletion), blocking, objection to processing, and data portability. You also have the right to object to automated decision-making.

Under the GDPR, where applicable, you have the rights of access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection to processing (including direct marketing), and the right not to be subject to solely automated decision-making.

You also have the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal, and the right to lodge a complaint with a supervisory authority.

9.2 To exercise your rights, please contact our Data Protection Officer at returnofkage@gmail.com. Under Chilean law, we will respond to your request within two business days as required by Article 16 of Law No. 19.628. If we cannot respond within that period, we will inform you in writing of the reasons for the delay and the expected timeframe. Under the GDPR, we will respond within one month, extendable by two further months where necessary. A reasonable fee may apply for access requests in certain cases.

10. WITHDRAWAL OF CONSENT

If processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing and does not prevent processing on other legal grounds. We may cease providing the Services if consent is necessary for their performance.

11. ACCESS AND CORRECTION

You may request access to or correction of your personal data by emailing returnofkage@gmail.com. We will respond as soon as possible within legal timeframes.

12. DATA SECURITY

We implement administrative, physical, and technical measures to protect your data from unauthorized access, destruction, alteration, disclosure, or misuse, including data minimization, access controls, encryption, anti-virus protection, regular software updates, secure data deletion, firewalls, multi-factor authentication, and periodic security audits.

13. ACCURACY OF PERSONAL DATA

We rely on the accuracy of the data you provide. Please inform us of any changes to your personal data.

14. DATA RETENTION AND RETENTION SCHEDULE

14.1 We retain your personal data only as long as necessary to fulfill the purposes for which it was collected or as required by law. Under Article 18 of Law No. 19.628, personal data may not be communicated after five years from when the respective obligation became enforceable.

14.2 Retention periods by category:

Account data: for the duration of the account’s active status; upon deletion, data is deleted or anonymized within 30 days, unless a longer period is required by law.

Support records: 3 years from case closure.

Transaction records: 5 years, or as required by tax/accounting laws.

Marketing consent logs: until consent withdrawal plus 3 years.

Technical logs and analytics data: maximum 24 months in aggregated or anonymized form.

15. CHILDREN

15.1 Our Services are not intended for individuals under the age of 14. We do not knowingly collect personal data from anyone under 14. If you are between 14 and 18 years old, you confirm that you have obtained parental or legal guardian consent to use the Services and for the processing of your data.

15.2 If you are a parent or guardian and believe your child under 14 has provided us with personal data without your consent, please contact us immediately so we can delete the data and close the account.

16. CHANGES TO THIS POLICY

We may update this Policy from time to time. Changes become effective upon posting the revised version. For material changes, we will notify you as required. Your continued use of the Services after changes constitutes acceptance of the updated Policy.

17. GOVERNING LAW AND DISPUTE RESOLUTION

17.1 This Policy shall be governed by and construed in accordance with the laws of the Republic of Chile. Any dispute, controversy, or claim arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts of Chile.

17.2 The foregoing does not deprive you of the right to bring proceedings before the competent courts of your place of residence or to lodge a complaint with a supervisory authority where provided by mandatory applicable law (e.g., users in the European Union may lodge complaints with their local data protection authority and bring claims in the courts of their member state).

18. CONTACT INFORMATION

For any questions regarding this Policy or to exercise your rights, please contact:

Data Protection Officer

ROKSTUDIO

Email: returnofkage@gmail.com

Effective Date: September 10, 2026

Last Updated: September 10, 2026