Privacy policy.

1. Controller

2. Data and purposes

• Account: email address, display name, user ID and sign-in data to create and secure your account.
• Service: game progress, inventory, settings and support messages to provide the requested service.
• Orders: basket, price, payment reference, status and consent time to process and document purchases.
• Technical data: IP address, device, timestamps and logs to operate and protect the service.
• Optional wallet: public address, proof of control and transaction hash when you connect or pay with a wallet.

Processing is based on contract performance (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c)) and our legitimate interest in a secure service (Art. 6(1)(f)). Account and order data are required to provide those features.

3. Service providers

• Supabase: authentication and account data.
• Stripe: card payments and fraud prevention.
• NOWPayments: crypto invoices and payment status.
• Hosting provider: website, database and technical logs.

Providers receive only data needed for their task. Card details stay with Stripe; private keys and seed phrases are never requested.

4. Retention and transfers

We keep data only while needed for the stated purpose and afterwards only for legal retention duties, security incidents or legal claims. The controller is in the United Arab Emirates; transfers outside the EEA use an adequacy decision, Standard Contractual Clauses or another lawful safeguard where required.

5. Your rights

You may request access, correction, deletion, restriction, portability or object to processing where the legal conditions apply. You may complain to the data protection authority at your residence, workplace or the place of an alleged infringement. We do not make solely automated decisions with legal or similarly significant effects.

Contact: business@katanainu.com.