1. Scope and controller
This draft describes personal data, related information, and service records handled in FLOOR VII closed staging. The legal controller, address, representative, and contact details must be finalized before launch.
2. Data categories
The design uses the minimum data needed to provide and protect the service:
- authentication identifiers, internal and public user IDs, sessions, and account status
- 18+ confirmation, legal-document versions, and confirmation timestamps
- locale, time zone, optional country/subdivision, display name, avatar, and visibility choices
- bets, draws, stops, payouts, balances, bonuses, achievements, mastery, rankings, and missions
- request IDs, timestamps, IP/user-agent and network data, device/session risk, anti-abuse and incident logs
- support text, replies, attachments, and case history if you contact support
3. Purposes
The intended purposes are limited to:
- authentication, account creation, login, session protection, and recovery
- authoritative gameplay, balances, rankings, achievements, profiles, and settings
- preventing and investigating bots, tampering, duplicate processing, attacks, defects, and violations
- support, rights requests, incidents, audits, legal compliance, and essential notices
- aggregated product, performance, retention, and game-balance improvement without direct identity in reports
4. Service providers and disclosure
Closed staging uses Cloudflare for delivery, Access, Turnstile, and security; Google Firebase for authentication; and Supabase/AWS infrastructure for PostgreSQL and operations. Depending on the service and contract, they process data as processors or service providers.
Closed staging does not sell data or disclose it for third-party advertising or independent marketing. Disclosure may occur where legally required or necessary to protect people, rights, and service security under applicable law.
5. International processing
Cloudflare and Firebase may process data on global infrastructure. A Supabase project has a selected primary region, while operational support and subprocessors depend on the actual contract and configuration.
Before opening a country, we must inventory the project region, providers, subprocessors, destinations, and transfer safeguards, then finalize any notice, agreement, or consent requirement.
6. Retention and deletion
Data should be kept only for its purpose, security, ledger integrity, disputes, and legal obligations, then deleted or de-identified. The retention schedule remains a draft and is not presented here as an approved promise.
After account deletion, restricted ledger records may remain temporarily where needed to prevent duplicate payouts, investigate fraud, preserve audits, or comply with law. Public ranking projections should support display-name anonymization.
7. Choices and rights
Depending on applicable law, you may be entitled to information, access, correction, deletion, restriction, objection, consent withdrawal, portability, and a complaint to a data-protection authority. Region sharing can be disabled, and marketing consent is separate from entry.
A verified request channel and procedure must be finalized before launch. This draft does not claim that an unresolved staging channel can accept and complete a formal rights request.
8. Device storage, age, and security
The browser may store login state, return paths, idempotency data, display/audio/review settings, and recovery state in cookies, localStorage, sessionStorage, or IndexedDB. See the Cookie and Device Storage policy.
The service is for adults aged 18+. The MVP does not collect identity documents, GPS, addresses, or contacts. It records the age self-declaration and version.
Safeguards include encrypted transport, access control, privilege separation, secret handling, server-side validation, audit logs, backups, anti-abuse controls, and incident procedures. Details that would weaken security are not published.