Privacy Policy
What we collect, why, and for how long. This site sets no cookies and runs no analytics, so this is a shorter document than most.
Plain-language summary, which is not a substitute for the policy below: this website sets no cookies, runs no analytics and has no sign-up. If you email us, we keep the email. If you apply for a role, we keep your application for twelve months. When the game ships, the store you buy it from handles your account and payment, not us.
1. Who is responsible for your data
VoxelWave Studio OÜ — a private limited company registered in Estonia under registry code 17417678 — is the data controller for the personal data described in this policy.
We are not required to appoint a Data Protection Officer, and we have not appointed one. Privacy questions go directly to the founder at privacy@voxelwavestudio.com.
Because we are established in Estonia, our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
2. What this policy covers
This policy explains how we handle personal data when you visit voxelwavestudio.com, when you email us, when you apply for a role or contact us about investment, and — once it is released — when you play our game.
It is written against the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
3. What we collect, why, and for how long
We collect as little as we can get away with. Here is the whole of it:
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Website request logs — IP address, approximate location, browser and device type, pages requested, time of request | Serving the site, security, blocking abuse, and counting visits in aggregate | Legitimate interests — running and protecting the site | Generated and retained by our hosting provider; typically days to weeks. We do not build profiles from it. |
| Emails you send us — your address, your name if you give it, and anything in the message | Answering you and keeping a record of what was agreed | Legitimate interests, or steps taken at your request before entering a contract | Up to 3 years from the last message, unless it relates to a contract we need to keep longer for accounting or legal reasons |
| Job applications — CV, portfolio, contact details, and anything else you choose to send | Assessing your application and, if we take it forward, arranging a call and a paid trial | Steps taken at your request before entering a contract; legitimate interests in filling the role | 12 months from the decision, so we can contact you when a similar role opens. Ask us and we will delete it sooner. |
| Investor and partnership enquiries — name, contact details, company, correspondence | Responding to your enquiry and managing the relationship | Legitimate interests, or steps taken at your request before entering a contract | Up to 6 years, reflecting statutory record-keeping periods |
| Game data — once the game is released | Running the game and fixing what breaks | Performance of a contract, and legitimate interests in fixing defects | See below |
About game data
The game is not released yet, so we hold no player data today. When it is released, it will be sold through stores such as Steam. Those stores hold your account, your payment details and your purchase history — we do not receive or store your payment information at any point.
We expect to receive aggregated, non-identifying sales and wishlist statistics from the store, and we may offer an optional, off-by-default crash report you can choose to send when something breaks. If we ever collect more than that, we will update this policy and say so plainly before we start.
4. Cookies and tracking
This website sets no cookies. There is no analytics, no advertising pixel, no tracking script, no fingerprinting, and nothing stored in your browser. There is no cookie banner because there is nothing to consent to.
We do not know who you are when you read this page, and we would have to change the site to find out.
5. Third parties that may see your data
We do not sell personal data, and we do not share it for anyone else’s marketing. A small number of service providers necessarily process data on our behalf:
| Who | What they handle | Where |
|---|---|---|
| Cloudflare | Hosting, content delivery and protection for this website. Sees the request data in the table above. | Global network, EU-headquartered subsidiary |
| Google Fonts | Serves the typefaces this site uses. Loading a page contacts Google’s servers, which discloses your IP address to Google. | Global |
| Tailwind CDN | Serves a stylesheet library this site loads. Contacting it discloses your IP address to that provider. | Global |
| Our email provider | Delivers and stores email you send us. | EU / US |
| Storefronts such as Steam (once released) | Your account, purchase and payment. Governed by their own privacy policy, not ours. | Global |
We are working towards serving fonts and stylesheets from our own servers, which would remove the third and fourth-party contact described above. Until then, we would rather tell you it happens than not.
We may also disclose data where the law requires it, or to establish or defend a legal claim.
6. Transfers outside the EEA
Some of the providers above operate globally, which means data may be processed outside the European Economic Area. Where that happens we rely on an adequacy decision by the European Commission, or on Standard Contractual Clauses together with additional safeguards where they are needed.
Ask us and we will tell you which mechanism applies to a given provider.
7. How we protect your data
The site is served over HTTPS with HSTS, a strict content security policy, and standard protective headers. Our accounts use strong unique credentials and multi-factor authentication. Access to email and applicant material is limited to the founder and, where a role requires it, a named contractor under a written confidentiality obligation.
No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the Estonian Data Protection Inspectorate within 72 hours and tell you directly where the law requires it.
8. Your rights
Under the GDPR you have the right to:
- Access — get a copy of the personal data we hold about you;
- Rectification — have inaccurate data corrected, or incomplete data completed;
- Erasure — have your data deleted where we no longer have grounds to keep it;
- Restriction — have us pause processing while a dispute is resolved;
- Portability — receive data you gave us in a machine-readable format;
- Object — object to processing we base on legitimate interests, including profiling;
- Withdraw consent — where we rely on consent, withdraw it at any time, without affecting processing already carried out.
Exercising these rights is free, and doing so will never count against you.
9. How to exercise your rights
Email privacy@voxelwavestudio.com and tell us what you want. You do not need a particular form of words — "please delete my application" is enough. That address reaches a person, not a ticket queue.
We will respond within one month. If a request is complex we may extend that by up to two further months, and we will tell you within the first month if we need to. We may ask you to confirm your identity where we cannot otherwise be confident the request is yours.
10. Complaints
If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to a supervisory authority at any time.
Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tätari 39, 10134 Tallinn, Estonia — aki.ee/en.
If you live elsewhere in the EU or EEA, you may complain to the supervisory authority in your own country instead.
11. Children
This website is not directed at children and we do not knowingly collect personal data from them. Where we would rely on consent and the person is below the age set for that by the law of their country, a parent or guardian has to give it.
For the game, age ratings and age requirements are applied by the storefront you buy it from.
If you believe a child has given us personal data, write to us and we will delete it.
12. Automated decisions
We do not carry out automated decision-making or profiling that produces legal effects for you or similarly significantly affects you. Applications are read by a person.
13. Changes to this policy
We will update this policy when what we do changes — most obviously when the game is released. The version in force is the one on this page, with its effective date at the top.
If a change materially affects you, we will say so on this website rather than quietly revising the page.
14. How to contact us
VoxelWave Studio OÜ — registry code 17417678, Estonia.
- Privacy and data requests: privacy@voxelwavestudio.com
- Everything else: contact@voxelwavestudio.com