PRIVACY POLICY

1. INTRODUCTION

Body Broker Studios, LLC ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use The Body Broker game, website, player marketplace, and related services (collectively, the "Service").

By using the Service, you consent to the data practices described in this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. INFORMATION WE COLLECT

2.1 Information You Provide

• Account Information: Email address for account creation and authentication. We use passwordless login - no passwords are stored.
• Profile Information: Username, preferences, and optional profile details you choose to provide
• Support Communications: Information you provide when contacting customer support

2.2 Information Collected Automatically

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: Gameplay data, session duration, feature usage, interaction patterns
• Log Data: IP address, browser type, pages visited, timestamps
• Location: Approximate location based on IP address (we do not collect precise GPS location)

2.3 Payment Information

Payment processing is handled by Stripe. We DO NOT store your credit card numbers, bank account details, or other sensitive payment information. We receive only transaction confirmations and limited billing details (last 4 digits, card type, billing address) necessary for customer service and fraud prevention.

2.4 AI Personalization Data

Our AI Storyteller collects gameplay behavioral data to personalize your experience, including decision patterns, response times, and interaction preferences. This data is used solely to enhance your gaming experience and is never shared with third parties for their marketing purposes.

3. HOW WE USE YOUR INFORMATION

We use your information for the following purposes:

• Service Provision: To provide, maintain, and improve the Service
• Account Management: To create and manage your account, process authentication
• AI Personalization: To customize gameplay through our AI Storyteller
• Transactions: To process payments and marketplace transactions
• Communications: To send transactional emails (login codes, receipts, service updates)
• Security: To detect, prevent, and address fraud, cheating, and security threats
• Legal Compliance: To comply with legal obligations and enforce our Terms
• Analytics: To analyze usage patterns and improve our services (using aggregated, anonymized data)

4. INFORMATION SHARING AND DISCLOSURE

4.1 Service Providers (Data Processors)

We share limited data with service providers who perform functions on our behalf. These providers are contractually bound to:

• Process data only on our instructions
• Use data only for the services they provide to us
• Implement appropriate security measures
• Delete or return data upon termination of services

Our service providers include:

• Stripe: Payment processing
• Resend: Email delivery
• AWS: Cloud hosting and data storage
• Anti-fraud services: Transaction security

4.2 Legal Requirements

We may disclose your information when required by law, including to:

• Comply with legal process (subpoenas, court orders, government requests)
• Enforce our Terms of Service
• Protect our rights, property, or safety, or that of our users or the public
• Prevent fraud or security threats

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice and, where required by law, obtain your consent before your personal information becomes subject to a different privacy policy.

4.4 Aggregated/Anonymized Data

We may share aggregated, anonymized data that cannot reasonably be used to identify you for research, analytics, or marketing purposes.

5. YOUR RIGHTS AND CHOICES

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data (subject to legal exceptions)
• Portability: Receive your data in a portable format
• Opt-Out: Opt out of marketing communications
• AI Reset: Request a reset of your AI behavioral profile
• Withdrawal: Withdraw consent where processing is based on consent

To exercise these rights, contact us at: privacy@thebodybroker.com

6. FOR EUROPEAN UNION / EEA USERS (GDPR)

6.1 Legal Basis for Processing

We process your personal data based on:

• Contract Performance (Article 6(1)(b)): To provide the Service you requested
• Legitimate Interests (Article 6(1)(f)): For fraud prevention, security, and service improvement
• Consent (Article 6(1)(a)): For optional features like marketing communications
• Legal Obligation (Article 6(1)(c)): For tax and legal compliance

6.2 Your GDPR Rights

Under GDPR, you have the right to:

• Access your personal data (Article 15)
• Rectify inaccurate data (Article 16)
• Erasure / "Right to be forgotten" (Article 17)
• Restrict processing (Article 18)
• Data portability (Article 20)
• Object to processing (Article 21)
• Withdraw consent at any time (Article 7(3))
• Lodge a complaint with a supervisory authority (Article 77)

6.3 International Data Transfers

Your data may be transferred to countries outside the EU/EEA. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfer Impact Assessments as required by Schrems II
• EU-US Data Privacy Framework certification (where applicable)

6.4 Data Protection Officer

Contact our DPO at: dpo@thebodybroker.com

7. FOR CALIFORNIA RESIDENTS (CCPA/CPRA)

7.1 Categories of Personal Information

• Identifiers: Email, username, IP address
• Commercial Information: Purchase history, marketplace transactions
• Internet Activity: Gameplay data, interaction logs
• Geolocation: Approximate location via IP

7.2 Your CCPA Rights

• Right to Know: Request disclosure of data collected in the past 12 months
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do NOT "sell" personal information as defined by CCPA
• Right to Non-Discrimination: We will not discriminate for exercising your rights

7.3 "Do Not Sell" Confirmation

We do not sell personal information. We do not share personal information with third parties for monetary or other valuable consideration. We do not share personal information for cross-context behavioral advertising.

8. DATA RETENTION

• Account Data: Retained while your account is active, plus 90 days after deletion request
• Transaction Records: 7 years (legal/tax compliance)
• Support Communications: 3 years
• Marketing Data: Until you withdraw consent
• AI Behavioral Data: Until you request a reset or delete your account
• Anonymized Analytics: Indefinitely (cannot be linked to you)

9. DATA SECURITY

We implement industry-standard security measures including:

• Encryption in transit (TLS) and at rest
• Access controls and authentication
• Regular security audits and penetration testing
• Employee training on data protection
• Incident response procedures

While we strive to protect your information, no system is completely secure. Please protect your account credentials and contact us immediately if you suspect unauthorized access.

10. COOKIES AND TRACKING

We use the following types of cookies:

• Essential Cookies: Required for authentication and core functionality (cannot be disabled)
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Help us understand how you use the Service (optional)

We do not use third-party advertising or tracking cookies. You can manage cookie preferences through your browser settings.

11. CHILDREN'S PRIVACY

The Service is intended for users aged 18+ (or 16+ with parental consent). We do not knowingly collect personal information from children under 16 without verifiable parental consent.

If we learn we have collected data from a child without proper consent, we will delete it promptly. Parents who believe we have collected their child's information should contact us at privacy@thebodybroker.com.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy with a new "Last Updated" date and, for significant changes, by email or in-app notification. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. CONTACT US

For privacy questions, data requests, or concerns:

• Privacy Inquiries: privacy@thebodybroker.com
• Data Protection Officer: dpo@thebodybroker.com
• General Support: support@thebodybroker.com

Body Broker Studios, LLC
[Address to be added]
United States