Privacy Policy

Effective Date: 15 April 2021

We, at X-FLOW LTD (“X-FLOW” “we” or “us”), are committed to respecting your privacy and the integrity and security of your personal data.

X-FLOW is data controller with registered office at Ioanni Kondylaki, 46 Q TOWER, Flat/Office 4 6042, Larnaca, Cyprus.

This Privacy Policy applies to www.x-flow.app, all other sites or online services that are owned or operated by X-FLOW, all mobile games published by X-FLOW, X-FLOW games that can be played through third party platforms (collectively “Services”). This Privacy Policy explains how we collect, store, use and share your personal data and how you can exercise your privacy rights.

We may update our Privacy Policy from time to time. When we do, we will revise the date at the top of the policy. If we make changes that are material, we will use reasonable efforts to notify you (such as by placing an in-game notice or a push-notification). We encourage you to check this Privacy Policy regularly for updates, so that you know our current practices.

By downloading, accessing and/or using our Services, you acknowledge the collection and use of your information in accordance with this Privacy Policy, including X-FLOW’s and our partners’ use of your data for the purposes as described below.

You are not obliged to actively provide any of your personal data. However, some functionalities of our Services may not be accessible if you do not provide us with the respective personal data (such as contact information for customer support).

Please, read the following carefully and make sure you fully understand this Privacy Policy. If you have any concerns about providing information to us or it being used as described in this Privacy Policy, please, discontinue and avoid using our Services.

1. What Data We Collect

The personal data we collect will depend on the circumstances and the Services you are using. We collect data in three ways: (a) data you provide to us; (b) data we collect automatically; and (c) data we collect from our partners. We do not knowingly collect (d) special categories of information.

a.     Data you provide to us

b.     Data we collect automatically

Note that we do not use such data to learn a person’s true identity or contact details, but mostly to understand how our users typically use and interact with our Services, so that we could maintain and improve them.

c.       Data we collect from our partners

d.       No special categories of information

We do not request or intend to collect any “special categories of information” such as data revealing racial or ethnic origin, political opinion, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. Please, be cautious when sharing this information about yourself (or others) in our Services.

2. Why We Collect and Use Your Data

To make our Services work

To perform the contract with you, which you enter into when you download or access our Services and accept our Terms of Use, we process data necessary to:

Our legal basis for such processing of personal data is Art. 6 para. 1 lit. b) GDPR

To make our Services more suitable for our players

To provide great Services to our players, we process personal data based on our legitimate interest to improve our Services in the following situations:

Our legal basis for such processing of personal data is Art. 6 para. 1 lit. f) GDPR

To serve you advertising

Our games may include advertising for third party products and services. Advertising includes serving you generic non-personalized advertisements and providing you with personalized advertising experience.

Non-personalized advertisements

To serve you generic non-personalized advertisements in the Services using third party advertising networks, it is generally necessary to process some data that may be considered as personal, such as your IP address or certain device identifiers. To do this, we rely on our legitimate interest in monetizing our Services.

Our legal basis for such processing of personal data is Art. 6 para. 1 lit. f) GDPR

Personalized advertisements

To serve you personalized advertisements in the Services using third-party advertising networks we will rely on your consent to process necessary data to:

You can opt out of personalized advertising by following the instructions in section 5 below.

You can withdraw your consent at any time by contacting us using the details given in section 10 below.

Our legal basis for such processing of personal data is Art. 6 para. 1 lit. a) GDPR

To keep our Services safe and fair

In order to keep the Services and its social features safe and fair, to fight fraud and ensure acceptable use otherwise, we have a legitimate interest to process necessary data to:

Our legal basis for such processing of personal data is Art. 6 para. 1 lit. f) GDPR

To analyze, profile, and segment

In all of the above cases and purposes, we may analyze, profile and segment all collected data and create aggregated statistical data, inferred non-personal data or anonymized or pseudonymized data, which we and our partners may use to provide and improve our Services. If such analyses require the processing of personal data (such as pseudonymized data), we do so based on our legitimate interest to improve our Services based on Art. 6 para. 1 lit. f) GDPR.

To comply with our legal obligations

In limited cases we pay process your data where we need to do so to comply with a legal obligation, or if we receive an order from a court or regulatory authority.

Our legal basis for such processing of personal data is Art. 6 para. 1 lit. c) GDPR

3. How We Share Your Data

Apart from X-FLOW, your data can be accessed by others in the following situations:

Other players and users

Social features are a core component of our Services. Other players and users may, for example, see your profile data, in-game activities and read the messages you have posted.

Other companies and public authorities

In order to combat fraud and illegal activity, we may exchange data with other companies and organizations and provide it to public authorities in response to lawful requests.

We may also disclose your data based on your consent, to comply with the law or to protect the rights, property or safety of ours, our players or others.

Our Service Providers and Partners

We use third parties to help us operate and improve our Services. These third parties assist us with various tasks, including hosting and maintenance, on-going development, analytics, customer care, marketing, advertising. We may also share information with advertising partners who distribute advertising in our Services.

We share your personal data with these third parties only where we have a legal basis as set out above or where such third parties process data on our behalf based on a data processing agreement.

For further information, please, see our List of Partners and their privacy policies.

4. International Data Transfers

Our Services are global by nature and your data can therefore be transferred and processed in other countries other than the country in which you are resident. Because different countries may have different data protection laws than your own country, we take steps to ensure adequate safeguards are in place to protect your data as explained in this Policy. Adequate safeguards that our partners may use include transfer of data to the jurisdictions, which are considered by the European Commission to be offering an adequate level of protection for personal data of EU residents or standard contractual clauses approved by EU Commission.

5. Your Rights and Options

Opt-out of personalized advertising

You can opt-out of personalized advertising on mobile applications by checking the privacy settings of your Android or iOS device.

Apple devices:

  1. Open Settings

  2. Select Privacy

  3. Select Advertising and enable "Limit Ad Tracking"

Android devices:

  1. Open Settings

  2. Select Google

  3. Select Ads and enable "Opt out of Ads Personalization"

If you are interested in more information about personalized advertising and your choices in this regard, you may visit the following websites:

All of the opt-out tools described in this subsection are provided by third parties, not by us. We do not control or operate these tools or the choices that advertisers and others provide through these tools.

Please note that opting out does not mean that you will stop seeing advertisements in our Services, rather third-party advertising networks will show you contextual advertisements not tailored to your interests. Please, be aware that such actions may result in decrease of advertising quality and less enjoyable user experience.

Data subject rights

In case we process personal data about you and if you are an EU resident or the resident of another jurisdiction that affords you the below rights you:

To submit a request, please, use the contact details in section 10 below.

Please, note that your request must:

We reserve the right not to respond to your request or provide you with personal data, in case we were unable to verify your identity or authority to make such a request.

6. Cookies and Similar Technologies

Like most online services, we and our partners use cookies and similar technologies to provide and personalize the Services, analyze use, target advertisements and prevent fraud. You can disable cookies in your browser settings, but some parts of the Services may then not function properly.

For further information, please, read our Cookie Policy.

7. How We Protect Your Data

Security Safeguards

In order to help ensure a secure and safe player experience, we are continuously developing and implementing administrative, technical and physical security measures to protect your data from unauthorized access or against loss, misuse or alteration. Although we use commercially reasonable efforts to assure that your data remains secure when maintained by us, please, be aware that no security measures are perfect or impenetrable.

Data retention

We keep your information only so long as we need it to provide our Services to you and fulfill the purposes described in this Privacy Policy. When we no longer need to use your information and there is no need for us to keep it to comply with our legal or regulatory obligations, we will either remove it from our systems or depersonalize it so that we cannot identify you.

8. Age Limits

We appreciate the need to provide extra privacy protections to users who are children. Our Services are intended for use only by those aged 16 and over. We do not knowingly collect personal information from children under 16 years of age. In order to request the deletion of personal data, for any reason, please use the in-app support feature in our Services or contact us at the address provided in section 10 below and we will take reasonable measures to promptly delete such personal data from our records.

9. Сalifornia Residents: Your Privacy Rights

If you are a California resident, the California Consumer Privacy Act of 2018 (“CCPA”) gives you the right to request disclosure of information that we collect about you, to delete that information, and to opt-out of the sale of your personal information (if we sell such information). This section describes how to exercise those rights and our process of handling those requests. We reserve the right to ask for reasonable information to verify your identity before we process your request.

The easiest way to submit a request is to use the in-app support feature (“Contact Us”) in our games. You may also submit your request via e-mail at privacy@x-flow.app

Please, note that your request must:

We reserve the right not to respond to your request or provide you with personal data, in case we were unable to verify your identity or authority to make such a request.

Selling of data

We do not “sell” data of our users as most people would typically understand this term. The definition of “selling” shall be interpreted in accordance with the meaning attributed to this term under CCPA. We do, however, share certain data with third-party advertising partners for the purposes of serving advertisements in our Services, fraud detection and prevention and advertising campaign management. Generally, the data collected is limited the user’s advertising ID, device identifiers and other technical information. Such data collection practices may fall under the definition of “selling” under CCPA.

Right to know

You may submit once a year, free of charge, a verifiable request to disclose what personal information we collected, used or disclosed about you in the preceding twelve (12) months.

Right to delete

You have the right to request that we delete any of your personal information we collected and retained, subject to certain exceptions. Once we receive and verify your consumer request, we will delete your personal information from our records. However, we may deny your deletion request if retaining the information is necessary for us or our service providers under certain circumstances, which will be explained to you at the time of the denial, if any.

Right to opt-out

You have the right to opt-out of “sale” of your personal information, as defined by the CCPA. In certain circumstances we may share your information with our partners, who help us deliver advertisements in our games tailored to your interests. To learn what information we collect and how we share it with third parties for advertising purposes, please, see our List of Partners.

If you would prefer that your personal information is not shared with third parties in this way, please, visit “Do Not Sell My Personal Information”.

Right to be free from discrimination

We may not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not: (i) deny your our Services; (ii) charge you different prices or rates for our Services; (iii) provide you a different level or quality of Services; (iv) suggest that you may receive a different price or rate for Services or a different level or quality of Services.

Authorized agents

You may exercise your CCPA rights by designating an authorized agent. If you would like to designate an authorized agent to make a request on your behalf, please, be sure that the agent can (i) demonstrate you have provided written permission for the agent to submit a request on your behalf and (ii) provide proof of his or her own identity. We reserve the right to require further reasonable information to verify the request. If the agent does not satisfy these requirements, we may deny the request.

Categories of personal information we collected, disclosed or sold

Personal information is information that directly or indirectly identifies a particular consumer, household or device. We have collected, disclosed or sold the following categories of personal information from California consumers within the last twelve (12) months.

Category Personal information Categories of service providers to whom personal information was disclosed or “sold” Business purpose for collection
A. Identifiers Name, username, email address, IP address, advertising ID, device identifiers and other device information
  • Advertising networks

  • Data analytics providers

  • Cloud storage providers

  • Social media services

  • Quality assurance vendors

  • App distribution platforms

  • Service providers

  • Provide services and operate business

  • Maintain, enhancing service, debugging

  • Customer support

  • Product development/improvement

  • Detection and prevention of fraud and security events

  • Analytics, research and reporting

  • Facilitate player’s social interaction

  • Serving advertisements

  • User acquisition

  • Compliance purposes and meeting legal/regulatory requirements

B. Personal Data Categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). Name
D. Commercial information Purchase history, transaction information. This does not include any payment or financial information, which is collected directly by app distribution platforms
F. Internet or other similar network activity Interaction with our web-site and applications
G. Geolocation data Country, State, City

We obtain personal information from various sources, including but not limited to:

10. Contact us

If you have questions about data protection, or if you have any requests for resolving issues with your personal data, you can contact us through the in-app support feature “Contact Us” or via e-mail at privacy@x-flow.app.
However, we may still redirect you to make the same request through the in-app support feature to verify you as our user and/or request additional information necessary for us to respond.