PrivacyPrivacy

Summary

• This website is a set of static pages. It has no accounts, forms, cookies, browser storage, audience analytics, advertising or content from other companies.
• Showing the pages requires processing your IP address; without it, the website cannot work. That and other technical details every browser sends reach our hosting provider (Firebase Hosting, by Google), and we keep these access records for 6 months, as Brazil’s Internet Civil Framework (Marco Civil da Internet) requires.
• If you write to us, we use your email address and your message to reply and to follow up on the matter.
• We do not sell personal data, build profiles or make automated decisions about you.
• You can ask for access, correction, deletion and other measures at privacy@fersaninteractive.com.

Who we are

This website, fersaninteractive.com, belongs to Fersan Interactive, an independent game studio. The controller of the personal data described here, the party that decides how it is handled, is FERSAN INTERACTIVE LTDA, CNPJ (Brazilian company registration) 66.561.110/0001-30, registered at Rua M.M.D.C., 80, Sala 1210 A2, Butantã, São Paulo/SP, CEP 05510-021, Brazil.

The channel for any matter about personal data, including for Brazil’s data protection authority (Agência Nacional de Proteção de Dados, ANPD), is privacy@fersaninteractive.com, also available as the privacy topic on the contact page.

The company is a small processing agent and, as ANPD Resolution 2/2022 allows, has not appointed a data protection officer; the channel above receives communications from data subjects and from the ANPD (ANPD Resolution 2/2022, art. 11(1)).

What this policy covers

This policy applies to the website fersaninteractive.com, in English and in Portuguese, and to messages sent to the email addresses published on it.

It does not cover the studio’s games: each game has its own privacy policy, published on its page (Rivalstride and Crane Crazy). Nor does it cover stores, platforms, social networks or other websites ours links to; each has its own policy.

We follow Brazil’s General Data Protection Law (LGPD, Law 13,709/2018) and Brazil’s Internet Civil Framework (Marco Civil da Internet, Law 12,965/2014). Because the website can be visited from other countries, this policy also gives the information that the data protection rules of the European Union and the United Kingdom (GDPR and UK GDPR) ask to be provided.

What this website does not do

• It has no accounts, registration, login, forms, comments or members’ area.
• It sets no cookies and stores nothing in your browser (such as localStorage or sessionStorage).
• It uses no audience analytics, advertising pixels, heatmaps or session recording.
• It loads nothing from other companies’ servers: fonts, images and scripts come from the website itself, and no page embeds videos, maps or social media buttons.
• It does not sell, rent or trade personal data, build profiles or make automated decisions that affect you.

Visiting the website: hosting technical data

When you open a page, your browser sends a request to the server. Firebase Hosting, the Google service that hosts the website, records the technical details of that request:

• the IP address and, derived from it, an approximate country and city;
• the date and time;
• the address of the page requested and of the referring page, when the browser sends it;
• the browser and operating system (the user agent);
• technical details of the response, such as status code, size and time.

The pages cannot be shown without this processing: the IP address is needed for the response to reach your device. The data comes from your browser, automatically.

Purposes: delivering the pages, keeping the website working and protecting it against abuse and attacks. Legal basis: legitimate interest (LGPD, art. 7, IX; for visitors in the European Union or the United Kingdom, art. 6(1)(f) of the GDPR and the UK GDPR). We have assessed that this processing is expected by anyone visiting a website, involves only technical data, is not used for other purposes and does not override your rights; this assessment is available on request at privacy@fersaninteractive.com.

As the Marco Civil da Internet requires (art. 15), the company keeps the website’s access records, that is, the data listed above, for 6 months. They are stored in a space of our own in Google Cloud Logging, in São Paulo, that only the person responsible for the company can access, and they are deleted automatically after 184 days. Legal basis: compliance with a legal obligation (LGPD, art. 7, II). We use them only for that obligation and, when needed, to investigate security incidents and abuse (legitimate interest, LGPD, art. 7, IX), and we hand them over only by court order (Marco Civil, art. 10(1) and art. 15(3)). The hosting records do not include the source port of the connection.

According to Google’s documentation, Firebase Hosting also uses the IP address to detect abuse and to provide customers with usage analysis, a feature we do not use, and keeps it for a few months; Google does not publish an exact period.

Messages you send us

The website publishes these email addresses, one per subject:

• contact@fersaninteractive.com: general questions;
• support@fersaninteractive.com: support for our games;
• business@fersaninteractive.com: business proposals and partnerships;
• press@fersaninteractive.com: press and content creators;
• privacy@fersaninteractive.com: privacy and requests about personal data;
• security@fersaninteractive.com: reports of security vulnerabilities.

When you write, we receive your email address, your name and signature if you include them, the content of the message, any attachments and the technical details of the email, such as date and time. We use this data to:

• read, answer and follow up on your matter, including later messages about it, on the basis of legitimate interest (LGPD, art. 7, IX);
• assess and handle business proposals, partnerships and press requests you bring to us, on the basis of legitimate interest (art. 7, IX) or, where you yourself would be a party to the possible contract, as steps prior to it at your request (art. 7, V);
• keep correspondence relating to the company’s activities until the rights and obligations recorded in it are time-barred (Brazilian Civil Code, art. 1,194) and handle requests about personal data (LGPD, arts. 18 and 19), to comply with legal obligations (art. 7, II);
• exercise or defend rights in judicial, administrative or arbitration proceedings, if needed (art. 7, VI).

For people in the European Union or the United Kingdom, the basis for these uses is legitimate interest (art. 6(1)(f) of the GDPR and the UK GDPR): replying to people who write to us, handling negotiations, complying with the Brazilian law we are subject to and defending rights. Where you would be a party to the possible contract, the basis is taking pre-contractual steps at your request (art. 6(1)(b)).

Send only what your matter needs. Never send passwords, tokens, payment details or identity documents, and avoid sensitive data, such as health information. If we receive something like that without asking, we reply without repeating that data and delete the message containing it as soon as the matter allows, unless the law requires us to keep it.

Our email runs on Google Workspace. Messages are read only by the people at the company responsible for each subject.

Cookies and storage on your device

This website uses no cookies, neither its own nor third-party ones, and stores no information in your browser. The language is part of the page address (/en/ or /pt-br/), so nothing needs to be remembered between visits. That is why there is no cookie notice: there is nothing to accept or refuse.

If we ever start using cookies or a similar technology, this policy will be updated first, and we will ask for your consent whenever the law requires it, with a real option to refuse.

Who we share data with

Personal data from this website reaches only:

• processors that handle data on our behalf and under our instructions, under each one’s data protection terms: Google, through Firebase Hosting (hosting), Google Cloud Logging (access records) and Google Workspace (email), and the subprocessors Google discloses, such as Fastly, which delivers the pages through Firebase Hosting’s content delivery network (CDN);
• public authorities, when the law or a court order requires it; access records are provided only by court order (Marco Civil da Internet, art. 10(1) and art. 15(3));
• lawyers and advisers, when needed to comply with legal obligations or exercise rights, under a duty of confidentiality;
• whoever succeeds the company in a corporate reorganisation, such as a merger, with the same safeguards as this policy.

Google processes this data only on our instructions and under the agreed terms (LGPD, art. 39) and is liable for damage if it breaches the law or those instructions (art. 42). We do not sell or rent personal data and do not share it for advertising.

International transfers

• Email (Google Workspace): the messages you send us are stored and processed by Google in data centres in several countries, including the United States, for the period described in “How long we keep data”, solely so that we can receive, answer and keep the correspondence. The transfer follows the standard contractual clauses approved by the ANPD (ANPD Resolution 19/2024), included in Google’s data protection agreement; Google acts as our processor, follows our instructions and maintains the security measures described in “How we protect data”. You can ask for the full text of these clauses at privacy@fersaninteractive.com; we reply within 15 days. Your rights, including petitioning the ANPD, are under “Your rights”.
• Hosting (Firebase Hosting): your browser sends the request directly to Firebase Hosting’s global network, which may serve it from servers in Brazil or abroad. The technical data of the visit may be processed in any country where Google or Fastly have facilities, including the United States, under Firebase’s data protection terms. This data is collected directly by Google. The access records we keep are stored in Brazil, in São Paulo.
• Destinations in the European Union and the European Economic Area are recognised as adequate by the ANPD (ANPD Resolution 32/2026). For visitors in the European Union, Brazil is recognised as adequate by the European Commission (Implementing Decision (EU) 2026/179).

How long we keep data

• Website access records: 6 months (184 days), then deleted automatically; longer only if an authority or a court requires them to be preserved (Marco Civil da Internet, art. 15(2)). Google keeps the IP address for a few months, as described above.
• Messages exchanged through our email addresses, including requests about personal data and security reports: 5 years after the last message received in each conversation, a period chosen on the basis of the most common limitation periods (Brazilian Consumer Protection Code, art. 27; Civil Code, art. 206). Conversations linked to contracts, disputes or legal obligations are labelled and kept for as long as the obligation or the applicable limitation period lasts (Civil Code, arts. 205 and 1,194). After that, messages are deleted automatically; complete removal from Google’s systems may take a few months.
• Records of security incidents: for at least 5 years, as the ANPD requires (ANPD Resolution 15/2024).

When the period ends, the data is deleted or anonymised, unless the law allows or requires keeping it (LGPD, art. 16).

How we protect data

• The whole website is served only over an encrypted connection (HTTPS), with HSTS so that browsers do not use insecure connections.
• A content security policy (CSP) prevents pages from loading scripts other than the website’s own, and no third-party script is used.
• The website is static: there is no database, form or server-side processing of data that could be exploited.
• We collect the minimum: the website asks for no data, and the email inboxes are accessed only by people at the company.
• The access records are kept in a Google Cloud space that only the person responsible for the company can access.
• Google states ISO 27001 and SOC 1, 2 and 3 certifications for Firebase Hosting.

No system is invulnerable. If you find a vulnerability, write to security@fersaninteractive.com; the instructions are in the terms of use and in the /.well-known/security.txt file.

Security incidents

We record every security incident involving personal data. If an incident may cause you relevant risk or harm, we will notify the ANPD and the people affected within the deadlines of the LGPD (art. 48) and ANPD Resolution 15/2024, explaining what happened, which data was affected, the risks, what we did and what you can do. If we cannot notify each person, we will publish the notice on this website for at least three months.

Your rights

Under the LGPD (arts. 18 and 20), you can ask, at any time and free of charge, for:

• confirmation that we process personal data about you;
• access to that data;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
• portability of the data to another provider, under the ANPD’s regulations;
• information about whom we share your data with;
• objection to processing that breaches the LGPD;
• review of decisions made solely by automated processing (which we do not make).

Because we do not rely on consent as a legal basis, the rights tied to it (deletion of data processed with consent and withdrawal of consent) do not apply to this website; if that changes, this policy will say so.

If you are in the European Union or the United Kingdom, you can also ask for access, rectification, erasure, restriction of processing and portability, object to processing based on legitimate interest and complain to the data protection authority of your country.

How to exercise your rights

Write to privacy@fersaninteractive.com saying what you would like. To protect your data, we may ask for a proportionate confirmation of identity; usually, replying from the same email address used in your messages is enough. If more is needed, we will say exactly what and why, and we will never ask for a copy of a document when partial information is enough. We will never ask for passwords.

• Confirmation that we process your data and access in a simplified format are sent immediately after we read the request.
• The complete statement, with the origin of the data, the criteria and the purpose of the processing, is sent within 15 days of the request (LGPD, art. 19).
• The answer is sent by email or, if you prefer, in printed form.
• If we cannot act on a request, we will tell you why: for example, if we are not the ones processing that data or if the law requires us to keep it.

If you are not satisfied, you can petition Brazil’s data protection authority, the Agência Nacional de Proteção de Dados (gov.br/anpd), and consumer protection bodies such as Procon. Visitors in the EU or UK can also complain to their local data protection authority.

Children and teenagers

The website presents the studio and its games and is not directed at children. It collects no data from anyone beyond the hosting technical records, and we do not know the age of its visitors.

If a child or teenager writes to us, we will handle the message in their best interest (LGPD, art. 14), using only what is needed to reply, and may ask a parent or guardian to take part. If a parent or guardian finds that we have received a child’s data, they can write to privacy@fersaninteractive.com and we will delete it, except what the law requires us to keep (LGPD, art. 16).

Each game’s privacy rules, including for children and teenagers, are in its own policy.

Links to other websites

The website may link to stores, platforms and social networks. When you follow one of these links, you leave our website, and your data is then handled under that service’s rules. We recommend reading each one’s privacy policy.

Changes to this policy

Each version of this policy has a number and the date it takes effect, shown at the top of the page. When the policy changes, we will publish the new version here, with the next number and a summary of what changed at the top of the page. When a change expands data processing, we will publish the new version before it starts. The history at the end of the page lists every version and the period each one was in force, and earlier versions remain available to read, unchanged.

This policy is informative: it describes how we handle data and does not depend on acceptance.

Language and contact

This policy exists in Portuguese and English, with the same content. If they differ, the Portuguese version prevails.

Questions about this policy or your data: privacy@fersaninteractive.com or FERSAN INTERACTIVE LTDA, Rua M.M.D.C., 80, Sala 1210 A2, Butantã, São Paulo/SP, CEP 05510-021, Brazil.