Privacy Policy

This Privacy Policy explains how Zaos Entertainment S.A ("Zaos Entertainment", "we", "us" or "our") collects, uses, shares and protects personal data when you visit https://zaos.global, create a Zaos account, download and play the game Zaos, use the launcher, contact support or take part in any of the social features we offer (together, the "Service"). It also explains the rights you have and how to exercise them. It is written to meet the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, and the ePrivacy rules on cookies. Please read it together with our Terms of Service, our Cookie Policy and our Code of Conduct.

At a glance (a plain-language summary; it is not a substitute for the full text below)

• We collect what we need to run your account and the game, keep it fair and safe, process purchases and help you when you contact us. We do not sell your personal data.
• To fight cheating we use a hardware identifier from your device and automated risk scoring. A permanent ban is always reviewed by a member of staff, and you can appeal through support.
• Players under 13 cannot register. Players aged 13 to 15 need a parent's or legal guardian's confirmation before their account is activated.
• Analytics cookies are only used if you accept them, and you can change your choice at any time through "Cookie settings" in the website footer.
• You can ask to access, correct or delete your data, or to close your account, by writing to privacy@zaos.global or through support. We reply within one month.

1. Who we are and how to contact us

1.1 The controller

The controller responsible for your personal data is:

Zaos Entertainment S.A, 50th Street and Corner of Elvira, Tower Financial Center, 35th Floor, Suite L, Panama City, Panama.

Website: https://zaos.global

1.2 Contact for privacy matters

For any question about this Privacy Policy or about your personal data, and to exercise any of your rights, you can contact us:

• by email at privacy@zaos.global;
• through the support system in the game or on the website at https://zaos.global/account/support; or
• by post at the address in section 1.1.

Legal notices that are not about privacy can be sent to legal@zaos.global.

1.3 Representative in the European Union and the United Kingdom

Our representative in the European Union and our representative in the United Kingdom under Article 27 GDPR / UK GDPR will be listed here once appointed. Until then, contact us at privacy@zaos.global.

2. Scope of this policy

2.1 What this policy covers

This policy applies to all personal data we process in connection with the Service, in particular:

• the website at https://zaos.global, including the early-access page, the account area, the item shop and checkout, and vote pages;
• the Zaos game client on any supported platform, and the game servers it connects to;
• the Zaos launcher, which installs, updates and checks the game;
• our support system, whether used from the website or from inside the game;
• the social features of the Service, including chat, friends, guilds, parties, player reports and the Discord integration; and
• emails we send to you about the Service.

2.2 What this policy does not cover

Third-party services that you use alongside Zaos, such as Discord, Facebook, PayPal, your bank, or vote and community sites, have their own privacy policies. When you use them, they act as independent controllers for their own processing. This policy only covers what we do with the data we receive from them or share with them.

2.3 Definitions

In this policy, "personal data" means any information relating to an identified or identifiable natural person. "Processing" means anything done with personal data, such as collecting, storing, using, sharing or deleting it. "Processor" means a company that processes personal data on our behalf and under our instructions. Other terms have the meaning given to them in the GDPR or in our Terms of Service.

3. The personal data we collect

We collect personal data that you give us, that is created when you use the Service, or that we receive from third parties such as Discord. The sections below describe each context.

3.1 Your account

When you create and use a Zaos account, we process:

3.2 Social sign-in and the Discord integration

You can sign in with Discord (the default social sign-in) or with Facebook. If you do, the provider sends us your user ID with that provider, your email address, your nickname and the address of your avatar image. We use them to create or link your account and to sign you in. We do not receive your Discord or Facebook password. What the provider shares is governed by your settings with that provider and its own privacy policy.

The game client also integrates the Discord Social SDK. If you connect your Discord account in the game, it is used to:

• show your Discord presence (for example that you are playing Zaos);
• show your Discord friends in the game. To do this we store the link between your account and those of your Discord friends who also play Zaos (your friend graph); and
• provide voice chat in lobbies. Voice chat runs through Discord. We do not record or store voice conversations.

3.3 Age and parental consent

At sign-up we ask for your birth date to check that you meet the minimum age of 13 and to know whether parental consent is needed. If you are under 16, we also ask for the email address of a parent or legal guardian. Your account stays inactive until the parent or guardian confirms by email. We keep the parent's or guardian's email address and a record of the confirmation (when it was given and for which account) as proof of consent. See section 12 for more on children.

3.4 Payments

Purchases of Zens (our premium virtual currency) are processed by Stripe. You enter your payment details directly with Stripe, which processes them as a payment service provider. We never see or store your full card number. We store:

• your Stripe customer ID;
• the card brand and the last four digits of the card, so you can recognise it;
• transaction records: amount, currency, status, refunds, the event data Stripe sends us about the transaction, and links to receipts or invoices; and
• a ledger of every movement of virtual currency on your account (purchases, spending, refunds, reversals and adjustments).

Depending on the payment method you choose (for example cards, PayPal or local European payment methods), the provider of that method may also process your data under its own privacy policy.

3.5 Gameplay, chat and logs

When you play, our game servers create and store:

• your characters and their progress, inventories, equipment and other game state;
• records of trades, items and virtual currency gained, spent or moved;
• login and session logs, including your IP address and the version of the game client you used;
• chat logs: public, whisper (private), party and guild messages, with the time they were sent and the IP address of the sender. We keep them for moderation, to investigate reports, and for the safety of players;
• offline messages left for other players; and
• auction house records and logs of player-versus-player combat.

3.6 Anti-cheat and security

To keep the game fair and protect accounts, we process:

• A hardware identifier read from your device (on Windows, the machine GUID). We store it in hashed form to enforce bans on devices used for serious or repeated violations;
• Detection records: when our anti-cheat systems detect a possible cheat, bot or manipulation, we record which detector triggered, the score it produced and the supporting technical evidence;
• Risk scores: our automated system combines signals of cheating, botting, fraud and multi-accounting into a risk score for an account (see section 5); and
• The closed-beta one-account check: during the closed beta, each person may only have one account. To check this, we compare hashed versions of the following signals: your email address, a device token stored in your browser, a browser fingerprint computed locally in your browser, your Discord ID and your hardware identifier. Only the hashed values are compared.

3.7 Player reports

When you report another player, we process: the reporting and reported accounts and characters, hashed IP addresses of both, the in-game position, server diagnostics captured at the time, the free text you write and up to four screenshots you attach. A diagnostic bundle created with the report also contains the raw IP address for abuse handling. It is kept short-term in cloud storage and deleted automatically. The reported player is not told who made the report.

3.8 Support requests

When you contact support, we process your messages, any attachments you upload (stored in cloud storage), the account and the character the request concerns, and, if you write to us because you cannot sign in, the contact email address you give us. So that staff can read and answer requests in any language, ticket text may be machine-translated by DeepL (see section 6).

3.9 Crash reports and launcher telemetry

Crash reports. If the game client crashes, it sends a crash report: the crash dump and technical data such as the application version, graphics settings and graphics card, and your IP address. We analyse crash reports with Sentry to find and fix the cause. Crash reports are deleted automatically after a short period.

Launcher telemetry. The launcher sends a random installation ID and technical data about your system: operating system version, amount of memory, number of processor threads, graphics card vendor, model, driver and video memory, supported graphics API level, the results of its compatibility checks, your language and a hashed IP address. We use this to make sure the game runs on the systems our players use and to prioritise fixes. You can switch launcher telemetry off in the launcher settings.

3.10 The website and cookies

When you visit the website, our hosting and security providers process standard request data (such as your IP address, browser type and the time of the request) to deliver the site and protect it from abuse. The website also uses:

• session and security cookies, which are strictly necessary;
• local storage to remember your cookie choice;
• analytics through Google Tag Manager and Google Analytics 4, only after you consent, under Google Consent Mode;
• error monitoring with Sentry (EU data region), configured not to collect personal data;
• Cloudflare Turnstile human verification on forms;
• the Discord server widget, which loads content from Discord;
• the game trailer, embedded from YouTube in privacy-enhanced mode, which only loads when you press play; and
• vote pages: when you vote for Zaos on a vote site, we record the time of the vote and the site.

The details, including every cookie and how long it lasts, are in our Cookie Policy.

3.11 The early-access list

If you join the early-access list, we store your email address, the time you signed up, your browser language, the language of the page you used, a one-way hashed form of your IP address (we do not keep the raw IP address) and a coarse country code. You join only by giving your consent (see section 4).

3.12 Emails

We send service emails, such as account and email confirmations, parental consent requests, security alerts, support replies and purchase receipts. We process your email address and the content of the email for this, and our email delivery providers process delivery data (such as whether a message was delivered or bounced).

4. Why we use your data and our legal bases

We only process personal data where we have a legal basis to do so. The main legal bases are: performance of our contract with you (Article 6(1)(b) GDPR), our legitimate interests (Article 6(1)(f) GDPR), your consent (Article 6(1)(a) GDPR) and compliance with a legal obligation (Article 6(1)(c) GDPR).

Where we rely on legitimate interests, we have weighed our interests against your rights and freedoms and taken measures (such as hashing and access controls) to limit the impact. You can ask us for more information about this balancing, and you have the right to object (see section 13).

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that happened before it.

Providing the data marked as contract is necessary to use the Service. If you do not provide it, we cannot create your account or provide the game to you.

5. Automated decision-making and profiling

5.1 What our anti-cheat risk scoring does

To keep the game fair at the scale of an online game, we use an automated system that analyses account and gameplay signals for patterns typical of cheating, botting, fraud and multi-accounting. Signals include anti-cheat detection records, unusual gameplay or trading patterns, payment disputes and links between accounts (such as shared hashed hardware identifiers). The system produces a risk score for the account. This is profiling within the meaning of the GDPR.

5.2 What the score can lead to

A high score flags the account for review by our staff. Where the evidence is strong and immediate action is needed to protect other players or the game economy, the system may apply automatic temporary measures, such as a temporary suspension, until the case is reviewed.

Permanent sanctions are never decided by the automated system alone. Every permanent ban is reviewed by a member of staff before it takes effect.

5.3 Your rights

If a measure has been applied to your account, you can contest it, express your point of view and ask for a human review by contacting support at https://zaos.global/account/support. We will look at your case and tell you the outcome. You also have the general rights described in section 13, including the right to object to profiling based on our legitimate interests.

6. Machine translation

Zaos brings together players who speak many languages, so we use machine translation in a few places:

• Player chat is translated by our own self-hosted translation server (LibreTranslate), which runs inside our infrastructure. Chat sent for translation does not leave our systems, and private chat never goes to an external translation service.
• Support tickets may be translated by DeepL so that our staff can read and answer requests written in any language.
• Staff announcements written by our team may be translated by DeepL.
• Release notes written by our staff may be translated using Anthropic's service. Release notes contain no player data.

7. Who we share your data with

We do not sell your personal data, and we do not share it with third parties for their own marketing.

7.1 Service providers (processors)

We use carefully selected service providers who process personal data on our behalf, under contracts that require them to protect it and to use it only on our instructions. Some act as independent controllers for parts of their processing (for example Discord and Meta for sign-in, and Stripe for its own regulatory obligations), in which case their own privacy policies also apply.

YouTube (Google) provides the embedded trailer only when you choose to play it. See our Cookie Policy.

7.2 Other players

By the nature of an online game, other players can see your public profile and nickname, your characters and their public attributes, your guild and party membership, your rankings, and the messages you send in public, party or guild chat. Whispers are visible to their recipient. Please think before sharing personal information in chat or in names.

7.3 Authorities and legal requirements

We may disclose personal data to courts, law enforcement or other public authorities where we are legally required to do so, or where it is necessary to protect the rights, property or safety of our players, our staff, the public or us, for example in cases of fraud or threats to someone's safety.

7.4 Business transfers

If Zaos Entertainment S.A or the Service, in whole or in part, is involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred to the new owner or the party involved, which will remain bound by this Privacy Policy or a policy that protects your data at least as well. We will tell you before your data becomes subject to a different privacy policy.

8. International transfers

We are based in Panama, and our main infrastructure is in the European Union (Google Cloud, the Netherlands). Some of our service providers are located in, or may access data from, other countries, including the United States.

When personal data from the European Economic Area or the United Kingdom is transferred to a country that does not have an equivalent level of data protection, we rely on one of the following safeguards:

• an adequacy decision of the European Commission or the UK government for the destination country;
• certification of the recipient under the EU-US Data Privacy Framework (and its UK extension); or
• Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum), together with additional measures where needed.

You can ask for more information about these safeguards, including a copy of the relevant clauses, by contacting privacy@zaos.global.

9. How long we keep your data

We keep personal data only for as long as we need it for the purposes it was collected for. These purposes are:

• providing the game and your account;
• anti-cheat and fair play, including enforcing sanctions and preventing banned players from returning;
• security and fraud prevention;
• game stability and crash analysis;
• support;
• legal, tax and accounting obligations; and
• establishing, exercising or defending legal claims.

When we no longer need the data for any of these purposes, we delete it or anonymise it so that it can no longer be linked to you.

In practice:

• Account data and game data are kept for as long as your account exists, and for a limited period after it is closed where needed for the purposes above (for example, to handle a late payment dispute, to keep a ban effective or to meet accounting obligations).
• Transaction records are kept as long as tax and accounting law requires.
• Logs, chat logs and anti-cheat records are kept as long as needed to moderate, investigate reports and appeals, and enforce sanctions.
• Some short-lived items expire automatically, for example the diagnostic bundles attached to player reports and the crash dumps sent by the client.
• Consent-based data, such as the early-access list, is kept until you withdraw your consent or until we no longer need it for the purpose you agreed to.

10. How we protect your data

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including:

• encryption in transit: the website, the game's services and our providers use encrypted connections;
• hashed passwords: passwords are stored only as one-way hashes, and two-step verification recovery codes are hashed;
• encrypted secrets: two-step verification authenticator secrets are stored encrypted;
• hashing where possible: IP addresses and hardware identifiers are hashed wherever the purpose allows (for example in reports, telemetry, the early-access list and device bans);
• two-step verification and passkeys that you can enable to protect your account;
• access controls: only staff who need access for their role can see personal data, and access is limited to what the task requires; and
• logged staff access: staff actions on accounts and personal data are logged so they can be audited.

No system is completely secure. If a personal data breach occurs, we will notify the competent supervisory authority and, where required, you, as the law requires.

You can help: use a strong, unique password, enable two-step verification, and never share your password. Our staff will never ask for your password.

11. Your choices in the game and on the website

• Cookies: choose which non-essential cookies to allow, and change your choice at any time through "Cookie settings" in the website footer.
• Launcher telemetry: switch it off in the launcher settings.
• Discord: you decide whether to connect Discord in the game, and you can manage what Discord shares in your Discord settings. To unlink Discord from your Zaos account, contact support.
• Two-step verification and trusted devices: manage them in your account area.
• Emails: unsubscribe from non-essential emails using the link in the email (see section 14).

12. Children

12.1 Minimum age

You must be at least 13 years old to create a Zaos account. Children under 13 cannot register.

12.2 Players aged 13 to 15

If you are aged 13 to 15, you need the consent of a parent or legal guardian. At sign-up, you give your birth date and the email address of your parent or guardian. We send them an email asking them to confirm, and your account stays inactive until they do. We keep a record of their consent.

Players under 18 need a parent's or guardian's permission before making any purchase. Parents and guardians are responsible for the purchases made by their children.

12.3 Information for parents and guardians

If you are the parent or legal guardian of a player, you can:

• contact us at privacy@zaos.global, or through support, with questions about your child's account and data;
• withdraw your consent at any time. If you do, we will deactivate your child's account and handle their data as described in this policy; and
• exercise your child's data protection rights on their behalf, as the law allows.

We will ask for information to verify that you are the parent or guardian who gave consent, or are otherwise entitled to act for the child.

12.4 If we learn that a child under 13 has registered

If we learn that a child under 13 has created an account, or that the consent of a parent or guardian was not validly given, we will deactivate the account and delete the child's personal data, except where we must keep limited data to meet a legal obligation or to prevent the child from registering again in breach of our rules. If you believe a child under 13 has an account, please contact privacy@zaos.global.

13. Your rights

13.1 What your rights are

Depending on where you live, and in particular if you are in the EEA or the United Kingdom, you have the following rights over your personal data:

• Access: to know whether we process your data and to receive a copy of it, with information about how we use it.
• Rectification: to have inaccurate data corrected and incomplete data completed. You can update much of your account data yourself in your account area.
• Erasure: to have your data deleted, for example when it is no longer needed or when you withdraw consent. This includes the right to ask us to close and delete your account.
• Restriction: to ask us to limit the processing of your data, for example while we check a request for rectification.
• Objection: to object at any time to processing based on our legitimate interests, including profiling, on grounds relating to your particular situation. You can always object to direct marketing.
• Portability: to receive the data you provided to us, processed on the basis of contract or consent, in a structured, commonly used and machine-readable format, and to have it sent to another controller where technically feasible.
• Withdrawal of consent: to withdraw any consent you have given, at any time, without affecting processing before the withdrawal.
• Human review: to contest an automated decision and obtain human review (see section 5).
• Complaint: to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work or where you believe an infringement took place. In the United Kingdom, this is the Information Commissioner's Office. We would appreciate the chance to address your concerns first, so please contact us.

13.2 How to exercise your rights

Send your request to privacy@zaos.global or through the support system at https://zaos.global/account/support. To protect your account, we will verify your identity before acting on a request, usually by asking you to send it from your account or from the email address linked to it, or to confirm it through your account. We may ask for more information if we cannot verify your identity.

We will reply within one month of receiving your request. If a request is complex or we receive many requests, we may extend this by up to two further months, and we will tell you why within the first month. Exercising your rights is free of charge. We may refuse, or charge a reasonable fee for, requests that are manifestly unfounded or excessive, as the law allows.

13.3 Account deletion

You can ask us to delete your account at any time. When we delete it, we delete or anonymise your personal data. Some records may be kept where we need them to meet legal obligations (for example accounting records of purchases) or to prevent fraud and cheating (for example the hashed hardware identifier of a banned device, so that a ban cannot be evaded by creating a new account). We keep these records only for as long as needed, as described in section 9. Deleting your account also means the loss of your characters, items and virtual currency, as explained in our Terms of Service and Refund Policy.

14. Marketing communications

We do not send marketing emails without your consent. The early-access list is consent-based: we use it to invite you to the closed beta and to send occasional news about the launch of Zaos. You can withdraw your consent at any time by using the unsubscribe link in any such email or by writing to privacy@zaos.global.

Service emails (such as confirmations, security alerts, support replies and purchase receipts) are part of providing the Service, and you cannot opt out of them while you have an account.

15. Cookies

We use cookies and similar technologies (such as local storage) on the website. Strictly necessary cookies keep the site and your sign-in working and secure. Analytics cookies are only set after you accept them, and nothing non-essential runs before you make your choice. Third-party content such as the Discord widget and the YouTube trailer may set the provider's own cookies. You can change your choice at any time through "Cookie settings" in the website footer. Our Cookie Policy lists every cookie we use, its purpose and how long it lasts.

16. Additional information for certain countries

We apply the principles of this policy to all players, wherever they live. Players in some countries have additional rights under their local law. This section summarises them in general terms. It does not limit any right you have under the law of your country.

16.1 Türkiye

If you live in Türkiye, the Law on the Protection of Personal Data No. 6698 ("KVKK") applies to our processing of your personal data. Zaos Entertainment S.A is the data controller. We process your data for the purposes and on the legal grounds described in this policy, which correspond to the grounds recognised by the KVKK (such as the performance of a contract, our legitimate interests, compliance with legal obligations and, where required, your explicit consent). Personal data may be transferred abroad as described in sections 7 and 8, in accordance with the KVKK's rules on cross-border transfers. Under the KVKK, you have the right to learn whether your data is processed, to request information about it, to learn the purpose of the processing and whether it is used accordingly, to know the third parties in Türkiye or abroad to whom it is transferred, to request its correction or deletion and to have third parties notified of this, to object to a result against you arising exclusively from automated analysis, and to claim compensation for damage arising from unlawful processing. You can exercise these rights by contacting privacy@zaos.global, and you may also apply to the Turkish Personal Data Protection Authority.

16.2 Brazil and other countries in South America

If you live in Brazil, the General Data Protection Law (Law No. 13,709/2018, "LGPD") applies to our processing of your personal data. Zaos Entertainment S.A is the controller. We process your data on the legal bases recognised by the LGPD that correspond to those described in section 4 (such as the performance of a contract, our legitimate interests, compliance with legal obligations and consent). International transfers take place as described in section 8 and as permitted by the LGPD. Under the LGPD, you have the right to confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about the entities with which we share data, information about the possibility of refusing consent and its consequences, withdrawal of consent, and review of decisions taken solely on the basis of automated processing. You can exercise these rights by contacting privacy@zaos.global, and you may also file a complaint with the National Data Protection Authority (ANPD).

Players in other countries of South America may have similar rights under their national data protection laws. We will respond to requests made under those laws in the same way, through privacy@zaos.global.

17. Changes to this policy

We may update this Privacy Policy from time to time, for example when we add features to the Service, change service providers or when the law changes. The version number and the "updated" date at the top of this page show when it last changed. If we make material changes, we will tell you in advance through the website, in the game or by email, before they take effect. Where a change requires your consent, we will ask for it.

18. Contact

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:

• Email: privacy@zaos.global
• Support: https://zaos.global/account/support
• Post: Zaos Entertainment S.A, 50th Street and Corner of Elvira, Tower Financial Center, 35th Floor, Suite L, Panama City, Panama