Privacy Policy

Last updated: 8 May 2026

1. Data Controller

Chien-Hung Lin (林建宏) ("we", "us"), an individual sole proprietor based in Taiwan (R.O.C.), is the data controller for personal data collected through the Werewolf Whispers AI service. This Privacy Policy is provided in compliance with the Taiwan Personal Data Protection Act (個人資料保護法) and, where applicable, the EU/UK GDPR for users in those regions.

2. Data We Collect

• Account data — email address, display name, login credentials (handled via third-party authentication providers such as Google)
• Usage data — game progress, level attempts, energy consumption, in-game prompts you submit, in-game actions
• Device & technical data — IP address, browser type, OS, device identifiers, language, referral source
• Support data — any messages, screenshots, or attachments you send us
• Transaction metadata — order ID, product purchased, subscription status (the actual payment card / billing details are collected and held by Paddle, not by us)

We do not collect biometric data, voice recordings of real people, government-issued IDs, or sensitive categories of personal data.

3. How We Use Your Data & Legal Basis

• Account creation & authentication — to provide access to the Service (contract performance)
• Providing the Service — running games, generating AI dialogue/narration for fictional NPCs, tracking progress, managing energy and subscriptions (contract performance)
• Security & fraud prevention — protecting accounts, preventing abuse and chargeback fraud (legitimate interest, legal obligation)
• Product improvement — analysing aggregated usage patterns (legitimate interest)
• Customer support — responding to inquiries (contract performance)
• Legal compliance — complying with tax, accounting, and regulatory obligations (legal obligation)

We do not use your personal data for automated decision-making with legal effect, nor for marketing profiling. We do not sell personal data.

4. Data Sharing & Recipients

We share your data only with the following categories of recipients:

• Paddle.com Market Limited (our Merchant of Record) — for payment processing, subscription management, tax compliance, fraud screening, and invoicing. See Paddle's Privacy Notice.
• Hosting & infrastructure — Lovable Cloud (Supabase) for database, authentication, file storage, and edge functions.
• AI model providers — Google (Gemini) and OpenAI for processing in-game prompts and generating fictional dialogue and synthetic narration. Inputs are sent only to fulfil your request and are not used to train models on identifiable personal data.
• Professional advisers — legal or accounting advisers, where strictly necessary.
• Authorities — where required by law or valid legal process.

5. International Transfers

Some of our service providers (e.g. Paddle, Google, OpenAI, Supabase) are located outside Taiwan, including in the EEA, UK, and United States. Where data is transferred internationally, we rely on the safeguards provided by those vendors, including Standard Contractual Clauses and equivalent mechanisms.

6. Data Retention

We keep account and usage data for as long as your account is active. Transaction records are retained for at least 5 years to comply with Taiwan tax and accounting law. When data is no longer needed, it is deleted or anonymised.

7. Your Rights

Subject to applicable law, you may request to: access, correct, delete, restrict, or port your personal data, object to processing, and withdraw consent. EEA/UK users additionally have the right to lodge a complaint with their local supervisory authority. Taiwan users may exercise rights under Articles 3 and 10 of the Personal Data Protection Act. To exercise any right, email us — we will respond within 30 days.

8. Security

We implement appropriate technical and organisational measures — including TLS encryption in transit, encryption at rest, access controls, and least-privilege Row-Level Security on the database — to protect your data.

9. Cookies & Local Storage

We use essential cookies and browser local storage to keep you logged in, remember preferences, and maintain session state. We do not use marketing or third-party tracking cookies.

10. Children

The Service is not directed at children under 13. If we become aware that we have collected personal data from a child under 13 without parental consent, we will delete it.

11. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email.

12. Contact

For privacy-related inquiries, please email support@wolfwhisper.xyz.