Privacy Policy | Silly Con Valley

1. Data Controller & Scope

This Privacy Policy explains how Millennium Falck Enterprise Oy (“we”, “us”, “our”, Finnish Business ID: FI-registered enterprise, Helsinki, Finland) collects, uses, and safeguards your personal data under the EU General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and the Finnish Data Protection Act (Tietosuojalaki 1050/2018).

This policy applies to:

• The Silly Con Valley mobile game application on iOS (and upcoming Android version).
• The official website sillyconvalleygame.com, including The Venture Mall merchandise store, the Character Sponsorship portal, and the Macroeconomic Terminal (/forecast/).

Last Updated: October 2026 (Version 1.44 Release)

2. Data We Collect & Purpose of Processing

2.1 E-Commerce & Store Purchases

When you purchase physical merchandise or digital sponsorships through our store, we process:

• Contact & Identification Details: First name, last name, email address, and billing address.
• Physical Shipping Address: (Only collected for physical merchandise/apparel orders fulfilled via Spreadconnect EU).
• Order Metadata: Purchased items, timestamp, transaction ID, order notes, and VAT calculation details.

Legal Basis: GDPR Article 6(1)(b) — Processing is necessary for the performance of a purchase contract.

2.2 Character Sponsorship & Intake Data

When you sponsor a custom character, we process your submitted founder handle, character name, satirical backstory, proposed in-game buffs/flaws, and reference avatar URLs/photos. This data is used exclusively to design bespoke 16-bit pixel-art portraits, balance gameplay perks, and publish your backer credit on our website’s Wall of Fame.

Legal Basis: GDPR Article 6(1)(b) (Contractual performance) and Article 6(1)(a) (Consent for public attribution).

2.3 Game Analytics, Crash Telemetry & Public Delaware Entities Registry

Within the iOS game app, we collect anonymized telemetry via Google Analytics 4 (GA4) & Firebase Crashlytics (e.g., session durations, anonymized crash stack traces, iOS version, device model, and aggregate gameplay events such as pitch battle showdowns and bankruptcy rates). We do not collect precise GPS geolocation or link crash logs to your personal real-world identity.

Public Macroeconomic Simulation Ledger: Custom startup company names chosen by players in-game (customEvent:company_name) are aggregated anonymously and published as satirical simulation statistics on our public Delaware Incorporation Registry (https://sillyconvalleygame.com/forecast/). Company names are sanitized and never linked to your personal identity, device identifiers, or IP address.

Legal Basis: GDPR Article 6(1)(f) — Legitimate interest in maintaining app stability, fixing bugs, and compiling aggregate game ecosystem analytics.

2.4 Apple iCloud Sync & Game Center Integration

iCloud Cross-Device Sync: Silly Con Valley utilizes Apple’s native iCloud Key-Value and CloudKit storage to seamlessly synchronize your game save states, unlocked CEO archetypes, and prestige levels across your own Apple devices (iPhone, iPad). Your save files are encrypted and stored in your private Apple iCloud account container; we have zero access to your iCloud account credentials, file contents, or personal files.

Apple Game Center: If you are signed into Apple Game Center, the game reports high scores (fastest IPO runs) and milestone achievements to Apple’s Game Center leaderboards. Game Center authentication, leaderboard displays, and friend visibility are governed directly by Apple’s Privacy Policy.

Legal Basis: GDPR Article 6(1)(b) (Performance of core game save synchronization requested by player).

2.5 Website Analytics, Advertising & Newsletter Subscriptions

Web Analytics & Cookies: Our website uses Google Analytics 4 (via Google Site Kit) with Google Consent Mode v2 enabled to measure traffic, popular devlogs, and acquisition funnels. Non-essential cookies and Google AdSense advertising scripts are controlled through our Complianz cookie consent banner, allowing EU/EEA visitors to grant or withhold consent at any time. For detailed cookie expiration timetables and granular category controls, please review our Cookie Policy (EU).

Email Newsletters (MailPoet): If you opt in to receive Android beta notifications, devlog dispatches, or patch notes via our email signup forms, we process your email address. Every broadcast email includes an instant one-click unsubscribe link to withdraw consent at any time.

Legal Basis: GDPR Article 6(1)(a) (Consent).

3. Payment Processing & Security

All credit card, Apple Pay, and electronic payments are handled directly by Stripe Payments Europe, Ltd. (and PayPal if selected). Stripe is certified as a PCI-DSS Level 1 Service Provider (the highest security tier in the payment industry).

We never store, capture, or have access to your full credit card number or CVV/CVC code. Real-time sales tax and EU VAT calculations are performed through Stripe Tax in compliance with European Union One-Stop-Shop (OSS) and Finnish tax laws.

In-App Purchases (iOS): Digital add-ons purchased within the mobile game app (such as custom CEO packs) are processed directly by Apple Inc. via the App Store StoreKit API. We do not receive or process your payment details for in-app purchases.

4. Third-Party Service Providers (Data Processors)

We share data with third-party processors only as strictly necessary to operate our services:

• Stripe (Ireland / USA): Payment gateway, fraud detection (Stripe Radar), and automated Stripe Tax calculation.
• Spreadconnect / SPOD (EU – Germany): Print-on-demand manufacturing and postal shipping of physical apparel.
• Apple Inc. (USA / Ireland): iOS app hosting, TestFlight beta distribution, iCloud game save synchronization, Game Center leaderboards, and In-App Purchase processing.
• Google LLC (USA / Ireland): Google Analytics 4, Firebase Crashlytics telemetry, and Google AdSense web advertisements.
• Complianz (EU – Netherlands): GDPR-compliant cookie consent management for website visitors.
• MailPoet / Automattic (USA / EU): Newsletter delivery and transactional email dispatch.

Where personal data is transferred outside the EU/EEA, transfers are safeguarded under the European Commission’s Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework.

5. Data Retention

• E-Commerce & Accounting Records: Retained for 6 to 10 years in compliance with the Finnish Accounting Act (Kirjanpitolaki 1336/1997).
• Character Artwork & Lore Data: Retained for the lifetime of the game to maintain in-game lore consistency across version releases.
• Game Telemetry & Crash Logs: Automatically purged by Google Firebase after 90 to 180 days.
• Newsletter Subscribers: Retained until you click unsubscribe or request deletion.

6. Your GDPR Rights

Under Chapter III of the GDPR, you have the right to:

• Access & Portability: Request a copy of all personal data we hold about you.
• Rectification: Request correction of inaccurate personal or order details.
• Erasure (“Right to be Forgotten”): Request deletion of your personal data, subject to statutory tax retention laws.
• Withdraw Consent: Revoke cookie consent or unsubscribe from marketing emails at any time.
• Lodge a Complaint: If you believe our data processing infringes GDPR, you have the right to file a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).

7. Contact Us