Data Rights, Retention & Account Deletion Policy

1. How to make a request

Email gamedev@neongrovecity.com from the address associated with the account and state the right you wish to exercise. You may also use the authenticated Support page. Describe the relevant account or processing so we can identify the request efficiently.

We may ask for proportionate information to confirm identity, especially where disclosure or deletion could expose transaction records. We will not ask for a password or one-time code. If identity cannot be confirmed through account control, a secure alternative must be provided before sensitive evidence is collected.

2. Access and copy

You may request confirmation whether personal data is processed, access to that data and the information required by Article 15 GDPR. Where feasible, the response includes account, profile, gameplay, transaction and support data in a commonly understandable electronic form.

The right of access does not require disclosure of another person’s data, confidential security logic or material protected by another legal right. Redaction or a tailored explanation may be used instead of withholding the entire response.

3. Rectification and completion

Incorrect account or profile information may be corrected on request. Some gameplay and ledger records represent historical events and cannot be rewritten as if the event never occurred; an explanatory correction or balancing entry may be used to preserve audit integrity.

4. Erasure and account closure

You may request account deletion under Article 17 GDPR. The current product does not provide a self-service deletion button, so the request is handled manually through support. Ordinary gameplay and profile data that is no longer necessary will be deleted or anonymised after the account is closed and active disputes are resolved.

Erasure may be limited where retention is necessary for a legal obligation, establishment or defence of claims, payment and accounting records, fraud prevention proportionate to risk, or another exception in Article 17(3). Restricted records are not used to continue ordinary gameplay or marketing.

5. Restriction, objection and consent

You may request restriction under Article 18 while accuracy, objection or legal need is assessed. You may object under Article 21 to processing based on legitimate interests; we will stop unless compelling legitimate grounds override the interests and rights involved or processing is needed for legal claims.

Consent may be withdrawn at any time for processing based on consent. Current service emails are transactional and required to administer the chosen account, purchase or support request; no direct-marketing programme is currently configured.

6. Portability

For data processed automatically on consent or contract and provided by you, Article 20 may permit receipt in a structured, commonly used and machine-readable format and transmission to another controller where technically feasible. Inferred security assessments and data processed on another lawful basis may fall outside portability.

7. Operational retention schedule

• Account and ordinary gameplay profile — while the account is active; after a valid closure request, until active support, payment and security matters are resolved, followed by deletion or anonymisation except for retained records.
• Verified transaction, Wallet Ledger, refund and return records — for the statutory accounting, tax, payment-dispute and limitation period applicable to the operator; this may commonly extend for several years and can be up to seven years where required.
• Support conversations — while the ticket is active and ordinarily up to 24 months after closure, longer only where the conversation evidences an unresolved transaction, complaint, security event or legal claim.
• Application and security logs — for the shortest period reasonably needed for troubleshooting, abuse prevention and incident evidence, ordinarily no longer than 12 months unless an identified incident requires preservation.
• Verification material — not collected through the current ordinary support flow. If a secure provider process is introduced, the specific retention period and controller roles must be disclosed before collection.
• Provider records — Stripe and Base44 apply their own retention duties to data they process independently; deletion from Neon Grove does not automatically erase an independent provider’s legally retained record.

8. Backups and deletion completion

Residual copies may remain temporarily in protected backups until the normal overwrite cycle completes. They are not restored for ordinary use and remain subject to access and security controls. If a backup is restored for disaster recovery, applicable deletion instructions must be re-applied.

9. Response period and complaints

We respond without undue delay and ordinarily within one month under Article 12 GDPR. A complex or numerous request may be extended by two months, with notice during the first month. Manifestly unfounded or excessive requests may be refused or charged only as permitted by law.

You may complain to a competent supervisory authority under Article 77 GDPR and seek a judicial remedy. Exercising a right will not reduce Game access except where deletion, restriction or missing contract-required information makes a function impossible.