Privacy Policy

Last updated: 2026-11-04.

This Policy explains how VANTAGAMES LTDA (CNPJ 68.960.308/0001-12, Av. Santarem, 205 - Cohab Ibura de Cima), the data controller, processes your personal data on the website and in the game DDT41, in accordance with the Brazilian General Data Protection Law (LGPD — Law no. 13,709/2018), the European Union General Data Protection Regulation (GDPR) and, where applicable, California law (CCPA/CPRA).

1. Data we collect

Category	Examples	Source
Account	username, nickname, e-mail, password (stored only as a hash), language	you
Social login	identifier, name and e-mail provided by Google, Facebook or Discord	the provider you choose
Usage and device	IP address, browser and device type, access times, security logs	automatic
Game	characters, progress, items, in-game messages, match and sanction history	your gameplay
Payments	orders, amounts, currency, status and transaction identifiers	you and the processors
Support	messages and attachments sent to support	you
Cookies	necessary cookies and, with your consent, analytics and marketing cookies (see section 9)	automatic
Advertising and measurement (with consent)	campaign origin (UTM parameters, landing page, referrer), ad click identifiers, _fbp, _fbc, Google Analytics client ID, conversion events	automatic

We do not store payment card data. It is handled directly by the payment processors (such as Mercado Pago, Efí or Xsolla) under their own policies.

2. Purposes and legal bases

• Providing the Service (creating the account, logging into the game, delivering purchases, support) — performance of a contract.
• Security and prevention of fraud and cheating (access logs, abuse detection) — legitimate interest and compliance with legal obligations (in Brazil, the Internet Civil Framework requires access logs to be kept for 6 months).
• Payments and tax obligations — performance of a contract and legal obligation.
• Account communications (e-mail confirmation, password reset, changes to terms) — performance of a contract.
• Promotional communications — only with your consent, which you may withdraw at any time.
• Improving the game with aggregated statistics — legitimate interest.
• Analytics and advertising (site usage statistics; measuring and personalising ads with Google and Meta) — consent, which you may withdraw at any time (see section 9).

We do not sell your personal data and we do not use it for automated decisions with legal effects on you, except automated cheat detection, which can be reviewed by a person on request.

3. Sharing

We share data only with: payment processors; hosting, e-mail and infrastructure providers; the social login providers you choose; authorities, when required by law; and, only with your consent, Google and Meta, as analytics and advertising platforms (see section 9). Except for Google and Meta, which also process data under their own terms and policies, all act under contract and only for the purposes above.

4. International transfers

Some suppliers may process data outside your country (for example, in the United States or the European Union). In those cases we rely on the safeguards provided for in the LGPD (art. 33) and the GDPR, such as standard contractual clauses. This includes Google and Meta, which may process data in the United States.

5. How long we keep data

• Account and game data: while the account is active; after deletion, up to 30 days in backups.
• Access logs: 6 months (or the period required by law).
• Orders and tax records: for the legal period (in Brazil, generally 5 years).
• Sanction history: as long as needed to prevent repeat offences.

6. Your rights

You may request: confirmation of processing and access to your data; correction; deletion or anonymisation; portability; information about sharing; withdrawal of consent; and objection to processing based on legitimate interest. EU residents may complain to their local data protection authority; in Brazil, to the ANPD. California residents have the rights to know, delete and correct, and not to be discriminated against for exercising them — personal data may be shared for targeted advertising only with your consent; to decline or withdraw consent, use "Cookie preferences" in the site footer.

To exercise your rights, write to our data protection officer (DPO): [email protected]. We will reply within 15 days (LGPD) or 30 days (GDPR) and may ask you to confirm your identity.

7. Children and teenagers

The Service is not directed to children under 13. In the European Union, where national law sets a higher age (up to 16), processing depends on parental consent. If we learn that we have collected data from a child without the required authorization, we will delete it. Parents and guardians can contact us at [email protected].

8. Security

We use encryption in transit (HTTPS), strong password hashing, encrypted secrets, access control and audit logs. No system is completely secure: we will report relevant incidents as required by law.

9. Cookies

We use cookies that are necessary for the site to work. Analytics and marketing cookies are optional and are used only with your consent.

Cookie	Category	Provider	Purpose	Duration
ddt41_session	Essential	DDT41	Keeps you signed in	Until you close the browser, or 30 days if you choose to stay signed in
ddt41_oauth, ddt41_oauth_pending, ddt41_2fa_challenge, ddt41_launcher_handoff	Essential	DDT41	Social login, two-factor authentication and launcher sign-in	5 to 30 minutes
ddt41_2fa_trust	Essential	DDT41	Remembers a trusted browser for two-factor authentication	30 days
ddt_consent	Essential	DDT41	Stores your cookie choice	180 days
ddt_attr	Analytics or Marketing	DDT41	Campaign origin (UTM parameters, landing page, referrer); ad click identifiers only with Marketing consent	90 days
_ga, _ga_*	Analytics	Google (Google Analytics)	Distinguishes visitors and measures site usage	2 years
_gcl_au, _gcl_aw	Marketing	Google (Google Ads)	Measures ad clicks and conversions	90 days
_fbp, _fbc	Marketing	Meta	Identifies the browser and the ad click to measure and personalise ads	90 days

The durations of Google and Meta cookies are those published by these suppliers and may change. Your language preference does not use a cookie: it is kept in your browser's local storage (ddt41:locale).

Your choices

• Optional cookies are set only after you consent in the cookie notice. Until then, no Google or Meta tag is loaded.
• Rejecting is as easy as accepting: both options appear in the notice with the same prominence, and you can also choose by category.
• You can change your choice at any time under "Cookie preferences" in the site footer. Withdrawing consent deletes the corresponding cookies from your browser, but does not affect processing already carried out.
• Your choice is kept in the ddt_consent cookie. If you are signed in, it is also recorded on your account.
• You can also block cookies in your browser, but signing in will stop working.

Data shared with advertising platforms

Only with your consent, we send the data below, through your browser and from our servers, to Google (Google Tag Manager, Google Analytics, Google Ads) and Meta (Meta Pixel, Conversions API):

• SHA-256 hashes of your e-mail address, account identifier and country;
• IP address and browser user agent;
• ad click identifiers (gclid, gbraid, wbraid, fbclid), _fbp, _fbc and Google Analytics client ID;
• sign-up and purchase conversion events (with value, currency, order code and package purchased) and site usage events (pages viewed, sign-in, checkout start, downloads).

Analytics consent allows sending to Google Analytics; Marketing consent allows sending to Google Ads and Meta. The legal basis is your consent, which you may withdraw at any time as described above.

10. Changes

We may update this Policy. Material changes will be announced and, where the law requires, we will ask for your consent. Previous versions remain available for reference.

11. Contact

Controller: VANTAGAMES LTDA — Av. Santarem, 205 - Cohab Ibura de Cima — [email protected] Data protection officer (DPO): [email protected]