LandOfRobs 
1. Who controls your data
This Privacy Policy explains how PoinGames Studio ("PoinGames", "we") handles the personal data of anyone who visits poinstudio.com, plays LandOfRobs or contacts our team.
Under Brazilian Law No. 13.709/2018 (the General Data Protection Law - LGPD), PoinGames Studio is the controller of the data described in this policy. If you are in the European Union, we act as the controller under the GDPR as well.
Data Protection Officer, as required by article 41 of the LGPD: privacidade@poinstudio.com.
2. What data we collect
We only collect what is needed to run the website and the game. We never sell your data.
2.1. Data you give us
- Contact form: name, email, subject and the content of your message.
- Game account (Poin ID): email address, chosen nickname, internal player id and game progress (level, experience, characters, items, trophies).
- Newsletter: email address and the date consent was given.
- Job applications: name, email, portfolio links and whatever information you choose to send.
2.2. Data collected automatically
- Technical access data: IP address, date and time of the request, pages visited, browser and operating system, recorded in server logs.
- Preferences: the language you picked and your cookie choices.
- Anti-spam signals: technical signals used to tell humans from bots on the contact form (time to fill the form, submissions per IP address and, when enabled, the result of the Cloudflare Turnstile check).
We do not collect sensitive personal data (LGPD art. 5, II) and we do not make automated decisions that produce legal effects on you.
3. Why we use it and on what legal basis
The LGPD requires a legal basis for every processing activity. Here is ours.
| Purpose | Data used | Legal basis (LGPD) |
|---|---|---|
| Reply to your message sent through the contact form | Name, email, subject, message | Consent (art. 7, I) and preliminary procedures at the request of the data subject (art. 7, V) |
| Create and keep your LandOfRobs account and progress | Email, nickname, progress data | Performance of a contract (art. 7, V) |
| Send the sign-in verification code (Poin ID) | Performance of a contract (art. 7, V) | |
| Send news and the newsletter | Consent (art. 7, I), revocable at any time | |
| Keep the site online and prevent fraud, spam and abuse | IP, access logs, anti-bot signals | Legitimate interest (art. 7, IX) and compliance with a legal obligation (art. 7, II) |
| Keep application access records | IP, date and time | Legal obligation - art. 15 of the Brazilian Internet Bill of Rights (art. 7, II) |
| Measure site performance with aggregated data | Performance cookies | Consent (art. 7, I) |
| Review job applications | Data sent with the application | Preliminary procedures at the request of the data subject (art. 7, V) |
4. Who we share it with
We do not sell, rent or trade your personal data. We share it only with processors that help us deliver the service, always limited to what is necessary:
| Partner | What for | Where the data sits |
|---|---|---|
| Google (Gmail / Google Workspace) | Sending and receiving contact form and Poin ID emails | United States |
| Cloudflare | Anti-bot verification (Turnstile), when enabled | United States |
| Discord | Official community and testing program (when you join it yourself) | United States |
| Buy Me a Coffee | Optional support widget, loaded only with your consent | United States |
| Hosting provider | Running the website and game servers | Brazil / United States |
We may also share data when required by a court order, by a competent authority, or when needed to defend our rights, always within the limits of the law.
4.1. International transfers
Some of our partners are located outside Brazil. In those cases the international transfer relies on article 33 of the LGPD, through standard contractual clauses and the safeguards offered by each provider.
5. How long we keep it
| Data | Retention period |
|---|---|
| Contact form messages | Up to 12 months after the conversation ends |
| Game account and progress | While the account exists; up to 6 months after a deletion request |
| Verification codes (Poin ID) | Automatically deleted within 60 seconds of use |
| Newsletter subscription | Until you unsubscribe |
| Access logs | 6 months, as required by art. 15 of the Brazilian Internet Bill of Rights |
| Job applications | Up to 12 months, unless you ask us to delete them earlier |
Once the period ends, data is deleted or anonymised, unless the law requires us to keep it longer.
6. Your rights
Article 18 of the LGPD guarantees that, at any time and free of charge, you can:
- confirm whether we process your data and access that data;
- correct incomplete, inaccurate or outdated data;
- ask for anonymisation, blocking or deletion of unnecessary data or data processed unlawfully;
- request portability of your data to another provider;
- ask for deletion of data processed on the basis of your consent;
- know which public and private entities we shared your data with;
- be informed that you may refuse consent and what happens if you do;
- withdraw your consent at any time;
- object to processing based on legitimate interest.
To exercise any of these rights, write to privacidade@poinstudio.com. We answer within 15 days, as required by art. 19, II of the LGPD. We may ask for extra information to confirm your identity before acting on the request.
You may also file a complaint with the Brazilian Data Protection Authority (ANPD) at gov.br/anpd.
7. How we protect your data
We apply technical and administrative measures consistent with article 46 of the LGPD, including:
- encryption in transit (HTTPS/TLS) across the whole site;
- session cookies flagged HttpOnly, Secure and SameSite;
- database access restricted to the internal network, with credentials kept out of the source code;
- rate limiting and anti-bot verification on public forms;
- parameterised database queries to prevent SQL injection;
- escaping of third-party content before it is displayed or sent by email.
In case of a security incident that may cause relevant risk to data subjects, we will notify the ANPD and the affected people, as required by article 48 of the LGPD.
8. Children and teenagers
Our games may be played by teenagers, but accounts and the forms on this website are meant for people over 18. Processing of children's and teenagers' data follows article 14 of the LGPD and always considers the best interest of the minor.
Children's data is only processed with specific, prominent consent from at least one parent or legal guardian. If you are a parent or guardian and believe a child has sent us data without that consent, write to privacidade@poinstudio.com and we will delete it.
9. Cookies
The use of cookies and similar technologies is described in detail in our Cookie Policy, where you can also change your choices at any time.
10. Changes to this policy
We may update this policy to reflect changes to the site, the game or the law. The effective date at the top of the page marks the current version. When a change is significant, we will announce it on the site or by email before it takes effect.
11. Talk to us
Privacy questions: privacidade@poinstudio.com.
Anything else: support@poinstudio.com.
Still have questions?
Talk to our data protection team. We answer every request within the deadline set by the LGPD.