Pascal Goedde, operating under the name “Verse Digital”, Solomou Solomou 10, Emba, Paphos 8250, Cyprus ("we," "us," "our"), operates HeadBox, a competitive survival shooter currently in development. The waitlist is open now, and Founder Access, a paid subscription, is planned to launch later. This Policy applies to our website, our waitlist, and, once available, the game and Founder Access.

Because HeadBox is still in development, the Platform is limited in scope: an account and a waitlist place now, and the game build and your Founder Access subscription once they are available. Everything we collect is listed in Section 2, and we collect nothing beyond it. If the Platform gains features that need more data, we will update this Policy and tell you before that processing begins.

Joining the waitlist has no minimum age. Other parts of HeadBox, such as Founder Access, gameplay, and competitions, have their own age requirements, set out in our Terms of Use and Eligibility page. If you believe a child's data has been provided to us without appropriate consent, contact us using the details in Section 13 and we will delete it.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the applicable Cyprus data protection law (Law 125(I)/2018). This Policy should be read alongside our Terms of Use and Cookie Policy.

We collect the following, and nothing more:

Account Data

• Username;
• Email address;
• Password, stored only as a one-way hash — we never see or store it in plain text;
• Basic account settings, such as your communication preferences.

Device & Usage Data

• IP address, browser type and version, operating system, and device identifiers;
• Log files, error reports, and crash data;
• Pages visited and how you move through the site, collected through analytics.

Support Data

• Messages you send us, including bug reports and feedback, and our replies.

Subscription & Billing Data (once Founder Access launches)

• Whether you hold Founder Access, and your subscription status, start, renewal, and cancellation dates;
• Transaction information that Xsolla shares with us to confirm and support your purchase, such as order or transaction identifiers, the amount and currency charged, and your country for tax purposes.

We do not collect identity documents or biometric data, and we do not receive or store your full payment card or bank details — these are handled by Xsolla (see Section 7). We do not ask for your full legal name, date of birth, or address.

We use your data only for the following purposes:

• Account Management: Creating your account, reserving your username, authenticating you, and managing your waitlist place;
• Founder Access: Confirming and managing your Founder Access subscription, granting or ending access accordingly, and handling billing questions and refund requests together with Xsolla;
• Platform Functionality: Delivering the game build and keeping the site and game working as intended;
• Analytics: Understanding how the site and game are used so we can see what works;
• Security: Protecting accounts, detecting cheating and abuse, and preventing unauthorised access;
• Customer Support: Answering your questions and investigating problems you report;
• Communication: Sending service messages such as account confirmations and security alerts, and — only if you opt in — development updates about the game;
• Product Improvement: Using feedback and aggregated usage data to improve HeadBox before full release.

We do not sell your personal data. We do not use automated decision-making that produces legal or similarly significant effects on you without offering human review.

Under the GDPR we must have a valid legal basis for each processing activity. We rely on:

• Contract Performance (Art. 6(1)(b)): Providing your account, the game, and Founder Access, as described in our Terms of Use;
• Legitimate Interests (Art. 6(1)(f)): Platform security, anti-cheat, abuse prevention, and product improvement. We balance these against your rights before relying on this basis;
• Consent (Art. 6(1)(a)): Optional analytics cookies and development-update emails. You can withdraw consent at any time, without affecting processing carried out beforehand;
• Legal Obligation (Art. 6(1)(c)): Keeping billing and transaction records as required by tax and accounting law, and responding to lawful requests from authorities.

We do not process special category data.

A fair game matters even during development. To detect cheating and abuse we may collect and analyse:

• Device identifiers, to detect multi-accounting or banned devices;
• IP address and connection data, to spot suspicious access patterns;
• Gameplay telemetry, analysed for patterns consistent with automated assistance;
• Account activity, such as login frequency and device switching.

We rely on legitimate interests for this processing. Where our systems flag a possible violation, we review it manually before any account restriction is applied, and you may contest the outcome through the process set out in our Terms of Use.

A cookie is a small text file stored on your device. We use three kinds:

• Strictly Necessary: Required for the site to work — sign-in, session management, and security. These cannot be switched off;
• Analytics (Google Analytics): Help us understand page views, session length, and errors. Set only with your consent;
• Functional: Remember preferences such as language. Set only with your consent.

We do not use marketing or advertising cookies. Your choice is saved in your browser; to change it, clear this site's stored data and choose again when the cookie banner reappears. Turning off optional cookies will not stop you using HeadBox. Analytics data is aggregated or pseudonymised wherever possible. See our Cookie Policy for the full list.

We do not sell your personal data. We share it only where necessary, with:

• Service Providers: Cloud hosting, email delivery, analytics (Google Analytics), and customer support tools. Each is contractually bound to process data only on our instructions;
• Xsolla (Payments & Subscriptions): Once Founder Access launches, purchases, recurring billing, and subscription management will be handled by Xsolla. Xsolla will collect and process your payment details under its own privacy policy, and share with us the subscription and transaction information described in Section 2;
• Patreon (Optional Support): If you choose to support HeadBox on Patreon, Patreon processes your data under its own privacy policy. Patreon is not part of Founder Access, and we receive only the information Patreon makes available to creators about their members;
• Legal & Regulatory Authorities: Where required by law, or where disclosure is necessary to protect rights, property, or safety;
• Corporate Transactions: If our business is merged, acquired, or restructured, subject to equivalent data protection commitments;
• With Your Consent: For anything not listed above.

These providers operate their own privacy policies, which we encourage you to review. This Policy does not cover third-party sites you reach by following links from HeadBox.

Some of our service providers operate outside the European Economic Area. Where your data is transferred outside the EEA, we rely on one of the following safeguards:

• A European Commission adequacy decision covering the destination country;
• The European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR;
• Another lawful transfer mechanism recognised under applicable law.

You may request a copy of the safeguards that apply to your data using the contact details in Section 13.

We keep data only as long as we need it:

• Account Data: For as long as your account is open, and afterwards only for as long as needed to handle any remaining questions, disputes, or legal obligations;
• Security & Anti-Cheat Logs: For as long as needed to support security, ongoing investigations, and appeals;
• Subscription & Billing Records: For as long as your subscription is active, and afterwards for as long as required by applicable tax and accounting law;
• Support Messages: For as long as needed to resolve the matter and handle any follow-up;
• Analytics Data: For the retention period configured in Google Analytics, and no longer than necessary; aggregated statistics may be kept indefinitely.

When data is no longer needed it is securely deleted or irreversibly anonymised.

Under the GDPR you have the right to:

• Access (Art. 15): Get a copy of the data we hold about you;
• Rectification (Art. 16): Have inaccurate or incomplete data corrected;
• Erasure (Art. 17): Have your data deleted where we no longer need it;
• Restriction (Art. 18): Limit how we process your data in certain circumstances;
• Portability (Art. 20): Receive your data in a structured, machine-readable format;
• Object (Art. 21): Object to processing based on legitimate interests;
• Withdraw Consent: At any time, without affecting processing carried out beforehand;
• Complain: To a supervisory authority — the Commissioner for Personal Data Protection in Cyprus, or the data protection authority of the EU country where you live, work, or where you believe an infringement took place.

To exercise any of these rights, contact us using the details in Section 13. We respond within one month, as required by the GDPR, and may need to verify your identity first.

We use technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS);
• Passwords stored using modern one-way hashing — we never store them in plain text;
• Access controls limiting staff access to personal data on a need-to-know basis;
• Monitoring for suspicious activity and unauthorised access.

If a data breach is likely to put your rights at risk, we will notify the supervisory authority within 72 hours of becoming aware of it, and tell you directly where the risk is high. No system is completely secure — please keep your password private and tell us immediately if you suspect someone else has accessed your account.

We will update this Policy as HeadBox develops. The revision date is shown at the top of the page.

For material changes — including any that introduce new categories of data or new purposes — we will give you prominent notice before they take effect, by in-platform notification or email. Continuing to use HeadBox after a revised Policy takes effect means you acknowledge it.

For any question or request about this Policy or your data:

• Data Controller: Pascal Goedde, operating under the name “Verse Digital”, Solomou Solomou 10, Emba, Paphos 8250, Cyprus
• Privacy Enquiries: info@verse-digital.net, or through our Help Centre
• Website: verse-digital.net

We respond to requests within one month, as required by the GDPR. If you are not satisfied with our response, you may lodge a complaint with the competent supervisory authority.