Privacy Policy
Last updated: 11 June 2026
This Privacy Policy explains how Visby Wild Crew AB (org. nr 559578-8430) (“we”, “us”, “our”), a Swedish limited company with its registered address at Kaungskviar 12, 622 75 Visby, Sweden, collects, uses, and protects personal data when you use Imperia Borealis (the “Game”), our websites at apparatengames.com and related subdomains, and associated services (together, the “Service”). It should be read together with our Terms of Service.
We are the data controller for the personal data described here. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish law.
1. Data We Collect
| Category | Examples |
|---|---|
| Account data | Username, email address, hashed password, account settings and preferences. |
| Gameplay data | Estates, progress, in-game actions, alliances, chat and user-generated content. |
| Purchase data | Records of purchases, package and transaction identifiers, amounts, currency, and status. We never receive or store your full card details — these are handled by our payment providers. |
| Support data | Correspondence you send us and the contents of support requests. |
| Technical data | IP address, device and browser information, session cookies, and server logs needed to operate and secure the Service. |
2. How and Why We Use Data
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and operate your account and provide the Game | Performance of a contract |
| Process and deliver purchases and keep purchase records | Contract; legal obligation (accounting) |
| Security, fraud prevention, abuse detection, and service stability | Legitimate interests |
| Service-related communications (e.g. account, security, important changes) | Contract; legitimate interests |
| Optional marketing or newsletter emails, where offered | Consent (you may withdraw at any time) |
| Improving and developing the Service | Legitimate interests |
3. Cookies and Local Storage
We use a small number of strictly necessary cookies and browser storage items to keep you signed in and to operate core features of the Game. These are essential to providing the Service you request. We do not use cookies to build advertising profiles.
4. Payments
Purchases are processed by third-party payment providers, not by us directly:
- Swish for domestic (Swedish) payments.
- Paddle.com for international card and wallet payments. Paddle acts as the Merchant of Record, meaning Paddle is the seller for those transactions and processes your payment details and tax information as an independent controller under its own buyer terms and privacy policy.
We receive only the transaction metadata needed to credit your purchase and keep accounting records (such as a transaction identifier, amount, currency, and status).
5. Who We Share Data With
We share personal data only with service providers who help us run the Service, including:
- Payment providers (Swish, Paddle) to process purchases;
- Hosting and infrastructure providers that operate our servers;
- Email delivery providers used for account and service communications.
These providers act as processors on our instructions, or (in the case of payment providers) as independent controllers for payment data. We do not sell your personal data.
6. International Transfers
We aim to keep personal data within the European Economic Area (EEA). Where a provider processes data outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.
7. How Long We Keep Data
We keep account and gameplay data for as long as your account is active and for a reasonable period afterwards. Purchase and accounting records are retained for as long as required by Swedish law (under the Bookkeeping Act, generally up to seven years). We delete or anonymise data when it is no longer needed for the purposes above.
8. Your Rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Have inaccurate data corrected;
- Request erasure of your data (“right to be forgotten”), subject to legal retention obligations;
- Restrict or object to certain processing;
- Receive your data in a portable format;
- Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, contact support@apparatengames.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
9. Children
The Service is not directed to children under 13, and you must be at least 13 to register (see our Terms of Service for full eligibility rules). We do not knowingly collect personal data from children under 13. If you believe a child has provided us data, contact us and we will delete it. Where we rely on consent and the applicable national age of digital consent under the GDPR is higher than 13 (it varies between 13 and 16 across EU member states), that consent must be given or authorised by a holder of parental responsibility.
10. How We Protect Data
We use technical and organisational measures to protect personal data, including hashed passwords, encryption of data in transit (HTTPS), and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new “Last updated” date, and material changes will be announced in-game or by email.
12. Contact
Visby Wild Crew AB (org. nr 559578-8430)
Kaungskviar 12, 622 75 Visby, Sweden
Support: support@apparatengames.com · +46 73 947 34 91