RottenWorld respects your privacy.
This Privacy Policy explains how CardanFX Studios Ltd., doing business as RottenWorld ("RottenWorld," "we," "us," or "our"), collects, uses, stores, discloses, and protects personal information when you interact with RottenWorld.
This Privacy Policy applies to:
This Privacy Policy should be read together with our Terms of Use.
By using the Services, you acknowledge the practices described in this Privacy Policy.
Where applicable law requires consent for a particular processing activity, we will request that consent separately.
RottenWorld is operated by CardanFX Studios Ltd., a corporation based in Ontario, Canada.
For purposes of applicable privacy and data-protection laws, CardanFX Studios Ltd. is responsible for personal information collected and processed through RottenWorld, except where an independent third-party service provider processes information under its own legal responsibilities.
CardanFX Studios Ltd.
Ontario, Canada
Legal Address: 77 Hill Rd, Sault Ste Marie, Ontario, Canada
Privacy Officer: CardanFX Studios Ltd. Privacy Officer
Privacy Email: cardanfx@gmail.com
General support: cardanfx@gmail.com
Website: rottenworld.net
Our processing of personal information is governed primarily by Canadian federal privacy law, including the Personal Information Protection and Electronic Documents Act ("PIPEDA"), which applies to personal information collected, used, or disclosed in the course of commercial activity by an organization based in Ontario. Where other privacy laws apply to a specific individual or transaction — for example because of where you reside — we describe those additional rights later in this Policy.
The information we collect depends on how you interact with RottenWorld.
We seek to collect only information reasonably necessary for the purposes described in this Privacy Policy.
2.1 Information You Provide Directly
You may provide information to us when you:
This may include:
Identity Information
Contact Information
Supporter Information
Contact Form Information
Communications
We may retain messages, requests, emails, support inquiries, and other communications you send to us.
If you financially support RottenWorld, payment processing may be provided by Stripe or another payment processor identified at checkout.
Payment processors may collect information such as:
RottenWorld does not intend to directly store your complete credit-card or debit-card number, card security code, or equivalent full payment credentials on its own application database.
Stripe or the applicable payment processor processes payment information in accordance with its own privacy policies, security practices, and legal obligations.
RottenWorld may receive limited information about a transaction, such as:
Stripe's current privacy policy explains that transaction information may include identity, contact, payment and transaction information and that Stripe may act either as a controller or processor depending on the service involved.
When you access RottenWorld, certain technical information may be generated automatically by our website, hosting infrastructure, security systems, payment providers, or other technical service providers.
Depending on the services enabled, this information may include:
We may use this information to operate the website, detect technical issues, protect our systems, prevent abuse, understand general website performance, and improve RottenWorld.
We do not use precise GPS location through the initial RottenWorld website unless a future feature expressly requests it and provides appropriate notice.
The current RottenWorld website is not designed to intentionally collect sensitive personal information such as:
Please do not include unnecessary sensitive information in contact forms or communications with RottenWorld.
If future RottenWorld functionality requires additional categories of information, we will update our privacy disclosures and obtain any consent required by applicable law before implementing such processing.
We may use personal information for the following purposes.
6.1 Providing the Website and Services
To:
6.2 Processing Support Payments
To:
6.3 Supporter Recognition
If you choose public recognition, we may use your selected:
for RottenWorld recognition systems such as the Founders Log, Power Grid Registry, Seed Vault, Founders Wall, or similar project features.
We will respect the display preference you select where such functionality is available.
If you voluntarily provide your email address through Join the Transmission, we may use it to send you RottenWorld project communications.
These may include:
Joining the transmission list is voluntary.
Where required by law, we will obtain appropriate consent before sending marketing communications.
You may unsubscribe from promotional email communications at any time using the unsubscribe mechanism included in the email or by contacting us.
Unsubscribing from promotional messages does not necessarily prevent us from sending essential transactional, legal, security, or support communications.
Because CardanFX Studios Ltd. is based in Canada, commercial electronic messages we send — such as RottenWorld development updates — are subject to Canada's Anti-Spam Legislation ("CASL").
In accordance with CASL, we:
We keep a record of consent for each subscriber, including the date consent was given, the source of the signup, and the version of the consent language displayed at that time, so that we can demonstrate compliance with CASL if required.
If you contact RottenWorld, we may process your information to:
Contact categories may include:
Submitting a contact request does not automatically create an employment, contractor, partnership, confidential, fiduciary, or commercial relationship.
Where applicable data-protection law requires a legal basis for processing personal information, RottenWorld may rely on one or more of the following bases:
Contractual Necessity
Where processing is necessary to provide a service, process a transaction, administer support-related features, or fulfill obligations associated with your interaction with RottenWorld.
Consent
Where you have voluntarily consented to a particular activity, such as certain marketing communications or non-essential technologies.
Where processing depends upon consent, you may withdraw that consent subject to applicable law.
Withdrawal does not affect the lawfulness of processing performed before withdrawal.
Legitimate Interests
Where processing is reasonably necessary for interests such as:
provided those interests are not overridden by your applicable privacy rights.
Legal Obligations
Where processing is necessary to comply with:
The appropriate legal basis may vary depending on your jurisdiction and the particular processing activity.
RottenWorld may use Supabase to provide database, authentication, storage, server, or application infrastructure.
Information stored through Supabase may include, depending on the RottenWorld feature involved:
Supabase may process such data on our behalf pursuant to applicable contractual and data-protection obligations.
Supabase's Data Processing Addendum addresses confidentiality, access restrictions, security obligations, and data-subject rights in connection with covered data.
Engaging Stripe, Supabase, or any other third-party processor does not transfer our responsibility for your personal information. Under PIPEDA's accountability principle, CardanFX Studios Ltd. remains responsible for personal information under its control, including information transferred to a third party for processing, and we use contractual and other means to require a comparable level of protection from our processors.
RottenWorld may use infrastructure providers such as Vercel, Supabase, content-delivery networks, domain providers, security services, and similar technology providers.
These providers may process technical data required to:
Technical logs may therefore be processed by infrastructure providers even when you do not submit a form.
RottenWorld may use cookies, local storage, pixels, server-side identifiers, and similar technologies where necessary to operate or secure the Services.
These technologies may be used for purposes such as:
Some third-party services, including payment processors, may place or access their own cookies or similar technologies according to their own policies.
At the initial stage of RottenWorld, we intend to minimize tracking technologies.
If we later introduce non-essential analytics, advertising pixels, behavioral advertising, retargeting systems, or similar tracking technologies, we will update this Privacy Policy and implement consent or opt-out mechanisms where required by applicable law.
This may include technologies from providers such as analytics or advertising platforms.
We will not treat consent to non-essential tracking as mandatory where applicable law requires users to be given a choice.
RottenWorld does not currently sell personal information for monetary consideration.
We also do not currently use personal information collected through RottenWorld to provide third parties with cross-context behavioral advertising.
If our practices materially change, we will update this Privacy Policy and provide applicable privacy choices before or when required by law.
We do not disclose personal information indiscriminately.
We may disclose information to the following categories of recipients when reasonably necessary.
Service Providers
Providers helping us operate RottenWorld, such as:
These providers receive only information reasonably necessary for their role, subject to their contractual and legal obligations.
Payment Networks and Financial Institutions
Information may be shared as necessary to process payments, authenticate transactions, prevent fraud, issue refunds, or manage payment disputes.
Professional Advisers
Information may be disclosed to attorneys, accountants, auditors, insurers, or other professional advisers where reasonably necessary.
Legal Requirements
We may disclose information if reasonably necessary to:
If RottenWorld or its operating entity becomes involved in a:
personal information may be disclosed or transferred as part of that transaction, subject to applicable law.
Where legally required, affected users will be notified of material changes affecting the responsible entity or treatment of their personal information.
RottenWorld may use service providers located in countries different from the country in which you live.
As a result, personal information may be processed in:
Privacy laws in those countries may differ from those in your jurisdiction.
Where applicable law requires safeguards for international transfers, we will use legally recognized mechanisms such as contractual safeguards or other lawful transfer mechanisms.
The GDPR, for example, requires users to be informed when their personal data may be transferred outside the EU/EEA and about the applicable protections.
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and as required by applicable legal, accounting, security, tax, or regulatory requirements.
Retention periods may differ depending on the category of information.
As a general policy:
Transmission List
Email subscription information may be retained until you unsubscribe or request deletion, subject to limited records necessary to ensure that an unsubscribe request continues to be honored.
Contact Requests
Contact communications may generally be retained for up to 24 months after the last meaningful interaction unless a longer period is reasonably necessary because of an active relationship, dispute, legal obligation, or legitimate business need.
Supporter Records
Supporter records and Signal Number records may be retained for the duration of the RottenWorld project or longer where necessary to preserve the historical recognition requested by the supporter.
If you request deletion of personal information connected with a permanent public recognition record, we may remove or anonymize identifying information while retaining a non-identifying Signal Number or transaction record where necessary.
Financial and Transaction Records
Information required for accounting, taxation, fraud prevention, payment disputes, or legal compliance may be retained for the applicable statutory retention period.
Security and Technical Records
Technical and security logs are generally retained only for the period reasonably necessary for security, troubleshooting, fraud prevention, and infrastructure operation.
Some information may remain temporarily in backups after deletion from active systems.
We may also retain information where reasonably necessary to establish, exercise, or defend legal claims.
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against:
Measures may include, where appropriate:
No system connected to the Internet can be guaranteed to be completely secure.
The Mexican LFPDPPP expressly requires responsible parties to maintain administrative, technical, and physical security measures appropriate to risk, sensitivity, consequences for individuals, and technological development.
If we become aware of a personal-data security incident, we will investigate it and take actions reasonably appropriate under the circumstances, and we keep an internal record of security incidents, including those that do not require notification, for at least 24 months.
Under PIPEDA, we will report a breach of security safeguards to the Office of the Privacy Commissioner of Canada, and notify affected individuals, where it is reasonable in the circumstances to believe the breach creates a real risk of significant harm.
Where other applicable law requires notification to affected individuals, regulators, or other authorities, we will provide such notification in accordance with those requirements.
Depending on where you live, you may have rights concerning personal information we hold about you.
These may include rights to:
Not every right applies in every jurisdiction or circumstance — see the jurisdiction-specific sections below.
We will not unlawfully discriminate against you for exercising applicable privacy rights.
CardanFX Studios Ltd. handles personal information in accordance with applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act ("PIPEDA") where applicable.
Under PIPEDA, individuals may have the right to:
Requests should be sent to:
Privacy Officer
CardanFX Studios Ltd.
cardanfx@gmail.com
We may take reasonable steps to verify your identity before providing access to personal information.
We will respond to valid access requests within the time required by applicable law. Under PIPEDA, access requests are generally required to be answered within 30 days, subject to a permitted extension where we notify you of the extension and the reason for it.
To exercise an applicable privacy right, contact our Privacy Officer at: cardanfx@gmail.com
Use the subject: Privacy Request — RottenWorld
Your request should provide enough information for us to understand and verify the request, which may include:
Do not send passwords, complete payment-card numbers, or unnecessary identity documents by ordinary email.
We may request additional information if reasonably necessary to verify your identity and protect personal information against unauthorized requests.
An authorized representative may make a request where permitted by applicable law, subject to appropriate verification of authority.
Internally, every privacy request is logged with a received date, a due date, and a status, and is worked through the following process: verify requester → locate data across our systems (transmission subscribers, contact submissions, supporter records, Signal records, and relevant Stripe transaction references) → access, correct, delete, restrict, or process the withdrawal of consent as applicable → respond → record the resolution.
Where Mexican data-protection law applies to our processing of your personal information, you may have rights of Access, Rectification, Cancellation, and Opposition ("ARCO"), as well as other rights provided by applicable Mexican law. Requests may be submitted to our Privacy Officer using the contact information provided in this Privacy Policy, and we will process them according to the procedure and deadlines required by the applicable Mexican law in effect at that time.
Where GDPR, UK GDPR, or comparable legislation applies, you may have additional rights, including:
You may also have the right to submit a complaint to the data-protection authority responsible for your jurisdiction.
The European Commission identifies these rights and requires organizations to disclose, among other things, processing purposes, legal bases, retention, recipients and international transfers.
Residents of certain U.S. states may have additional privacy rights under applicable state law.
Depending on the jurisdiction and whether the applicable statutory requirements apply to RottenWorld, these rights may include:
California law, where applicable, recognizes rights including access/knowledge, deletion, correction, opt-out of sale or sharing, limitation of certain sensitive-information uses, and non-discrimination.
RottenWorld does not currently sell personal information or share personal information for cross-context behavioral advertising as those terms are commonly used under California privacy law.
If RottenWorld later engages in processing for which applicable law requires honoring browser-based opt-out preference signals, we will implement appropriate mechanisms, including recognition of legally required signals such as Global Privacy Control (GPC) where applicable.
California privacy guidance expressly recognizes the right to opt out of sale or sharing, including through GPC where applicable.
At present, RottenWorld does not sell personal information or use the initial website for cross-context behavioral advertising.
RottenWorld does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects concerning users.
Systems may automatically perform operational functions such as:
Some of these functions may be provided by third-party providers such as payment processors.
If we later introduce automated decision-making subject to specific legal requirements, we will provide appropriate disclosures and rights.
RottenWorld's initial Services are not directed specifically toward children under the age of 13.
We do not knowingly seek to collect personal information directly from children under 13 through the initial website without legally appropriate authorization.
Users who are below the age at which they can independently consent to the relevant processing or enter into a transaction should involve a parent or legal guardian.
If you believe a child has provided personal information to RottenWorld improperly, contact: cardanfx@gmail.com
We will investigate and take appropriate action.
Future game services may have separate age requirements, parental-control features, and privacy notices.
Some RottenWorld features may allow supporters to request public recognition.
If you affirmatively choose a public name or alias, that information may be visible to anyone and could potentially be:
We therefore recommend using an alias if you do not want your legal name connected publicly with RottenWorld.
Selecting Anonymous means we will not intentionally publicly display your name as part of that supporter recognition.
Transaction records may still need to be retained privately where legally required.
RottenWorld may assign supporters an identifier such as: SIGNAL #000041
A Signal Number may be associated internally with supporter records necessary to administer the system.
A publicly displayed Signal Number does not need to identify the supporter's legal identity.
If a supporter requests removal of their public name, RottenWorld may retain the non-identifying Signal Number for historical integrity while removing or anonymizing the associated public personal information where appropriate.
RottenWorld may link to platforms such as:
When you leave RottenWorld and interact with another platform, that provider's own privacy policy governs its processing.
RottenWorld does not control the privacy practices of independent third-party platforms.
The Services may contain links to websites or services not controlled by RottenWorld.
This Privacy Policy applies only to processing under RottenWorld's responsibility.
We encourage you to review the privacy practices of any third-party service before providing information to it.
Some browsers provide a "Do Not Track" setting.
Because there is not a single globally applicable technical or legal standard governing all Do Not Track signals, the Services may not respond uniformly to traditional Do Not Track settings.
Where applicable law requires recognition of a legally defined opt-out mechanism such as Global Privacy Control, we will handle such signals as required.
RottenWorld is an evolving project.
We may update this Privacy Policy as:
When this Privacy Policy changes, we will update the Last Updated date displayed at the beginning.
If a change materially affects how we use personal information previously collected, we will provide additional notice or obtain consent where required by applicable law.
We will not retroactively rely upon this section to authorize materially incompatible processing where applicable law requires additional notice or consent.
You may contact us to request limitations on certain uses or disclosures of your personal information where such rights are available.
You may also:
Requests may be sent to: cardanfx@gmail.com
We take reasonable steps to maintain personal information in a form that is accurate and appropriate for the purposes for which it is processed.
You may contact us if your information changes or if you believe information we maintain about you is incorrect.
RottenWorld intends to collect only information reasonably necessary for specified purposes.
We do not intend to create extensive personal profiles merely because an individual visits RottenWorld.
The GDPR similarly incorporates purpose limitation, data minimization, storage limitation, accuracy, security, transparency, and accountability as core processing principles.
As RottenWorld evolves from a development website into a playable experience, additional functionality may require additional privacy disclosures.
Examples could include future:
This Privacy Policy does not mean that RottenWorld currently collects all of those categories of information.
If those features are introduced, we will evaluate the associated privacy implications and update our disclosures before or when required.
Questions regarding privacy or this Privacy Policy may be directed to:
RottenWorld
Operated by: CardanFX Studios Ltd.
Address: 77 Hill Rd, Sault Ste Marie, Ontario, Canada
Privacy: cardanfx@gmail.com
Support: cardanfx@gmail.com
Website: rottenworld.net
Privacy requests should preferably include the subject: Privacy Request — RottenWorld
SUMMARY OF CURRENT ROTTENWORLD DATA PRACTICES
At the current development stage, RottenWorld is designed around a relatively limited amount of personal information. Visitors can generally view the core RottenWorld website without creating an account. Personal information is primarily collected when a visitor voluntarily joins the transmission list, contacts the project, supports the project, selects supporter recognition, or communicates directly with RottenWorld.
Payment credentials are processed through the applicable payment provider rather than intentionally stored as complete card credentials in the RottenWorld application database.
RottenWorld does not currently sell personal information.
RottenWorld does not currently operate a behavioral advertising marketplace.
RottenWorld does not currently connect Support Payments to ownership, investments, Survivors, or rooms.
As RottenWorld evolves, this Privacy Policy will evolve with it.
THIS WORLD STARTS WITH YOU.