privacy

draft — official text pending review by whitebox, inc.

1. Introduction

This Privacy Policy describes how WHITEBOX, INC., INC (“Saga,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects your personal information when you access or use the Saga mobile application, website, and all related services (collectively, the “Service”).

For purposes of applicable data protection law (including the GDPR and UK GDPR), Saga is the data controller responsible for your personal information. This means we determine the purposes and means of processing your personal data.

This Privacy Policy is incorporated into and subject to our Terms and Conditions. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, do not use the Service.

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or email at least fourteen (14) days before taking effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily provide, including:

• Account information: name, phone number, email address, username, password, date of birth, and profile photo.
• Profile information: bio, interests, and other details you choose to add.
• User Content: comments, messages, story choices, and other content you submit through the Service.
• Communications: correspondence with our support team, feedback, and survey responses.
• Payment information: purchase history and subscription details. Payment credentials (e.g., credit card numbers) are processed directly by the applicable app store (Apple App Store, Google Play Store) and are not stored by Saga.

2.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Device information: device type, operating system, unique device identifiers, browser type, and language settings.
• Usage data: pages viewed, features used, actions taken, time spent, frequency of use, and interaction patterns.
• Story interaction data: choices made at decision points, choice timing, story completion rates, and engagement patterns with interactive content.
• Log data: IP address, access times, referring URLs, and crash reports.
• Location data: approximate location derived from IP address. Precise location data is collected only if you enable location-based features on your device.

2.3 Information from Third Parties

We may receive information from:

• Social login providers: if you sign up or log in using a third-party account (e.g., Google, Apple), we receive basic profile information as authorized by you.
• App stores: purchase and subscription data from Apple or Google.
• Analytics providers: aggregated usage data from third-party analytics services.
• Advertising partners: identifiers and interaction data for ad measurement and attribution.

3. How We Use Your Information

We use collected information for the following purposes:

3.1 Providing and Operating the Service

• Create and manage your account.
• Deliver interactive content and enable story participation.
• Process story choices, tally collective decisions, and determine narrative outcomes.
• Facilitate social features including messaging, commenting, and following.
• Process transactions and manage subscriptions.

3.2 Personalization and Recommendations

• Personalize your experience, including content recommendations and story suggestions.
• Customize content visibility, featured placement, and rankings based on engagement data and algorithmic systems.
• Adapt the Service to your preferences and usage patterns.

3.3 Machine Learning and AI Development

We use your User Content, interaction data, choice patterns, and engagement signals to train, develop, and improve machine learning models, artificial intelligence systems, recommendation algorithms, and other automated systems. This includes using your data as training data for models that power content recommendations, story generation, moderation tools, and other Service features. This use is consistent with the license you grant in Section 9.1 of our Terms and Conditions.

3.4 Marketing and Advertising

• Send promotional communications (with your consent where required by law).
• Display advertising and sponsored content within the Service.
• Measure ad effectiveness and attribution.
• Use User Content in marketing materials, advertising, and promotional campaigns across any media format, as described in our Terms and Conditions.

3.5 Safety, Security, and Compliance

• Detect, prevent, and address fraud, abuse, security threats, and technical issues.
• Enforce our Terms and Conditions and Community Guidelines.
• Comply with legal obligations, including responses to lawful requests from law enforcement and government authorities.
• Preserve data for investigations as described in our Terms and Conditions.

3.6 Analytics and Improvement

• Analyze usage patterns and trends to improve the Service.
• Conduct research and development.
• Test new features and functionality.

4. How We Share Your Information

We do not sell your personal information in the traditional sense. We may share your information in the following circumstances:

4.1 With Other Users

Information you make public—such as your profile, username, comments, and story choices—is visible to other users of the Service. Direct messages are visible only to the intended recipients, though they may be reviewed for safety and moderation purposes.

4.2 With Service Providers

We share information with third-party vendors who perform services on our behalf, including hosting, analytics, customer support, payment processing, and content delivery. These providers are contractually obligated to use your information only as necessary to provide services to Saga and are bound by confidentiality obligations.

4.3 For Legal and Safety Purposes

We may disclose your information when we believe in good faith that disclosure is necessary to: (i) comply with applicable law, regulation, or legal process; (ii) respond to lawful requests from law enforcement or government authorities; (iii) protect the safety of any person; (iv) address fraud, security, or technical issues; or (v) protect Saga’s rights, property, or safety. We may preserve data for investigations as described in our Terms and Conditions.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of Saga’s assets, your information may be transferred to the acquiring entity. All licenses granted to Saga under the Terms and Conditions shall continue in full force and effect in connection with such transactions and shall insure to the benefit of Saga’s successors and assigns.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

4.6 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. This data may be used for analytics, research, marketing, and other business purposes without restriction.

5. Cookies and Tracking Technologies

We and our third-party partners use cookies, pixels, SDKs, and similar tracking technologies to collect usage information, remember your preferences, and deliver targeted advertising.

5.1 Types of Tracking Technologies

• Essential cookies: required for the Service to function (e.g., authentication, security).
• Analytics cookies: help us understand how you use the Service (e.g., pages visited, features used).
• Advertising cookies: used to deliver relevant ads and measure campaign effectiveness.
• Mobile SDKs: embedded in the app to collect usage data and enable analytics and advertising.

5.2 Your Choices

You can manage cookie preferences through your browser or device settings. Disabling certain cookies may affect functionality. For mobile advertising, you can limit ad tracking through your device’s operating system settings (e.g., “Limit Ad Tracking” on iOS, “Opt Out of Ads Personalization” on Android).

Where required by law, we will obtain your consent before placing non-essential cookies or tracking technologies.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. After account deletion, we retain information as follows:

• Public-facing content: removed from public areas within thirty (30) days, subject to the exceptions in Section 11.3 of our Terms and Conditions.
• Account and interaction data: retained for up to thirty-six (36) months after account deletion to comply with legal obligations, resolve disputes, and enforce agreements, unless a longer retention period is required by law.
• Anonymized and aggregated data: retained indefinitely for analytics, research, and product improvement. Once data is irreversibly anonymized, it is no longer considered personal information under applicable law.
• Backup systems: copies may persist in backup and archival systems for up to ninety (90) days following deletion from primary systems.
• AI and ML training data: User Content and interaction data incorporated into machine learning training datasets may persist in those datasets even after account deletion, as such data cannot be practically extracted from trained models. This is consistent with the surviving license in Section 9.1 of our Terms and Conditions.

We will delete or anonymize your personal information when it is no longer needed for the purposes described above, unless a longer retention period is required or permitted by law.

7. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, alteration, and destruction. These measures include encryption in transit and at rest, access controls, regular security assessments, and incident response procedures.

However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity under your account.

8. Children’s Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete that information as quickly as possible in compliance with the Children’s Online Privacy Protection Act (COPPA).

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at saaim@playingsaga.com so we can take appropriate action.

For users between 13 and 17, we encourage parents and guardians to review this Privacy Policy together with their children and to monitor their use of the Service.

9. Your Rights and Choices

9.1 All Users

Regardless of your location, you can:

• Access and update your account information through app settings.
• Delete your account through app settings or by contacting saaim@playingsaga.com.
• Opt out of promotional communications by using the unsubscribe link in emails or adjusting notification settings.
• Disable location services through your device settings.
• Manage cookie and tracking preferences as described in Section 5.

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected, the sources of collection, the purposes for collection, and the third parties with whom we share it.
• Right to delete: request deletion of your personal information, subject to certain exceptions.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale/sharing: direct us not to sell or share your personal information for cross-context behavioral advertising. We do not sell personal information in the traditional sense, but certain data sharing with advertising partners may constitute a “sale” or “sharing” under the CCPA/CPRA.
• Right to limit use of sensitive personal information: direct us to limit the use of sensitive personal information to purposes necessary to provide the Service.
• Right to non-discrimination: we will not discriminate against you for exercising your rights.

To exercise these rights, contact us at saaim@playingsaga.com. You may also exercise your right to opt out of sale/sharing by using the “Do Not Sell or Share My Personal Information” link accessible in the app settings menu and at playingsaga.com. We will verify your identity before processing requests. You may designate an authorized agent to make requests on your behalf.

Categories of personal information collected, disclosed, and the purposes for processing are detailed in Sections 2 and 3 of this Privacy Policy.

9.3 EEA, UK, and Swiss Residents (GDPR / UK GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Right of access: obtain confirmation of whether we process your personal data and request a copy.
• Right to rectification: request correction of inaccurate or incomplete personal data.
• Right to erasure (“right to be forgotten”): request deletion of your personal data in certain circumstances.
• Right to restriction of processing: request that we limit processing of your personal data in certain circumstances.
• Right to data portability: receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object: object to processing of your personal data based on legitimate interests, including profiling.
• Rights related to automated decision-making: not be subject to decisions based solely on automated processing that produce legal or similarly significant effects, subject to certain exceptions.
• Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact us at saaim@playingsaga.com. You also have the right to lodge a complaint with your local supervisory authority.

9.4 Legal Basis for Processing (EEA/UK)

We process personal data on the following legal bases:

• Contract: processing necessary to perform our contract with you (i.e., the Terms and Conditions).
• Legitimate interests: processing necessary for our legitimate business interests, including operating and improving the Service, ensuring safety and security, preventing fraud, and conducting analytics and research, where those interests are not overridden by your rights.
• Consent: where you have given explicit consent to processing for a specific purpose, such as receiving marketing communications or enabling location-based features.
• Legal obligation: processing necessary to comply with applicable law.

10. International Data Transfers

Saga is based in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the United States and potentially other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

Where required by applicable law, we implement appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission, the UK International Data Transfer Agreement, or other legally recognized transfer mechanisms.

By using the Service, you acknowledge and consent to the transfer and processing of your information in the United States and other jurisdictions as described in this Privacy Policy.

11. Third-Party Links and Services

The Service may contain links to third-party websites, apps, or services that are not operated or controlled by Saga. This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party services you access. Saga is not responsible for the privacy practices or content of third parties.

12. Do Not Track Signals

Some browsers transmit “Do Not Track” (DNT) signals. There is currently no industry standard for how companies should respond to DNT signals. At this time, the Service does not respond to DNT signals. We will update this policy if and when a standard is established.

13. EU Digital Services Act Disclosures

To the extent Saga is subject to the EU Digital Services Act (DSA), we provide the following disclosures:

• Content moderation: we employ a combination of automated tools and human review to moderate content. Details are available in our Community Guidelines and Terms and Conditions.
• Recommender systems: the Service uses algorithmic recommendation systems to personalize content, determine story visibility, and rank interactive experiences. These systems consider factors including engagement data, choice patterns, recency, and user preferences. Users may have options to adjust recommendation preferences in app settings.
• Advertising transparency: where ads are displayed, we will clearly identify them as such and provide information about why an ad was shown, as required by applicable law.
• Reporting and complaints: users can report content and submit complaints through the mechanisms described in Section 12 of our Terms and Conditions.

14. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

WHITEBOX, INC., INC
saaim@playingsaga.com
+1 (415) 490 8270

By using Saga, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.