Privacy Policy — Mars Directive

This Policy explains how we handle personal data when you play Mars Directive (the “Game”).

1. Who is responsible for your data¶

Blackdeep Technologies Ltd (developer, Bulgaria) and Cortextual AI LLC (publisher, United States) operate the Game as joint controllers under Article 26 GDPR. Their addresses are in §15. You can contact either company to exercise your rights. Our shared contact is support@blackdeep.tech; §14 explains our responsibilities.

2. The short version¶

• Characters are AI. Your messages and voice transcripts are stored on our servers and linked to your account. AI providers process your input to generate dialogue and speech.
• Voice input is sent for transcription. We do not retain your voice recordings, but keep the resulting text.
• Our storage is in Germany. AI processing involves transfers to the United States and may occur in other countries (§6).
• We do not sell your data, use it for advertising, or train our own AI models on it (§4.2).
• Email support@blackdeep.tech to access or delete your data.

3. What we collect¶

3.1 Account and identity data¶

We receive account identifiers and profile information from Steam, including your Steam ID, display name and avatar. If you link Discord, we also receive your Discord ID, username, avatar and email address. We maintain your account creation date, credit balance and game progress.

We do not request your Steam or Discord password, payment-card details, real name, postal address, date of birth or precise location through the Game. You may nevertheless disclose personal information in conversation; see §3.2 and Terms of Use §4.5.

3.2 Conversation and gameplay data¶

We store the full text of your messages, voice transcripts and AI character responses, together with session and message information such as characters, timestamps, credit use and diagnostic information. This history is linked to your Steam and/or Discord account; it is not anonymous. It supports character memory, credit accounting, fault investigation and abuse prevention.

We also cache generated character speech and its source text in a shared cache, without an account identifier. A character may repeat personal information you supplied; see §7 for deletion.

3.3 Voice data¶

When you use voice input, we capture microphone audio for your utterance and send it to Google for transcription. We discard the recording immediately after transcription and retain only the text. We do not use your voice to identify you or create voiceprints or other biometric identifiers.

3.4 Technical data¶

We process IP addresses, sign-in tokens and server logs to keep you signed in, diagnose faults and protect the service. IP addresses are used transiently for rate limiting and in short-lived logs; they are not stored against your account.

3.5 What we do not collect¶

We do not collect advertising identifiers or social-graph data, use third-party analytics or telemetry SDKs, track you across sites, or profile you for marketing.

4. Why we process it, and our legal basis¶

4.1 Running the Game¶

You can object to processing based on legitimate interests (§9).

4.2 We do not train AI on your conversations¶

We do not use your conversations, voice transcripts or voice audio to train, fine-tune or evaluate our own AI models. We do not sell or share them for anyone else’s model training either. The restrictions that stop our AI providers training on them are in §5.

If we ever want to change this, we will ask you first and you will be free to refuse. It would never happen automatically, and never as a condition of playing.

5. AI providers and who we share data with¶

Google, ElevenLabs and AWS act as our processors, handling data on our instructions and contractually restricted from using it for their own purposes. Steam and Discord are independent controllers with their own policies.

We use Gemini’s paid tier, under which Google does not use prompts or responses to improve its products. We have opted out of ElevenLabs’ content use for service improvement, and our data processing agreement restricts it to our instructions. These restrictions also cover personal information repeated in generated character dialogue.

We may disclose relevant data to professional advisers, authorities where legally required, or to establish or defend claims. In a merger, acquisition or asset sale, data may pass to an acquirer bound by this Policy or who gives notice of changes.

We will update this provider table and the “Last updated” date before a new AI provider starts processing your data. We do not sell your data.

6. Where your data is stored, and international transfers¶

Our account data, conversation history and cached character audio are stored with AWS in Frankfurt, Germany. Only Blackdeep personnel access player data when operating the Game.

AI processing involves transfers to the United States. We use Google and ElevenLabs’ standard global services. Google receives your input and recent history; ElevenLabs receives generated dialogue. Google’s terms permit transient storage or caching wherever Google or its agents have facilities. We cannot confine this processing to the EU.

Transfers rely on the European Commission’s Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified, with supplementary measures including encryption in transit. The UK International Data Transfer Addendum applies to UK players. Request a copy of the relevant safeguards at support@blackdeep.tech.

7. How long we keep it¶

Account deletion: email support@blackdeep.tech. Within 30 days, we remove your account and identifiers, conversations, transcripts, session records and credit records, except information needed for a legal obligation or claim. You can also request deletion of conversation history without closing your account.

Shared speech cache: account deletion does not automatically remove cached character dialogue. Entries are identified by their dialogue text, have no account identifier and are shared between players, so we cannot identify them from your account. If a cached line reproduces personal information about you, contact us and we will remove that entry.

8. How we protect it¶

We encrypt traffic between the Game and our servers and restrict production-data access to authorised personnel who need it. Stored data is access-controlled; passwords, where used, are salted and hashed. No system is perfectly secure.

For a personal data breach, we notify the competent authority without undue delay and, where feasible, within 72 hours of awareness, unless risk to your rights and freedoms is unlikely. We also notify you without undue delay if that risk is high.

9. Your rights¶

9.1 EEA, UK and Switzerland¶

You may request access, correction, erasure, restriction and portability; object to processing, including legitimate-interest processing; and withdraw consent without affecting earlier lawful processing. You can exercise your rights against either joint controller.

We do not make solely automated decisions about you with legal or similarly significant effects. You can complain to your local supervisory authority or the Bulgarian Commission for Personal Data Protection, the authority for our EU establishment.

9.2 California (CCPA/CPRA)¶

In the 12 months before this Policy’s date, we collected the categories in §3: identifiers, internet and network activity, audio and electronic information, and other information you choose to disclose in conversations. Sources, purposes and recipients are described in §§3–5.

You may request to know, delete or correct your information, and limit use of sensitive personal information. You may use an authorised agent. We do not sell or share personal information as those terms are defined by the CPRA, and have not done so in the preceding 12 months. We do not knowingly sell information of consumers under 16 or discriminate for exercising privacy rights.

9.3 Other U.S. states¶

Applicable state laws provide rights that may include access, correction, deletion, portability, and opting out of targeted advertising, sale or profiling. We do not conduct those activities. Where your state provides an appeal process for a refused request, we will explain how to appeal.

9.4 How to exercise your rights¶

Email support@blackdeep.tech with your request. If you linked Discord, using its email address helps us verify you. For Steam-only accounts, use any email address you control and provide your in-Game name and, if available, Steam ID; we will ask you to confirm ownership through Steam. We will not refuse a request because we do not already hold your email address.

We respond within one month. For complex or numerous requests, we may extend this by two months, informing you within the first month. Account deletion follows the 30-day commitment in §7. Requests are free unless manifestly unfounded or excessive.

10. Children¶

The Game is not intended for children under 13, or under 16 in the EEA, UK and Switzerland where a lower national digital-consent age does not apply. Steam access is required and is subject to Valve’s age requirements. We do not knowingly collect data from children below the applicable age. Parents or guardians can contact support@blackdeep.tech for prompt account and data deletion.

11. Automated and AI-generated content notice¶

In line with Article 50 of the EU AI Act, the characters are AI systems. Their dialogue, speech and behaviour are machine-generated; you are not communicating with a human during gameplay.

12. Territorial availability¶

The Game is unavailable in the territories listed in Terms of Use §2.

13. Changes to this Policy¶

We update the “Last updated” date when this Policy changes. For material changes, we notify you in-Game or through a Steam announcement before they take effect, and request consent where required.

14. Our joint-controller arrangement (Article 26(2) GDPR)¶

This is the essence of our arrangement:

• Blackdeep operates servers, databases and AI integrations, contracts with AI providers, and manages security. Only its personnel access player data. It monitors our shared support address and takes primary responsibility for rights requests and breach notifications.
• Cortextual publishes the Game, contracts with players, holds the cloud hosting account, and takes responsibility for accurate player-facing information, including this Policy.
• Both companies determine why data is processed and what is collected, and share responsibility for this Policy. Your rights apply against either company, regardless of this allocation.

Request deadlines run from receipt of your message, and each company remains accountable under applicable data protection law.

15. Contact¶

For support, account and privacy requests to either company: support@blackdeep.tech.

Blackdeep Technologies Ltd — Sofia 1, Varna 9000, Bulgaria.

Cortextual AI LLC — 21208 Harbor Way, Apt 138, Miami, FL 33180, United States.