1. Overview
This Policy explains what personal data BRIGHT SALE MEDIA SL collects when you use Heartvale, the websites heartvalefarm.com and play.heartvalefarm.com and our support, why we collect it, how long we keep it and what rights you have. We process personal data under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).
We do not sell your personal data and we do not use it for third‑party advertising.
2. Data controller
BRIGHT SALE MEDIA SL · NIF B27671619 · C/ Delfín 8, Urbanización Torre de la Horadada, Pilar de la Horadada, 03191 Alicante, Spain · support@heartvalefarm.com. We have not appointed a data protection officer; privacy questions go to the same address.
3. What we collect
- Account data — your email address, a user ID, the one‑time sign‑in codes we send you (or a password, for test accounts only), sign‑in dates and the account status.
- Game data — your farm save: progress, quests, land, buildings, crops, animals, machines, inventory, wardrobe, Coins and Golden Grain balances, market listings and sales, settings. The save is stored on our servers so that it follows you between devices.
- Transaction data — Golden Grain purchases and spending, the in‑game ledger, order and listing history. When real payments are enabled: the amount, currency, date, payment reference and the last digits and brand of the card. We never store full card numbers; they go directly to the payment service provider.
- Support data — the content of messages you send to support@heartvalefarm.com and our replies.
- Technical data — IP address, browser and device type, operating system, language, screen size, time zone, server logs, error reports and the identifiers kept in your browser's local storage (see the Cookie Policy).
- Security and anti‑fraud data — signals that help us detect bots, exploits, multiple accounts and payment abuse.
- Launch‑notice email — if you typed your email into the launch‑notice field on heartvalefarm.com, that address, for one announcement only.
4. How we collect it
Directly from you (sign‑in, play, purchases, support messages); automatically from your browser and our servers while you use the Platform; and from service providers (for example a payment provider confirming a payment or an email provider reporting that a message could not be delivered).
5. Why we process it and on what legal basis
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Creating and running your account, saving and syncing your farm | account, game, technical | contract (Art. 6(1)(b)) |
| Selling and delivering Golden Grain, keeping accounting records | transaction, account | contract; legal obligation (Art. 6(1)(c)) |
| Sending the sign‑in code, the welcome letter and purchase confirmations | account, transaction | contract |
| Answering your support requests | support, account | contract; legitimate interests |
| Preventing fraud, bots, exploits and abuse; enforcing the Terms | security, technical, transaction | legitimate interests (Art. 6(1)(f)); legal obligation |
| Keeping the Platform secure and fixing errors | technical | legitimate interests |
| Improving the game from aggregated play statistics | game, technical | legitimate interests; no profiling, no advertising |
| Sending a one‑off launch announcement | launch‑notice email | consent (Art. 6(1)(a)) |
| Meeting legal, tax and consumer‑protection obligations | transaction, account, support | legal obligation |
Service messages (sign‑in codes, purchase confirmations, security and policy notices) are part of running the service. We do not send marketing newsletters. If that changes, marketing messages will be sent only with your consent and with an unsubscribe link in every message.
6. Required and optional data
Without an email address there is no account and no cloud save. Without payment data there are no purchases. Everything else is optional or collected automatically as part of running the service.
7. Cookies and local storage
The game stores its settings, your save and your sign‑in session in your browser's local storage. The website and the game use a small number of strictly necessary cookies and, only if you accept, analytics cookies; the choice is remembered for both. Details, names and durations are in the Cookie Policy.
8. Who we share data with
We share personal data only with providers who process it on our documented instructions under data processing agreements, and with authorities where the law requires it:
- Database and sign‑in: Supabase (account, game and transaction data; sign‑in codes).
- Hosting and content delivery: Vercel and Cloudflare (technical data, server logs).
- Email delivery: Resend (your email address and the content of the letters we send you).
- Visit statistics: Google (Google Ireland Ltd / Google LLC) through Google Analytics 4, and only if you accept analytics: technical data and a randomly generated identifier, never your email address or your account data.
- Payment processing: payment service providers named at checkout, banks and card networks (payment data). Currently no real payments are taken.
- Professional advisers, auditors, insurers and public authorities where required.
- A successor of our business, in case of a merger or sale, under the same protections.
We do not share personal data with advertising networks or data brokers.
9. International transfers
Our providers may process data outside the European Economic Area, in particular in the United States. Where that happens we rely on an adequacy decision of the European Commission (including the EU‑US Data Privacy Framework for certified providers) or on the Standard Contractual Clauses approved by the Commission, with supplementary measures where needed. You can ask us for details at support@heartvalefarm.com.
10. How long we keep data
- Account and game data: while the account exists and for up to 90 days after you ask us to close it, so that an accidental closure can be undone; then deleted or anonymised.
- Purchase and accounting records: 6 years from the end of the financial year (Article 30 of the Spanish Commercial Code) and 4 years for tax purposes (Article 66 of the General Tax Act), whichever is longer.
- Support messages: up to 2 years after the last message, or longer while a dispute is open.
- Server and security logs: up to 12 months.
- Launch‑notice email: deleted after the announcement is sent, or earlier on request.
11. Security
All traffic is encrypted (HTTPS). Access to data is limited to the people and systems that need it, protected by access controls and logging. Sign‑in uses one‑time codes so that no password of yours is stored. Our providers are chosen with security in mind and are bound by data processing agreements.
12. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to processing (including any direct marketing), to data portability, and to withdraw consent at any time where processing is based on consent. Write to support@heartvalefarm.com from the email address of your account; we may ask you to confirm your identity. We answer within one month, extendable by two months for complex requests, and we will tell you if that happens.
13. Automated decisions
We use automated tools to detect bots, exploits and payment abuse. No decision with legal or similarly significant effects on you is taken solely by automated means without human review; you can always contest such a decision at support@heartvalefarm.com.
14. Children
Heartvale is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it.
15. Supervisory authority
You can lodge a complaint with the Spanish data protection authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, https://www.aepd.es — or with the data protection authority of the country where you live.
16. Changes to this Policy
The current version is always available at play.heartvalefarm.com/legal/privacy.html. Material changes will be announced on the Platform or by email before they take effect.
17. Contact
BRIGHT SALE MEDIA SL · C/ Delfín 8, Urbanización Torre de la Horadada, Pilar de la Horadada, 03191 Alicante, Spain · support@heartvalefarm.com