Royal Toys Privacy Policy

Introduction
Whale Played Ltd. (“Whale Played”, “we”, “our”, “us”) respects your privacy and commits to protecting your personal data under Israel's Protection of Privacy Law (PPL) and, where applicable, other data protection laws, including the  GDPR and CCPA. This Policy covers our mobile game Royal Toys and websites (the “Service”).

Whale Played Ltd. is registered in Israel, with its business address at Avital 18, Yokneam Illit, 2067018.

By using the Service, you acknowledge that your personal data will be processed as described in this Policy.

Information We Collect
From you: Username, email, support messages, in-app purchases, and game progress.

Automatically via SDKs

Device info (model, OS), IP address, advertising IDs (IDFA/AAID), gameplay data (sessions, levels, scores/achievements in Royal Toys), crash logs. Firebase collects analytics like app opens and events; Adjust tracks installs/attribution; Unity Ads/AppLovin/Facebook handle ad delivery. We do not intentionally collect special categories of personal data (such as health data or biometric data).

From platforms/third parties

Google Play, App Store data; ad networks.

How We Use Your Information

To operate, maintain and improve Royal Toys game (e.g., progress saving), analyze usage, personalize ads (where permitted by applicable law and based on your consent where required), communicate with users, prevent fraud, and comply with legal obligations.

Legal bases: performance of a contract, legitimate interests (e.g., analytics, fraud prevention), consent (ads) and compliance with legal obligations.

Sharing your information

We may share your information with third party service providers and processors, including: AWS, MongoDB, Heroku (hosting/databases), Firebase (analytics), Unity Ads, AppLovin, Adjust (attribution), Facebook (ads), Google Play/App Store.

We share personal data only as necessary to provide the Services, operate our business, and comply with legal obligations.

We do not sell personal data (as defined under applicable law).

Legal disclosures may be made to authorities where required by law or to protect our rights.

International Data Transfers
Your personal data may be transferred to and processed in countries outside your jurisdiction, including the United States and the European Union (e.g., US/EU servers via AWS/Firebase).

For EEA/UK, we use Standard Contractual Clauses or other approved mechanisms.

Israel is recognized by the European Commission as providing an adequate level of protection. We implement appropriate safeguards in accordance with applicable law.

Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected as described in this Policy, including to provide our services, comply with our legal obligations, resolve disputes, and enforce our agreements. The retention period may vary depending on the type of information and the context of its collection. When personal data is no longer required, we take reasonable steps to delete, anonymize, or securely store it in accordance with applicable law.

For example:

·  Gameplay data: until account deletion + up to 90 days

·  Logs: retained for up to 90 days after deletion

Retention periods for third-party services (e.g., Firebase, Adjust) are determined by their respective configurations and policies.

Your Rights
Depending on your location and applicable law, you may have certain rights regarding your personal data. These may include the right to:

·  Access the personal data we hold about you.

·  Request correction of inaccurate or incomplete information.

·  Request deletion of your personal data, subject to legal or contractual obligations.

·  Object to or restrict certain types of processing, including for direct marketing purposes.

·  Withdraw consent where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal.

·  Request data portability, where applicable.

You may exercise these rights by contacting us at: [email protected].

We may ask for reasonable information to verify your identity before fulfilling your request.

If you believe your privacy rights have not been respected, or if you have concerns about our handling of your personal data, you may also have the right to contact or file a complaint with your local data protection authority.

Note for U.S. Residents

For residents of California and other U.S. states with applicable privacy laws, the rights described above, including the rights to access, correct and delete personal information, and, where applicable, to opt out of certain data uses, also apply.

Please note that we do not sell or share personal information as these terms are defined under U.S. privacy legislation.

For any privacy-related questions or requests, you can contact us at:  [email protected].

Children’s Privacy

The Service is not intended for children under the age of 13 (or other age as required by local law).

We do not knowingly collect personal data from children. If we become aware that such data has been collected, we will take steps to delete it. If you believe that we might have received information from a child, please contact us at: [email protected].

Security
We implement appropriate technical and organizational measures to protect personal data, including encryption, access controls, audits via processors like AWS/MongoDB.

Cookies & Tracking
We use SDKs/cookies for ads/analytics (e.g., Adjust consent mode, AppLovin settings). Where required by law, we obtain your consent before using such technologies. You can manage your preferences through in-app settings or your device settings.

Changes

We may update this Privacy Policy from time to time.

Where required, we will provide notice (e.g., in-app or via email).

Last updated: April 7th, 2026

Contact
For questions contact: [email protected].

Israel PPA complaints: Privacy Protection Authority.

Governing law: Israel.