Privacy Policy

1. Introduction

XLGAMES, Inc. (“we”, “our”, “Company” or “us”) collect, use, and process information about you (“you”, “user”, or “player”). We provide various services related to the Game (i.e. game, website, event, survey, customer service) ("Games and Services"). This Privacy Policy (“Policy”) covers the personal information that is provided, collected, or generated when you access, use, or subscribe to our Games and Services, except where separate privacy policies or terms and conditions apply. This Policy applies to our Games and Services, and explains the rights and choices you have with respect to this data, and how you can communicate with us. This Policy does not apply to and cannot control activities when you click or visit other sites from our Games and Services.

We will occasionally update this Policy. When we do, we will revise the effective date above. While we will periodically inform you of this Policy or any material changes made to it, your continued use of our Games and Services after such changes means you accept the Policy as revised. We encourage you to periodically review this Policy to stay informed about how we collect and process your personal information. From time to time, we may ask you to confirm your acceptance of this Policy when we offer our Games and Services.

2. What Information Do We Collect

We will collect the following categories of information that may directly or indirectly identify or describe you or your device or information that may be reasonably capable of being associated with or reasonably linked to you or your device. The information you provide to us may differ depending on the circumstances. For example, these include:

1) Identifiers: SteamID64, PlayStation Network Online ID, Xbox Live ID, Epic Games Account ID, nickname, IP address, email address, phone number, date of birth, gender, country of residence, language, nationality;
2) Device or Network Information: device model, OS version, MAC address, device ID, IP information;
3) Game information: game character names, chat records, information about crash reports and system activity details (such as game settings, play date/time), gameplay behavior;
4) Purchase information: price, purchase date, game items, order number;
5) Customer service: customer opinions, customer complaints;

To ensure a fair, secure, and compliant environment for all users, we may collect and analyze data related to your activity and gameplay behavior. This process involves continuous monitoring and profiling.

When you participate in social features (such as in-game text/voice chat, Discord/SNS chat), the information that you disclose is public information. We may store and access it, and it may be read, copied, collected, or used by other users without your consent.

We use this data to operate and improve our Games and Services. Some of this information is collected through our use of cookies and related online tools/technologies. See our “Cookies and Related Technologies” section below for more information.

3. How We Use Your Information

We use the collected information for a variety of purposes, primarily to provide the Games and Services to players like you and to improve the quality of our Games and Services. These include:

1) To operate and provide our Games and Services;
2) To improve the quality of our Games and Services, and fix bugs;
3) To detect and act upon the illegal or unauthorized use of our Games and Services;
4) To manage inquiries and requests from you (e.g. refund items in-game, etc.);
5) To provide advertising information and other information on marketing and promotional events and surveys;
6) To track usage patterns, analyze trends of users, and calculate statistics on Games and Services;
7) To prepare user statistics and provide in-game metrics (such as a leaderboard);
8) To prevent, detect, identify, investigate, and respond to potential or actual claims, liabilities, prohibited behavior, cheating, hacking, or criminal activity; and
9) To comply with and enforce legal requirements, agreements, and policies.

Most of the time, our processing of your personal information is necessary to respond to you or process your request. We may also process your information to comply with a relevant legal obligation. From time to time, we may ask for your consent to use your information for specific reasons. Where consent was provided and is required, you may withdraw your consent at any time by contacting us at the address provided in this Policy.

4. How We Share Your Information

We share certain personal information with third parties to provide our Games and Services to you, including service providers that process personal information on our behalf to provide our Games and Services to you, such as customer support and community management. Some examples of these third parties are provided below. We do not sell or rent your personal information, and we do not sell or share your personal information with app market operators, payment service providers, or other payment platforms for cross-context behavioral advertising or targeted advertising purposes.

1) Third-party program restriction providers to block cheating tools and unauthorized programs;
2) Cloud computing service providers to provide cloud storage services;
3) Payment service providers to assist with payment transactions or withdrawal services for sellers;
4) Marketing platforms and analytics service providers relating to player behavior, in order to tailor the Service and conduct marketing activities (such as a leaderboard);
5) Online survey service providers in order to improve the game service;
6) Customer service providers to manage customers' inquiries;
7) Real-time text/voice transmission platform providers to provide chat services;

5. Cookies and Related Technologies

We use cookies and other technologies to recognize your browser or device, learn more about your interests, provide you with essential features and services, and for additional purposes. Approved third parties may also set cookies and related technologies when you use our Games and Services.

Cookies are small files downloaded to your device (if your browser is enabled to accept cookies) to track movements within websites and customize your experience. Most Internet browsers allow you to erase cookies from your device hard drive, block acceptance of cookies, or receive a warning before a cookie is stored. You should refer to your browser instructions or “Help” screen to learn more about how to manage cookies. Please note, however, that if you block cookies, some portions of our websites may not function properly.

We use third-party analytics services to improve our Services and your experience. Analytics service providers may collect your activity data while using our Games and/or Services. However, we do not allow the collection of or access to information that directly identifies you, such as your name or email address. You can find the information you need to manage the collection of your data below:

• Google Analytics: https://tools.google.com/dlpage/gaoptout

We also strive to provide a safe and fair gaming environment for all players. When you play the Game, we or third parties may use cookies and similar technologies, or collect data about your machine or device, for fraud prevention, security, and authentication purposes.

6. International Data Transfers

Your personal information will be processed in your country for the purposes set forth in this Privacy Policy. However, your personal information may be processed in countries outside of your home country in exceptional cases in order to provide the services.

When your personal information is transferred internationally, we take appropriate security measures in compliance with the laws of the country in question. For example, personal information is protected using legal mechanisms such as standard contractual provisions or adequacy decisions on personal information protection.

Where required by applicable law, we will obtain your consent to the international transfer of your personal information. Where consent is not required, we rely on other lawful transfer mechanisms or legal grounds, such as the performance of a contract, our legitimate interests, standard contractual clauses, adequacy decisions, certification mechanisms, contractual safeguards, or other safeguards recognized under applicable laws.

You may object to such transfers of your personal information in the manner set forth in this Privacy Policy, subject to limitations permitted under applicable laws and the nature of the Services or payment dispute handling involved.

Where we transfer personal information internationally, we rely on the transfer mechanism or legal basis applicable to the relevant country or region, recipient, purpose, and category of information.

For users in Korea, where applicable, we rely on consent, statutory exceptions, contractual necessity, certification, or other mechanisms recognized under the Personal Information Protection Act, or other lawful grounds permitted by Korean law.

For users in the EEA, United Kingdom, or Switzerland, where applicable, we rely on adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, transfer risk assessments, certification mechanisms, or derogations permitted for specific situations, such as where the transfer is necessary for the performance of a contract, the handling of a transaction requested by you, or the establishment, exercise, or defense of legal claims.

For users in Japan, where we provide personal data to a third party located outside Japan, we will provide information required under applicable Japanese law, including the destination country, the recipient, the purpose of provision, the categories of personal data provided, the legal basis or consent status where applicable, and information regarding the recipient’s safeguards. Where required by applicable law, we will also provide information upon request regarding the measures taken to ensure the continued implementation of such safeguards.

For users in Taiwan, where applicable, we provide information regarding the purpose, categories, recipient, region, method, and retention period of the international transfer. If you refuse the provision or transfer of information necessary for refund verification, refund review or payment dispute handling may be limited, delayed, or unavailable.

We may transfer your personal information to the following recipients and countries:

• Recipient: Amazon Web Services Inc.

  Transmitted Information: SteamID64, nickname, game usage history, access logs, etc.
  Entrusted Task: Cloud service operation and management
  Transmitted Country: United States, Germany, Japan, Taiwan, Singapore, Hong Kong
  Transfer Date and Method: Transmission over the network at the time of service use
  Personal Information Retention/Usage Period: Information will be destroyed without delay upon termination of the entrustment contract or withdrawal from service

• Recipient: Google LLC

  Transmitted Information: Non-personally identifiable information such as access logs and cookie data
  Entrusted Task: Website usage statistics analysis, service quality improvement, and media content provision
  Transmitted Country: United States
  Transfer Date and Method: Transmission over the network at the time of service use
  Personal Information Retention/Usage Period: Upon termination of the entrustment contract or 14 months from the date of data collection

7. Retaining and Deleting Personal Information

In principle, we will remove your personal information without delay after the purpose of collecting personal information is achieved. Personal information stored in physical form will be shredded or incinerated, and personal information stored electronically will be removed using technical measures in a way that the information cannot be reproduced. However, we may retain your personal information even after you have closed your account with us or we have ceased providing Services to you, if retention of your personal information is reasonably necessary to comply with our legal obligations, meet regulatory requirements, resolve disputes, prevent fraud, cheating, or abuse, or enforce this Policy or any other agreement we may have with a player.

8. Our Policy Concerning Children

This Game and/or Service is not intended for underage users. Thus, we do not knowingly collect, use, or share any information about them. When we process information for a child under the age of 14, we will obtain consent from parents or guardians before the child uses our Games and Services. If you are a parent or guardian and believe your child has provided us with information, you can contact us and request that your child’s information be deleted from our system.

9. Links and Third-Party Services

If you click on a link to a third-party website, including, without limitation, an advertisement, you will leave our website and go to the website you selected. Because we cannot control the activities of third parties, we cannot guarantee that they will adhere to the same privacy and security practices as we do. We encourage you to review the privacy policies of any other service provider from whom you request services. If you visit a third-party website linked to our Games and Services, you should consult that site’s privacy policy before providing any personal information.

10. Security of Your Information

When processing your personal information, we implement the following technical and administrative measures to ensure security and prevent personal information from being lost, stolen, leaked, altered, or damaged.

1) Technical Measures

We make every effort to prevent the leakage or damage of your personal information due to hacking or computer viruses. To prepare for potential damage, data is backed up on a regular basis while the latest antivirus programs are used to prevent leakage or corruption. We also ensure the secure transmission of personal information over networks through encrypted communication. Furthermore, unauthorized external access is monitored using intrusion prevention systems. We always strive to implement all possible technical measures to ensure system security.

2) Administrative Measures

We limit the handling of personal information strictly to authorized personnel, issuing separate passwords that are regularly updated. In addition, we emphasize compliance with this Privacy Policy through regular training for employees handling personal data. We strive to ensure compliance with this Privacy Policy and designate an officer in charge through our internal organization for personal information protection to immediately correct any problems upon discovery.

We provide regular in-house or external training to employees who handle personal information regarding new security technologies and privacy obligations. The transfer of duties in handling personal information is carried out thoroughly while maintaining security, and responsibility for any privacy issues before and after employment is clearly defined.

We are not responsible for any personal information leaks caused by your own mistakes or the inherent risks of the internet. You must properly manage your accounts and passwords to protect your personal information and take responsibility for them.

11. Your Privacy Rights

Subject to limitations in applicable law, you are entitled to object to or request the restriction of processing of your personal information, and to request access to, rectification, erasure, and portability of your own personal information. To make a request concerning your rights or if you have any other questions, please contact us by sending an email to the address specified in Section 13 ("Contact Us"). We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

You have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how we process your personal information. The data protection authority you can lodge a complaint with may be that of your habitual residence, where you work, or where we are established.

For users in the U.S., depending on the state in which you reside and the privacy law applicable to you, you may have additional rights regarding your personal information. These rights may include the right to know or access the personal information we collect, use, disclose, sell, or share about you; the right to request deletion; the right to request correction; the right to receive a portable copy of your personal information; the right to opt out of the sale or sharing of personal information; the right to opt out of targeted advertising; the right to limit the use or disclosure of sensitive personal information, where applicable; the right to opt out of certain profiling or automated decision-making activities, where applicable; and the right to appeal our decision if we deny your request.

Where required by applicable U.S. state privacy laws, you may exercise opt-out rights through the methods described in this Privacy Policy, including any privacy settings, cookie settings, in-app settings, or other designated request channels we provide. Where required by law, we will also recognize applicable browser-based or device-based opt-out preference signals, such as Global Privacy Control, in a commercially reasonable manner.

You may designate an authorized agent to submit a request on your behalf where permitted by applicable law. We may require information necessary to verify your identity and confirm the agent’s authority before processing the request.

We will not discriminate against you for exercising your privacy rights. However, certain requests may affect our ability to provide specific features, process payment-related requests, review refund requests, prevent fraudulent refunds, or resolve disputes.

12. Amendments

We may amend, at our discretion, any portion of this Policy at any time by posting or displaying the amended Policy on our Games and Services. If we make material changes, we will post a prominent notice on our websites or in our Games and Services or give you other reasonable notice before any material changes take effect. All other changes are effective upon posting.

13. Contact Us

If you have any questions about this Policy or your dealings with our Games and Services, please contact us by sending an email to privacy@xlgames.com.

Data Protection Officer

• Name: Kim Kyoung Min
  Position: Director
  Address: 7F-8F, 14, Daewangpangyo-ro 645beon-gil, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea

This Privacy Policy may be translated into other languages for your convenience. In case of any discrepancies between the English version and other versions, the English version shall prevail. However, the Korean version of the Privacy Policy shall prevail for users based in Korea.

Announcement Date: October 12, 2026
Effective Date: This Privacy Policy takes effect on October 19, 2026.