Privacy Policy

1. Who we are

Vulkain (“we”, “us”) provides tools for game creators to distribute, monetize, and scale their games. For personal data processed through the Service, we act as a controller for account and platform data, and may act as a processor when studios use redemption links to collect recipient information under their instructions.

2. Data we collect

Account and profile

• Email address and authentication data (e.g. magic-link sessions)
• Name and profile fields you provide during onboarding
• Account type, account name, and related tenant settings

Product usage

• Games, key inventory metadata (not plaintext keys in logs), batches, distribution links, and redemption records
• Audit events (who uploaded keys, created links, changed status)
• Technical logs such as IP address, user agent, and approximate location derived from IP for security and abuse prevention

Recipients of distribution links

• Email addresses when a link requires or binds an email before revealing a key
• IP and device signals used for rate limiting and fraud controls

Cookies and similar technologies

See our Cookie Policy for details.

3. How we use data

• Provide, secure, and improve the Service
• Authenticate users and protect accounts
• Operate key distribution and redemption flows
• Detect abuse, anomalies, and policy violations
• Communicate service notices and (with consent where required) product updates
• Comply with legal obligations

4. Legal bases (EEA/UK)

Where GDPR / UK GDPR applies, we rely on:

• Contract — to provide the Service you request
• Legitimate interests — security, fraud prevention, product improvement (balanced against your rights)
• Consent — where required (e.g. certain cookies or marketing)
• Legal obligation — when the law requires us to retain or disclose information

5. Sharing

We do not sell personal data. We may share data with infrastructure providers (hosting, email delivery, analytics, captcha) under appropriate agreements, with advisors or authorities when legally required, or with a successor in a corporate transaction.

Studio customers can see redemption data for their own links and games. Recipients should understand that the studio operating a link may receive their email and redemption metadata.

6. International transfers

If we process data outside your country, we use appropriate safeguards such as standard contractual clauses where required.

7. Retention

We retain account and operational data for as long as your account is active and as needed for security, dispute resolution, and legal retention. You may request deletion subject to legitimate retention needs (e.g. fraud logs, legal holds).

8. Security

Steam keys are encrypted at rest. We apply access controls, tenancy scoping, and operational practices designed to prevent unauthorized access. No method of transmission or storage is perfectly secure.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing or withdraw consent. You may also lodge a complaint with a supervisory authority.

10. Children

The Service is aimed at professionals and businesses. It is not directed at children under 16, and we do not knowingly collect their data.

11. Changes

We may update this Policy from time to time. The “Last updated” date will change when we do. Significant changes may be highlighted in the product or by email when appropriate.

12. Contact

For privacy requests, contact us through the support channel published on the Vulkain website or provided with your beta access.