1. Who We Are
GameMantra Technologies ("GameMantra", "we", "us", or "our") operates the gamemantra.ai platform — an AI-driven monetization and LiveOps infrastructure for mobile game studios. This includes the SDK, developer console, analytics pipeline, and all associated APIs.
Our registered office is in India. For privacy inquiries, contact us at [email protected].
2. Who This Policy Covers
gamemantra.ai is a business-to-business (B2B) platform. Our direct customers are game studios and publishers ("Studios") who integrate the GameMantra SDK into their games. We process data on behalf of Studios, not on behalf of their end-users (players).
If you are a player of a game that uses GameMantra, please contact the Studio that published that game — they are the data controller for your personal information under their own privacy policy.
This policy also covers website enquiries — anyone who fills in a form on gamemantra.ai (Contact, Request a Demo, or an integration enquiry). For that data we are the controller, not a processor, and Section 5 sets out what we collect and why.
3. Data We Collect From Studios
Account data: Name, work email address, company name, billing email, and GST/tax registration number (required for India invoicing). Collected during signup and stored in our Postgres database.
Usage data: API call counts, SDK event volumes, offer requests, and session counts. Used for billing, quota enforcement, and platform health monitoring.
Payment data: Processed by Paddle, which acts as merchant of record. We never see or store full card numbers or bank account details.
Authentication data: Email addresses used to generate one-time magic link tokens. We do not store passwords.
4. Data We Process on Behalf of Studios (Player Data)
When a Studio integrates our SDK, we receive and process the following data about their game players on the Studio’s behalf:
- Opaque player identifiers — device IDs, hashed user IDs, or Studio-assigned IDs. We do not receive names, emails, or phone numbers.
- In-game economy events — currency earned/spent, item purchases, level completions, session durations. No real-money transaction data.
- Session metadata — session start/end times, approximate country (from IP address, not stored as raw IP), device platform.
- Offer interactions — whether a player was shown an offer, clicked it, or dismissed it.
This data is used to power the AI monetization pipeline: personalizing offers, running holdout experiments, computing economy health metrics, and training our prediction models.
We process this data under the Studio’s instructions and do not use it for any purpose other than providing the gamemantra.ai service to that Studio.
5. Data We Collect From Website Enquiries
When you submit a form on gamemantra.ai — Contact, Request a Demo, or an integration enquiry — we collect and store the following. You are not a customer at this point and there is no account; we are the controller for this data.
- What you type: first and last name, business email address, phone number, country, company name, your role, the product areas you select, how you heard about us, and the message you write.
- Where you were: the page the form was on, the referring URL, and any utm campaign parameters in the link you arrived through.
- Technical data: your IP address and browser user-agent string. Unlike player data, the IP address here is stored, because it is what makes the abuse controls below possible.
- The consent wording you were shown: we store the exact sentence displayed next to the tick box at the moment you submitted, so that what you agreed to is a record rather than an assumption. A submission with no such record is rejected.
Why we use it. To read your enquiry and reply to it — that is the purpose of the form, and it does not depend on the tick box. Separately, and only if you tick the box, to send you occasional updates about GameMantra. You can withdraw that at any time by replying to any such message or by emailing us; withdrawing it does not stop us replying to an enquiry you sent.
Who else sees it. Your enquiry is emailed to the relevant GameMantra team through Resend, and is stored on our infrastructure at Hetzner, both listed in Section 7. It is not sold, and it is not shared with anyone else.
Abuse prevention. To stop the forms being used to send bulk mail, your email address and IP address are briefly held in our cache to enforce a short cooldown per address and an hourly cap per network. These entries expire on their own within the hour. The forms also carry a hidden field that real people never fill in; there is no CAPTCHA to solve.
How long we keep it. Enquiry records are kept while the conversation they started is still relevant to us, and are deleted on request — email [email protected] and we will remove them. We do not currently apply an automatic deletion schedule to enquiry records.
Your rights. You can ask us for a copy of what an enquiry holds, ask us to correct it, or ask us to delete it, at the same address. You do not need an account to ask.
6. Legal Basis for Processing
For Studio account data: contract performance — necessary to provide the service you signed up for.
For billing and tax records: legal obligation — required under Indian GST law and applicable financial regulations.
For player behavioral data (processed on behalf of Studios): legitimate interests of the Studio to monetize and operate their game, or as directed by the Studio’s own legal basis (consent, contract) with their players.
7. Data Sharing and Sub-Processors
Payments are handled by Paddle.com Market Ltd (UK), which acts as merchant of record and as an independent data controller for payment data — it decides for itself how that data is processed for fraud prevention, tax determination and regulatory compliance, under its own privacy notice. It is not our sub-processor and we do not instruct it on that processing.
We do not sell data. We share data only with the following sub-processors:
- Hetzner Online GmbH (Germany / Finland) — Cloud server infrastructure. All data resides on servers operated by Hetzner.
- Resend — Transactional email delivery (magic link authentication emails).
- Cloudflare — CDN, DDoS protection, and R2 object storage for SDK artifacts.
- Sentry — Error monitoring (code stack traces, no player PII).
This list names the sub-processors we use today. We update it before a new sub-processor receives any data — including before a new payment processor takes any payment.
8. Data Retention
Studio account data: Retained for the duration of the contract plus 7 years (Indian tax record requirements).
Player economy events: Retained for 2 years in ClickHouse, then purged. Studios may request earlier deletion.
ML model training data: Anonymized feature vectors are retained for up to 3 years. Raw events are not retained past the economy event window.
Website enquiries: Kept while the enquiry is still relevant and deleted on request (see Section 5); no automatic deletion schedule is applied to them today. The rate-limit entries holding an email address or IP expire within the hour.
Magic link tokens: Expire after 15 minutes and are deleted on use.
API keys: Hashed (SHA-256) only. The plaintext key is shown once at creation and never stored.
9. Security
We implement industry-standard security controls: TLS 1.2+ for all data in transit, AES-256 encryption for data at rest, SHA-256 API key hashing, JWT-based session authentication with 24-hour expiry, OPA policy enforcement on every offer request, and role-based access controls with audit logging.
If you discover a security vulnerability, please report it to [email protected].
10. International Data Transfers
Our primary infrastructure is hosted in the EU (Hetzner, Helsinki). Studios contracting from India are subject to India’s Digital Personal Data Protection Act, 2023 (DPDPA). We implement appropriate safeguards for cross-border data flows.
11. Your Rights (Studios)
As a Studio customer, you may at any time:
- Request a copy of your account data
- Correct inaccurate information in your account
- Request deletion of your account and associated data
- Export your game’s economy event data in CSV format
- Object to a specific data processing activity
To exercise these rights, email [email protected] from your registered account address.
12. Cookies and Tracking
The gamemantra.ai developer console uses a single session cookie to maintain your authenticated session (set by NextAuth.js). We do not use advertising cookies, cross-site tracking, or third-party analytics scripts.
Our marketing website (gamemantra.ai) does not use any tracking cookies.
13. Changes to This Policy
We will notify Studios of material changes to this policy by email at least 14 days before the changes take effect. The current version is always available at gamemantra.ai/privacy.
14. Contact
For privacy questions, data requests, or to report a concern:
GameMantra Technologies