Privacy Policy

GameMantra Technologies ("GameMantra", "we", "us", or "our") operates the gamemantra.ai platform — an AI-driven monetization and LiveOps infrastructure for mobile game studios. This includes the SDK, developer console, analytics pipeline, and all associated APIs.

Our registered office is in India. For privacy inquiries, contact us at [email protected].

gamemantra.ai is a business-to-business (B2B) platform. Our direct customers are game studios and publishers ("Studios") who integrate the GameMantra SDK into their games. We process data on behalf of Studios, not on behalf of their end-users (players).

If you are a player of a game that uses GameMantra, please contact the Studio that published that game — they are the data controller for your personal information under their own privacy policy.

Account data: Name, work email address, company name, billing email, and GST/tax registration number (required for India invoicing). Collected during signup and stored in our Postgres database.

Usage data: API call counts, SDK event volumes, offer requests, and session counts. Used for billing, quota enforcement, and platform health monitoring.

Payment data: Processed by Paddle, which acts as merchant of record. We never see or store full card numbers or bank account details.

Authentication data: Email addresses used to generate one-time magic link tokens. We do not store passwords.

When a Studio integrates our SDK, we receive and process the following data about their game players on the Studio's behalf:

• Opaque player identifiers — device IDs, hashed user IDs, or Studio-assigned IDs. We do not receive names, emails, or phone numbers.
• In-game economy events — currency earned/spent, item purchases, level completions, session durations. No real-money transaction data.
• Session metadata — session start/end times, approximate country (from IP address, not stored as raw IP), device platform.
• Offer interactions — whether a player was shown an offer, clicked it, or dismissed it.

This data is used to power the AI monetization pipeline: personalizing offers, running holdout experiments, computing economy health metrics, and training our prediction models.

We process this data under the Studio's instructions and do not use it for any purpose other than providing the gamemantra.ai service to that Studio.

For Studio account data: contract performance — necessary to provide the service you signed up for.

For billing and tax records: legal obligation — required under Indian GST law and applicable financial regulations.

For player behavioral data (processed on behalf of Studios): legitimate interests of the Studio to monetize and operate their game, or as directed by the Studio's own legal basis (consent, contract) with their players.

Payments are handled by Paddle.com Market Ltd (UK), which acts as merchant of record and as an independent data controller for payment data — it decides for itself how that data is processed for fraud prevention, tax determination and regulatory compliance, under its own privacy notice. It is not our sub-processor and we do not instruct it on that processing.

We do not sell data. We share data only with the following sub-processors:

• Hetzner Online GmbH (Germany / Finland) — Cloud server infrastructure. All data resides on servers operated by Hetzner.
• Resend — Transactional email delivery (magic link authentication emails).
• Cloudflare — CDN, DDoS protection, and R2 object storage for SDK artifacts.
• Sentry — Error monitoring (code stack traces, no player PII).

This list names the sub-processors we use today. We update it before a new sub-processor receives any data — including before a new payment processor takes any payment.

Studio account data: Retained for the duration of the contract plus 7 years (Indian tax record requirements).

Player economy events: Retained for 2 years in ClickHouse, then purged. Studios may request earlier deletion.

ML model training data: Anonymized feature vectors are retained for up to 3 years. Raw events are not retained past the economy event window.

Magic link tokens: Expire after 15 minutes and are deleted on use.

API keys: Hashed (SHA-256) only. The plaintext key is shown once at creation and never stored.

We implement industry-standard security controls: TLS 1.2+ for all data in transit, AES-256 encryption for data at rest, SHA-256 API key hashing, JWT-based session authentication with 24-hour expiry, OPA policy enforcement on every offer request, and role-based access controls with audit logging.

If you discover a security vulnerability, please report it to [email protected].

Our primary infrastructure is hosted in the EU (Hetzner, Helsinki). Studios contracting from India are subject to India's Digital Personal Data Protection Act, 2023 (DPDPA). We implement appropriate safeguards for cross-border data flows.

As a Studio customer, you may at any time:

• Request a copy of your account data
• Correct inaccurate information in your account
• Request deletion of your account and associated data
• Export your game's economy event data in CSV format
• Object to a specific data processing activity

To exercise these rights, email [email protected] from your registered account address.

The gamemantra.ai developer console uses a single session cookie to maintain your authenticated session (set by NextAuth.js). We do not use advertising cookies, cross-site tracking, or third-party analytics scripts.

Our marketing website (gamemantra.ai) does not use any tracking cookies.

We will notify Studios of material changes to this policy by email at least 14 days before the changes take effect. The current version is always available at gamemantra.ai/privacy.

For privacy questions, data requests, or to report a concern: