πŸ”Έ ART AUCTION PANIC Β· JJBK STUDIO



ART AUCTION PANIC β€” PRIVACY POLICY
Version 1.0 Β· Effective May 2026
Controller: JJBK Studio Β· privacy@jjbkstudio.com Β· Spain / European Union
Privacy Policy β€” Art Auction Panic
Art Auction Panic Β· JJBK Studio

PRIVACY POLICY

Rebel Auction House Β· Data Protection Notice

Version 1.0 Effective May 2026 Scope Global β€” GDPR / CCPA Aligned Contact privacy@jjbkstudio.com
01

Who We Are

Art Auction Panic is a time-management game created by JJBK Studio, developed in connection with the Rebel Canvas program of Harlem Genesis. In this policy, "we", "us", or "our" refers to JJBK Studio as the data controller.

Studio

JJBK Studio

Privacy Contact

privacy@jjbkstudio.com

Jurisdiction

Spain / European Union

02

Scope of This Policy

This Privacy Policy applies to all data processing activities related to:

GameArt Auction Panic (PC, mobile, or browser versions)
Websiteartauctionpanic.com and any associated subdomains
Email flowsKnowledge Card lead capture, PDF delivery, and follow-up educational emails
Future (planned)Rebel Canvas waitlist, social share features, Discord integration β€” covered when activated

Links to Rebel Canvas or Harlem Genesis resources may appear in the game or emails. Those services are governed by their own respective privacy policies once you navigate there.

03

Data We Collect

Game Data

Player nameChosen freely by the player; used for leaderboards and personalised messages from Alex's game interface.
Game progressDay level reached, boss completion state, score, lives, and artist unlocks.
Special toolsWhich special tools ("powers") Alex has earned during gameplay.
Local preferencesAudio, language, and display settings stored in PlayerPrefs on your device.

Lead Capture Data (Email Submission)

Email addressProvided voluntarily when requesting a Knowledge Card PDF after defeating a Boss level.
Submission contextBoss level completed, Knowledge Card requested, game version, player segment, and submission timestamp.

Email Analytics

Delivery eventsWhether an email was sent, delivered, opened, or had a link clicked β€” and when.
Email identifiersInternal message IDs assigned by our email delivery provider (Resend).

Technical / Security Data

Technical logsIP address, browser user agent, and timestamps required for security and debugging purposes.

Future / Conditional Data

Social shareTweet or post URL if you use an optional share feature (not yet active). Only collected with your direct action.
Rebel Canvas waitlistContact details submitted if you join a waitlist (covered separately when this feature activates).
πŸ”’ PlayerPrefs are local. Game progress, settings, and preferences stored via Unity's PlayerPrefs exist only on your device unless you explicitly send data to our backend β€” for example, by submitting your email for a Knowledge Card PDF.
04

How We Use Your Data

Purpose Data Used
Run and display the game (scores, leaderboard, player name)Game data
Deliver the Knowledge Card PDF you requestedEmail Submission context
Unlock Knowledge Cards in the Achievements panelBoss completion
Send optional follow-up educational emails (Days 3 / 7 / 30)Email
Measure whether emails are delivered, opened, or clickedEmail analytics
Improve the game, content, and educational funnelAggregated analytics
Prevent abuse, debug technical issues, ensure securityTechnical logs

We do not sell your personal data. We do not use your data for automated individual decision-making or profiling that produces legal effects.

05

Legal Bases (GDPR)

For users in the European Union and European Economic Area, we process personal data under the following legal bases:

Performance of a requested service Sending the Knowledge Card PDF you explicitly requested by submitting your email address.
Consent Follow-up educational or promotional emails (Days 3 / 7 / 30) and any optional newsletter-style updates. You can withdraw consent at any time. See Section 13.
Legitimate interests Basic security logs, aggregated gameplay analytics, and debugging β€” where our interests are not overridden by your rights.
ℹ️ When you enter your email in-game to receive a Knowledge Card PDF, you will see a clear notice such as: "Get the PDF and occasional Art Auction Panic / Rebel Canvas learning updates. Unsubscribe anytime." This connects your submission to the relevant legal basis.
06

Email PDFs and Learning Updates

When you defeat a Boss level in Art Auction Panic, you may optionally provide your email to receive a Knowledge Card PDF β€” a short educational guide explaining the NFT concept covered by that level.

What gets sent

Day 0Immediate PDF delivery β€” transactional, triggered by your request.
Day 3 / 7 / 30Optional follow-up learning emails β€” only if you consented at submission. Always include an unsubscribe link.

Every follow-up email includes a clear unsubscribe link. You can also request removal at any time by emailing privacy@jjbkstudio.com.

07

Leaderboards and Player Names

The in-game leaderboard displays player names and scores. Please choose a name that does not include personal information you would not want to be visible to others who play on the same device or, in future, share leaderboard data.

Leaderboard data is currently stored locally via PlayerPrefs. If a global leaderboard is introduced in a future update, this policy will be updated accordingly and you will be informed.

08

Cookies, Local Storage & PlayerPrefs

Art Auction Panic (game client) uses Unity's PlayerPrefs system to store game data locally on your device. This is similar to a cookie but operates at the application level, not in a browser.

What's storedGame progress, scores, boss completion flags, leaderboard entries, audio and language settings.
Where it livesOnly on your device. Not transmitted to our servers unless you explicitly submit data (e.g., email capture).
How to clearReset or uninstall the game. Some platforms allow clearing app storage from device settings.

The artauctionpanic.com website may use strictly necessary cookies for basic site functionality. No advertising or tracking cookies are used.

09

Service Providers

We share data with the following trusted third-party processors, solely to operate the services described in this policy:

Provider Role Data Shared
Supabase Database, storage, and backend functions Email, submission context, timestamps
Resend Email delivery and analytics Email address, email event data
Hostinger Domain and email hosting Inbound / outbound email metadata
Rebel Canvas / Harlem Genesis Linked program (future waitlist, NFT claim) Only if you click through or join a waitlist
🚫 We do not sell your personal data to any third party, including advertisers or data brokers.
10

International Transfers

Our service providers (Supabase, Resend) may process data in countries outside the European Union, including the United States. Where such transfers occur, we rely on providers that implement appropriate safeguards β€” such as Standard Contractual Clauses approved by the European Commission or other recognised transfer mechanisms β€” to protect your personal data.

You may request information about specific transfer mechanisms by contacting privacy@jjbkstudio.com.

11

Data Retention

Data Type Retention Period
Local PlayerPrefs (game progress, settings)Until you reset or uninstall the game
Email lead capture recordsUp to 24 months, or until you request deletion
Email event logs (delivery, open, click)Up to 24 months, then aggregated or deleted
Technical / security debug logsUp to 90 days, where technically possible
Unsubscribe recordsKept indefinitely to honour your opt-out

After the applicable retention period, personal data is deleted or irreversibly anonymised. You may request earlier deletion at any time (see Section 12).

12

Your Rights

Depending on where you live, you may have the following rights regarding your personal data. EU/EEA users have these rights under the GDPR. California residents have similar rights under the CCPA.

πŸ‘

Access

Request a copy of the personal data we hold about you.

✏️

Rectification

Ask us to correct inaccurate or incomplete data.

πŸ—‘

Erasure ("Right to be Forgotten")

Request deletion of your personal data, subject to legal obligations.

⏸

Restriction

Ask us to limit processing of your data in certain circumstances.

πŸ“¦

Portability

Receive your data in a structured, machine-readable format.

🚫

Objection

Object to processing based on legitimate interests.

↩️

Withdraw Consent

Withdraw consent at any time without affecting prior processing.

βš–οΈ

Lodge a Complaint

File a complaint with your national data protection authority (e.g., AEPD in Spain).

πŸ‡ΊπŸ‡Έ California residents: Under the CCPA, your email address qualifies as personal information. You have the right to know what data we collect, request its deletion, correct inaccurate data, and opt out of any sale or sharing of personal information. We do not sell or share your personal information with third parties for their own marketing purposes.

To exercise any of your rights, contact us at privacy@jjbkstudio.com. We will respond within 30 days (or the timeframe required by applicable law).

13

Unsubscribe and Marketing Choices

Every follow-up or promotional email sent by Art Auction Panic includes a clear and functional unsubscribe link in the footer. Clicking it will immediately remove you from further non-transactional emails.

You may also unsubscribe or withdraw marketing consent at any time by emailing privacy@jjbkstudio.com with the subject line "Unsubscribe".

Unsubscribing does not affect the delivery of the PDF you requested (a transactional communication), and your unsubscribe record will be retained to ensure we respect your preference.

14

Children

⚠️ Art Auction Panic is not directed at children under the age of 13 (or the minimum age required in your country under applicable law β€” up to 16 in some EU member states for online consent). If you are under the applicable minimum age, please do not submit your email address or any personal information without the permission of a parent or guardian. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. Parents or guardians who believe their child has submitted personal data should contact us at privacy@jjbkstudio.com.
15

Security

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

EncryptionHTTPS for all web communications; encrypted connections to Supabase and Resend.
Access controlMinimal access to production data on a need-to-know basis.
Trusted providersWe work with established infrastructure providers that maintain their own security programmes.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to addressing any breach in accordance with applicable law.

16

Contact

For any privacy-related questions, requests, or complaints, please reach out to us:

Privacy Email

privacy@jjbkstudio.com

General Contact

zara@artauctionpanic.com

Response Time

Within 30 days

EU Supervisory Authority

AEPD (Spain) β€” aepd.es

17

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or new features. When we make material changes, we will update the "Effective" date at the top of this page and β€” where appropriate β€” notify you via in-game announcement or email.

The latest version of this policy is always available at artauctionpanic.com/privacy. Continued use of Art Auction Panic after any update constitutes acceptance of the revised policy.

πŸ“‹ This document is provided for informational purposes and does not constitute legal advice. We recommend periodic review by a qualified legal professional, especially if you expand to new markets or activate additional data flows such as the Rebel Canvas waitlist or global leaderboard features.