Privacy policy.

Custom Player applications, customers and orders

COLLAGEN d.o.o., Petrinjska 4, 21000 Split, Croatia, OIB 28952807144, is the controller for Custom Player application, customer and order data. While secure checkout is disabled, this page does not transmit form data. When enabled, the form sends only the fields shown, the required declarations and technical security records needed to create and protect the application and order.

After confirmed payment, the minimum invoice data needed to issue a legally required B2C fiscalized receipt — order reference, service description, amount, payment method, applicant name and e-mail — is sent through a protected connection to COLLAGEN d.o.o.'s contracted external invoicing provider. Game access is not purchased or provisioned through this transfer.

The purposes are to receive the applicant's own request, prevent impersonation and abuse, process and reconcile payment, perform identity and eligibility review, communicate status, keep accounting and consent evidence, handle disputes and protect the service. The principal legal bases are steps requested before and performance of the service contract, compliance with accounting and other legal obligations, and legitimate interests in fraud prevention, security and legal-claim defence after a documented balancing assessment. Separate consent is required for any optional use that is not necessary for these purposes. Payment does not prove identity and never activates a player automatically.

Application and customer details are encrypted at rest with service-specific keys. E-mail addresses also use keyed lookup hashes; public status access uses a separate random secret stored only as a keyed hash. Orders, provider events, policy versions, declarations, status changes, delivery attempts and administrative actions are recorded for audit. Card details are handled by Revolut Hosted Checkout and are not collected or stored by BOSSMADE Games.

Operational notifications about a new application and payment events, including the submitted profile and order information, are sent to the restricted administrative mailbox bossmade.games@gmail.com. This means Google acts as an e-mail service recipient. Payment and hosting providers, professional advisers and public authorities receive data only where needed for their function or required by law. Access must be limited to authorised personnel using multi-factor authentication.

No photograph or identity document is requested through this form. A social profile is a reference only and is not identity proof. Applicant-provided facts remain separate from WPM editorial estimates and simulation-generated values. Any portrait produced under this workflow is generic and fictional and does not use an applicant photograph as input.

Unpaid applications are deleted after 30 days. Closed or rejected application profile data is deleted or irreversibly anonymised within 24 months, unless a shorter period applies or continued retention is necessary for an active dispute, impersonation report or legal claim. Administrative Gmail notification copies are deleted within 90 days; the encrypted database remains the authoritative record. Accounting, payment, consent and fraud-prevention evidence is kept only for the applicable statutory limitation or mandatory accounting period. Active licensed records are retained while the licence is in force and for the applicable claims period after it ends. Legal holds suspend scheduled deletion only for the affected records and must be reviewed.

Applicants may request access, correction, restriction, objection or deletion where applicable and may report impersonation through the published privacy contact. Requests are authenticated proportionately without asking for card credentials. Data that is no longer required is deleted or irreversibly anonymised. International transfers by Google, Revolut or another provider require the provider's applicable safeguards and must be described in the final notice before checkout is enabled.