1. Who Is Responsible?
NIELSEN GAMES, Bankgata 32, Lillehammer, Norway, is the data controller responsible for the personal information described in this policy. For privacy questions and requests, contact [email protected].
2. Information We Process
- Account information: username, email address, password hash, selected character gender, language and settings. Passwords are stored using one-way hashing rather than as readable passwords.
- Gameplay: character, rank, progress, inventory, properties, family membership, transactions, combat, rewards and other game actions.
- Communications: chat, inbox and family messages, support requests, uploaded support screenshots and reports submitted by or about players.
- Technical and security information: IP addresses when connecting, session information, a browser identifier, request activity and relevant error or security records. Authenticated requests may create IP observations and request-attempt records for rule enforcement and manual investigation of possible automation. These do not by themselves prove misconduct.
- Optional push notifications: a browser push endpoint, subscription keys, chosen alert categories and notification delivery records.
- Purchases, where enabled: relevant transaction references, products, amounts, currency, status, refunds and disputes.
- Agreement records: the legal-document version and registration acceptance time. Earlier registration versions also recorded a separate acknowledgement of death-related purchase losses.
Information comes from you, your use of the service, players who communicate with or report you, and transaction or delivery providers where applicable. Do not include sensitive personal information in profiles, screenshots or messages unless necessary for your support request.
3. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Accounts, authentication, gameplay, requested communication features and account recovery | Performance of our contract with you |
| Purchases and purchase support, when enabled | Performance of our contract with you |
| Security, fraud and cheating prevention, moderation and investigations | Legitimate interests in a safe and fair service |
| Fault diagnosis and service reliability | Legitimate interests in maintaining the service |
| Required financial records and legal obligations | Compliance with legal obligations |
| Optional push subscriptions and processing requiring consent | Your consent, where required |
When relying on legitimate interests, we consider the effects on players and apply proportionate safeguards. You may object as explained below. You may withdraw consent for optional processing without affecting the lawfulness of earlier processing.
We do not treat agreement to the Terms as consent to advertising or unrelated optional processing.
4. Required and Optional Information
Information marked as required on registration is needed to create the account and provide the associated features. Without essential account information we cannot create or operate your account.
Referral codes, community participation, support attachments and enabling push notifications are optional. Please avoid sharing unnecessary personal information.
5. Visibility and Staff Access
Your username, character information, selected character gender, rank, family membership and relevant gameplay activity may appear in profiles, leaderboards, combat reports and other game features.
Public chat is visible to players with access to that channel. Family chat follows family access rules. Inbox messages are available to their participants. Email addresses and password hashes are not intended to be publicly displayed.
Authorised staff may access relevant communications and records where reasonably necessary for support, moderation, security or legal obligations. Sensitive investigation access is recorded with the administrator, target, time and stated purpose. Messages are not end-to-end encrypted. Other players can copy or share information you send them.
6. Message Translation
When the translation feature is enabled and a player requests it, selected message text and the requested language are sent to DeepL. For received inbox messages this includes the subject and body.
A recipient may request translation of a message they are entitled to read. The message itself may contain personal information. The game does not send the account password, payment details or email address as separate translation fields. Any such information written inside the message would be part of its text.
Opening chat or the inbox does not by itself request a translation. Translations may be temporarily cached to avoid repeated requests and can contain errors. Account-language interface translations use the game's own catalogue.
Optional Facebook Login
When you choose Facebook login, you are redirected to Meta to authorize identification and email access. We use the app-specific Facebook identifier and email, when supplied, to create or connect the login method you request. If Facebook does not supply an email, registration asks you to enter one. Existing accounts are never merged just because email addresses match.
Verification runs on our server. Facebook access tokens are used temporarily for identity verification and are not retained in our database. Meta processes authentication under its Privacy Policy. We request no friends, birthday, location or posting permissions. Connection records remain while connected, subject to account closure and applicable retention. See our Facebook data deletion instructions to request removal. Disconnecting Facebook does not by itself delete your game character or purchases.
Optional Google Login
If you choose Google login, your browser loads Google Identity Services and Google processes the network and account information needed for authentication under its Privacy Policy. We receive a signed identity token and use the Google account identifier and verified email address to create or connect your game login. We do not request access to your Gmail inbox, contacts, files or Google password.
Google login is optional. We process the connected identifier and email to provide the login method you request and protect accounts. We retain this connection while your game account exists, subject to account closure and applicable legal retention. Temporary login challenges expire after five minutes and are cleaned up when new challenges are created. Tokens are verified on the server and are not retained as reusable access credentials. Existing accounts are connected only after password confirmation. You can continue using ordinary password login; contact support to request removal of a connection.
7. Human Verification
Registration uses Cloudflare Turnstile to help prevent automated signups and abuse. When you choose to start verification, your browser connects to Cloudflare, which processes technical signals such as your IP address, browser and device characteristics, and challenge interaction information to assess whether a request is legitimate.
We send the resulting verification token to Cloudflare from our server and check its result, expected signup action and approved hostname before creating an account. We do not send your password, registration email or selected character gender as part of the verification request. We do not separately add your IP address to that server request, although Cloudflare receives connection information from your browser.
This processing supports our legitimate interests in protecting the service against bots, fraud and abusive account creation. Human verification is required for registration; if verification cannot complete, an account cannot be created. It is not advertising consent. Contact support if you need assistance or believe you were incorrectly blocked.
See the Cloudflare Turnstile Privacy Addendum and Cloudflare Privacy Policy for provider processing and retention information. Our own acceptance record does not store the raw CAPTCHA token.
9. Optional Push Notifications
If you enable notifications, we store the subscription endpoint and keys needed to deliver your chosen alerts. Delivery uses the push service associated with your browser or device, which may be operated by Apple, Google, Mozilla or Microsoft.
You can disable notifications in Settings or your browser permissions. Notifications can appear on a lock screen. Game notification payloads use event categories rather than the full text of private messages.
10. Service Providers and Disclosures
Relevant information may be processed by hosting, database, backup and network-security providers needed to run the service. Provider access depends on the environment delivering the game. Contact [email protected] for the current infrastructure providers and processing locations.
Transactional welcome emails use Cloudflare Email Service where enabled. Cloudflare receives the recipient email address, player name and message content to deliver this account message. This is separate from marketing. Delivery status is retained with the account; message bodies and provider tokens are not stored in the welcome-mail queue. Replies go to our Gmail support address. Password recovery uses Cloudflare Email Service when configured, or Google's Gmail email service for existing Gmail configurations. The delivery provider processes the recipient address and a short-lived password reset link; reset messages are not added to the welcome-mail queue. Google Fonts supplies the interface fonts and receives the network information needed to deliver them. Cloudflare Turnstile processes registration verification requests when you start human verification. DeepL processes requested message translations where enabled. Your browser's push provider delivers optional notifications. Relevant providers have their own privacy information, including Google and DeepL.
When enabled, real-money Credit purchases use Stripe-hosted checkout. Stripe processes your payment and billing details under its privacy policy (https://stripe.com/privacy). We send the selected package and an internal player/order reference to Stripe and retain payment references, amounts, currency and fulfillment records for delivery, support and accounting. Our server does not receive or store your full card details.
Providers receive information appropriate to their role. Appropriate processor agreements are required where they process information on our behalf. We may disclose relevant information where legally required, to handle legal claims or to address serious fraud or safety concerns. We do not sell personal information or use private messages for advertising.
11. International Transfers
Some hosting, email, translation and push providers may process information outside Norway and the European Economic Area. The relevant countries depend on the provider and service configuration.
We are responsible for establishing an appropriate transfer mechanism where required, such as an applicable adequacy decision or Standard Contractual Clauses, with additional safeguards where necessary. Contact [email protected] for the current destinations, applicable safeguards and how to obtain information about them.
12. Retention and Account Closure
We retain information for the time necessary for its purpose or a legal obligation. The following criteria determine retention:
- Account and gameplay records: while the account operates, then only where needed to complete closure, resolve disputes or meet another justified purpose.
- Messages, reports and support attachments: while needed for communication, support, moderation or associated disputes. Removing a message from one inbox may not remove a copy available to another participant.
- Security and browser-binding records: while needed for account restrictions, session security and proportionate fraud or abuse investigations, with longer retention limited to unresolved issues or legal requirements. IP observations and request-attempt history use a rolling 30-day investigation window; expired records are removed by activity-triggered routine cleanup. Backups follow the backup cycle. Moderation decisions, case notes and access audits are retained where necessary for enforcement, appeals or legal claims.
- Purchase and financial records: for applicable accounting, tax and claims requirements.
- Agreement records: while needed to establish the applicable agreement and resolve related claims.
- Push subscriptions: while enabled and usable, subject to removal when disabled, invalidated or otherwise no longer needed.
- Backups: until replaced or expired under the backup cycle; retained copies must remain protected and are not a means to restart unrelated processing.
Character death does not automatically delete your account or personal information. To request account closure or deletion, contact [email protected]. We will explain any information that must be retained and why. Contact us for the retention criteria and periods applicable to a particular record or infrastructure backup.
13. Your Rights
Subject to applicable law and circumstances, you may request access, correction, deletion, restriction, portability of eligible information and an objection to processing based on legitimate interests. You may withdraw consent for consent-based processing.
These rights are not absolute; for example, records may be required for legal obligations or claims. Contact [email protected]. We may request proportionate identity verification and normally respond within one month. If a lawful extension is necessary, we will explain it.
You may complain to Datatilsynet, Norway's data protection authority, or another competent supervisory authority.
14. Automated Restrictions
Automatic checks enforce request limits, account eligibility, browser-based registration restrictions, session security and gameplay rules. They can reject registration, limit requests or end a session. They use account, request or browser/session information to apply these rules, rather than verifying a person's real-world identity.
Contact support if you believe a restriction is incorrect. If additional automated decision-making with legal or similarly significant effects is introduced, it requires the information and safeguards required by law.
15. Security
We use safeguards appropriate to the information and risks, including password hashing and restricted access. No online service can guarantee complete security. Use a unique password and report suspected compromise promptly. Do not send passwords or complete payment-card details to support.
16. Age Requirement
Mafia-Family is intended for people aged 18 or older under its Terms. Contact us if you believe someone below the permitted age has registered so we can investigate and take appropriate action.
17. Changes and Contact
This policy will be updated when processing changes. Material changes will be communicated clearly where appropriate. Optional consent must be requested separately where required.
For privacy questions, rights requests or account closure, contact [email protected].