Privacy Policy
This policy explains what personal data Cortez Productions ("we", "us") collects through cortezproductions.com and its game pages, and through the social publishing tool we use to post our own content to Instagram and TikTok. It also explains why we collect it, how long we keep it, who receives it and what rights you have.
1. Who we are
Cortez Productions is an independent game development studio based in Brazil. We are the controller of the personal data described in this policy. For any privacy question or request, write to contact@cortez.productions.
2. Data collected on our websites
Contact form
When you use the contact form we receive your name, email address and message. They are delivered to our mailbox by email so we can read and answer your message. We do not add you to any mailing list.
Demo signup (Space Delivery)
When you sign up for the Space Delivery demo alert we receive your email address, the date and time of the signup and the page it came from. We use it only to tell you when the demo is available. The list is stored in a Google Sheets spreadsheet that only our team can access.
Spam and abuse protection
Both forms are protected by Cloudflare Turnstile, which checks signals from your browser to tell people and automated bots apart, and by a hidden field that bots tend to fill in. Form submissions pass through a small server we run on Cloudflare, which checks the Turnstile result and then forwards the message. Its logs record a request ID, the page origin, the domain part of your email address (not the full address) and whether the request succeeded. Cloudflare's own handling of Turnstile data is described in its privacy policy.
Hosting, network and security logs
Our websites are hosted on GitHub Pages and served through Cloudflare. Like any web server, these services process your IP address, browser type, the pages you request and similar technical data to deliver the site and protect it from attacks. We do not use these logs to identify individual visitors.
Data stored in your browser
We store your language preference and whether you already signed up for or dismissed the demo alert in your browser's local storage. This data stays on your device and is not sent to us. You can remove it by clearing your browser's site data.
3. Third-party content and advertising
Some parts of our pages are loaded from other companies. When your browser loads them, those companies receive your IP address and browser information and may set their own cookies, under their own privacy policies:
- Google Ads tag (Google): we use the Google tag to measure how well our advertising works, for example how many visitors reach our pages from an ad. Google may use cookies for this. You can control personalised ads at adssettings.google.com.
- YouTube (Google): embedded trailers and background videos.
- Google Fonts (Google): web fonts.
- Discord: the community server widget on our home page.
- Steam (Valve): links to our store pages. Review scores and tags shown on our home page are fetched from Steam through a public proxy service (codetabs.com), which receives your IP address when your browser makes that request.
- Content delivery networks (unpkg.com, cdnjs.cloudflare.com): icon and animation libraries.
Purchases of our games happen on Steam and are governed by Valve's terms and privacy policy, not by this policy.
4. Our social publishing tool
We run a private tool, hosted at autopost.cortezproductions.com, that schedules and publishes Cortez Productions' own videos to the studio's own Instagram professional account and TikTok account. It is used only by our team and is not offered to the public. It connects only to accounts owned by Cortez Productions.
For those accounts the tool processes:
- OAuth access and refresh tokens issued by Meta and TikTok, stored encrypted;
- account identifiers, username or nickname, and the posting options the platforms report for the account (for example available privacy levels);
- the videos, captions and settings we choose to publish, and the resulting post IDs and publishing status;
- operational logs of each publishing attempt.
The tool does not read or store data about other people: no followers, comments, direct messages, or other users' profiles or content. It uses the data above only to publish our posts at the scheduled time and to tell our team if a post fails. Data is stored on Cloudflare (Workers, D1 database and R2 storage); failure alerts go to a private Discord channel and contain post IDs and status, not personal data about anyone else.
Our use of data received from Instagram and TikTok follows the Meta Platform Terms and the TikTok Developer Terms.
5. Legal bases
Under the Brazilian General Data Protection Law (LGPD) and, where it applies, the EU/UK GDPR, we rely on:
- Consent for the demo signup and for advertising measurement. You can withdraw it at any time.
- Your request (pre-contractual steps) to answer messages you send us.
- Legitimate interests in keeping our websites secure, preventing spam and operating our own social media accounts.
6. Who receives data
We do not sell personal data. We share it only with the service providers needed to run our websites and tools: Cloudflare (network, security, form processing, email delivery and the publishing tool), GitHub (hosting), Google (spreadsheet storage, fonts, video and advertising measurement), Meta and TikTok (when we publish to our own accounts), Discord (widget and internal alerts) and Valve (Steam). We may also disclose data when required by law.
Several of these providers are located outside Brazil, mainly in the United States. Transfers rely on the safeguards offered by those providers, such as standard contractual clauses.
7. How long we keep data
- Contact messages: for as long as needed to handle your request and any follow-up, and no longer than 24 months after our last exchange.
- Demo signup emails: until the demo alert has been sent, and no longer than 12 months after the demo launches, or until you ask us to remove you.
- Form server logs: a few days, as kept by Cloudflare's logging service.
- Publishing tool tokens: until the connection is revoked or the account is disconnected.
- Publishing tool logs: 90 days.
- Media files uploaded for publishing: deleted 30 days after posting.
8. Your rights
You can ask us to confirm whether we process your data, to access, correct, delete or export it, to restrict or object to its use, and to withdraw consent. We aim to answer within 15 days. If you are not satisfied with our answer, you can complain to Brazil's National Data Protection Authority (ANPD) or to the data protection authority where you live.
9. Data deletion requests
To delete any personal data we hold about you, email contact@cortez.productions with the subject "Data deletion request" and the email address you used with us. We will confirm once the data is deleted.
Our publishing tool only connects to Cortez Productions' own accounts. The owner of a connected account can also revoke the tool's access at any time, which stops all access immediately:
- Instagram: in the Instagram app or website, open Settings, then Website permissions, then Apps and websites, and remove the app.
- TikTok: in the TikTok app, open Settings and privacy, then Security and permissions, then Apps and services, select the app and remove access.
After access is revoked, the stored tokens stop working and we delete them along with the account identifiers.
10. Children
Our games are horror titles and our websites are not directed at children. We do not knowingly collect personal data from children under 13, and anyone under 18 should use our forms only with a parent's or guardian's consent. If you believe a child has sent us personal data, contact us and we will delete it.
11. Security
Our sites are served only over HTTPS. Form secrets and platform tokens are kept as encrypted server-side secrets, access to our tools is restricted to our team, and we keep the data we collect to the minimum needed.
12. Changes to this policy
We may update this policy when our websites, tools or the law change. The effective date at the top shows the latest version. For significant changes we will add a notice on our home page.
13. Contact
Cortez Productions
Email: contact@cortez.productions
Website: cortezproductions.com