Privacy Policy

Last updated: August 10, 2026 (version 2026-08-10) — written to meet the EU General Data Protection Regulation (GDPR)

1. Who We Are (Controller)

ZOFL STUDIOS LLC (“ZOFL,” “we,” “us”) operates playlastworld.com and LASTWORLD (the “Service”) and is the data controller for the personal data described here. Address: 28 Church St, Ste 14 #6315, Winchester, Massachusetts 01890, USA. Contact for anything in this policy: contact@zofl.com.

2. Where Your Data Lives: EU Servers

All player account and game data is stored on servers located in the European Union. Our player database and authentication run in Frankfurt, Germany (EU), and our game and update servers run in Germany (EU). Website alpha sign-ups are stored in the same EU database. We do not store player data outside the EU. Our team administers these EU systems remotely; such access is limited to operating the Service and protected by the safeguards in Section 10.

3. What We Collect

• Account data: your email address and password. The password is stored only in securely hashed form by our authentication system — we never see or store it in plain text.
• Identity data (kept private): your first and last name, date of birth, and country, given when you create an account. Date of birth enforces our 16+ age gate. These are stored in a private record that only your own account can read — they are never shown to other players, never public, and not used for marketing.
• Profile data (visible to other players in the Game): your chosen display name, avatar, cosmetic selections, wins/losses and rank, and an online/last-seen indicator.
• Gameplay data: match history and results, match replays, your in-game inventory and currency, loadouts, general levels, and similar game-state records tied to your account.
• Acceptance records: the version and time at which you accepted the Terms of Use, and the alpha access code your account redeemed.
• Moderation data: if your account is sanctioned, the ban status and reason.
• Technical data: your IP address and connection data, processed transiently to run online matches, deliver downloads and updates, and protect the Service (short-lived server and connection logs); and basic technical data collected by our website host when you visit the Site (see also the Cookie Policy).
• Alpha waitlist (website): if you sign up on the Site, your email address, chosen region and chosen platform (Windows or Mac).
• Local files on your device: the Game stores settings and your login session on your own machine. These stay on your device and are not personal data we hold.

We collect no more than this. We do not run third-party advertising or tracking, we do not profile you, and we do not sell personal data.

4. Why We Process It (Purposes)

• To create and operate your account, run matches, and provide the Game (including matchmaking, replays, and the in-game economy).
• To enforce the 16+ age requirement.
• To keep the Service fair and secure: preventing cheating and abuse, enforcing bans, protecting our servers.
• To contact alpha waitlist sign-ups about access and development updates.
• To comply with legal obligations and enforce our Terms of Use.

5. Legal Bases (GDPR Article 6)

• Contract (Art. 6(1)(b)): account, identity, profile, gameplay, and acceptance data — processing needed to provide the Game you signed up for.
• Legitimate interests (Art. 6(1)(f)): technical logs, anti-cheat, and moderation — keeping the Service secure, fair, and operational.
• Consent (Art. 6(1)(a)): the website alpha waitlist. You can withdraw consent at any time by asking us to remove your email.
• Legal obligation (Art. 6(1)(c)): where retention or disclosure is required by law.

6. Who We Share It With (Processors)

We do not sell or rent personal data, and we share it only with the infrastructure providers that host the Service for us, acting on our instructions:

• Supabase — database and authentication, hosted in Frankfurt, Germany (EU).
• OVHcloud — game, relay, and update servers, hosted in Germany (EU).
• Vercel — hosting of this website.

Beyond that, we disclose personal data only to authorities where required by law, to protect our rights, safety, or property, or to a successor entity in a merger, acquisition, or sale of assets.

7. Retention

• Account, identity, profile, and gameplay data: kept while your account exists; deleted when your account is deleted (on your request, or at our initiative — including alpha-wide wipes, see the Terms).
• Match replays and history: kept for the operation of the alpha and may be wiped at any time.
• Technical logs: short-lived and rotated automatically.
• Alpha waitlist emails: kept until the alpha/launch communication they were collected for is over, or until you ask us to remove yours.

8. Your Rights (GDPR)

If you are in the EU/EEA (and in many other places), you have the right to: access the personal data we hold about you; have it rectified or erased (“right to be forgotten” — deleting your account deletes your personal data); restrict or object to processing based on legitimate interests; data portability (a copy in a machine-readable format); and to withdraw consent at any time where processing is based on consent. Exercise any of these by emailing contact@zofl.com from your account email — we respond within one month as the GDPR requires. You also have the right to lodge a complaint with your local data-protection authority (in the EU/EEA member state of your residence or workplace).

If you are a California resident: you have rights under the CCPA/CPRA, including the right to know, delete, and opt out of the “sale” or “sharing” of personal information — we do not sell or share personal information as those terms are defined by law.

9. Age Limit

The Service is not directed to children under 16, accounts require a verified date of birth showing 16 or older, and we do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has provided us personal data, contact us and we will delete it.

10. International Access and Transfers

Your data is stored in the EU as described in Section 2. ZOFL STUDIOS LLC is a United States company, and limited remote access by our team from outside the EU occurs strictly to administer and operate the Service. Where GDPR treats such access as a transfer, we protect it with appropriate safeguards, including our processors’ EU hosting commitments and standard contractual protections, and we keep such access to the minimum needed.

11. Security

We protect personal data with technical and organizational measures: passwords stored only as secure hashes, encrypted connections, row-level access controls in the database (your private identity record is readable only by your own account), key-based server access, and the EU hosting described above. No method of transmission or storage is completely secure, and — as an early-alpha service — we cannot guarantee absolute security; see the Terms of Use for the alpha’s disclaimers.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Changes take effect when posted, and the “Last updated” date and version above will change accordingly. For material changes we may additionally notify you in the Game or by email.

13. Contact

Privacy questions or requests: contact@zofl.com, or ZOFL STUDIOS LLC, 28 Church St, Ste 14 #6315, Winchester, Massachusetts 01890, USA.