Privacy Policy

This Privacy Policy explains how Nandaka Interactive Private Limited collects, uses, shares, stores, and protects personal data when you use Legends of Hastinapur, legendsofhastinapur.com, and related services.

Nandaka Interactive Private Limited, having its principal place of business at G1, #4/608, V.O.C Street, D#423, Kottivakkam, Perungudi, Tiruvanmiyur, Chennai, Tamil Nadu, India, 600041, is responsible for personal data processed in connection with the Game and website.

We do not sell personal data. We do not use third-party advertising networks, retargeting pixels, or behavioral advertising.

We collect only the information needed to operate accounts, provide the Game, process support requests, prevent abuse, and comply with legal obligations.

• Account information, including email address, username, authentication identifiers, and account settings.
• Date of birth and age-band declaration used to enforce age rules.
• Guardian acknowledgement and receipt/support contact details when a 13-17 account starts paid checkout.
• Gameplay and account activity, including character data, progression, inventory, chat moderation signals, support history, and security logs.
• Order and transaction records needed for checkout review, purchase support, refunds, tax, and audit obligations for Hastinapur Seals, Legend Pass, Founder Packs, cosmetics, and other digital entitlements. We do not collect or store card numbers on this website.
• Device, IP address, browser, and telemetry data needed for security, fraud prevention, service reliability, and consent-based analytics.

We use personal data to provide and secure the Game, maintain accounts, support players, improve reliability, investigate abuse, comply with law, and process valid legal or support requests.

We may use aggregated or anonymized analytics to understand product usage and improve the service. We do not use payment data for advertising.

• Account creation, login, security, and fraud prevention.
• Gameplay operation, progression, support, bug fixing, and service reliability.
• Moderation, anti-cheat, abuse prevention, and enforcement of our Terms.
• Order support, refund review, tax records, and legal compliance.
• Consent-based product analytics through approved service providers.

For users in India, we process personal data in accordance with the Digital Personal Data Protection Act, 2023 and applicable rules as they come into force.

You may request access, correction, completion, deletion, grievance redressal, withdrawal of consent for consent-based processing, and nomination where applicable.

To exercise DPDP rights, contact privacy@legendsofhastinapur.com or grievance@nandakainteractive.in. We may verify your identity before acting on a request.

If the GDPR applies to you, you may have rights to access, rectification, erasure, restriction, objection, portability, and complaint to a supervisory authority.

Where we rely on consent, you may withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

We use third-party service providers only where needed to operate, secure, support, process orders, or improve the service. These providers process data for us under their own security and privacy commitments.

• Supabase: authentication and account management. The current launch Supabase project is configured for the ap-south-1 Mumbai region.
• Cloudflare: CDN, DDoS protection, bot management, and security services.
• Cloudflare Turnstile: human verification on selected forms.
• Payment service providers: payment session processing, order status, refund support, fraud prevention, and transaction audit records when online payments are enabled.
• PostHog Cloud: consent-based product analytics. We do not use PostHog for advertising or retargeting.

We retain personal data for as long as your account is active and for a reasonable period afterward where needed for legal compliance, dispute resolution, security, tax, fraud prevention, and enforcement.

Account deletion requests are handled under our Data Deletion & Right to Erasure policy. Some records, such as transaction, tax, security, and enforcement records, may be retained where required or permitted by law.

You can request access to your data, correction of inaccurate data, deletion of eligible data, or withdrawal of consent for non-essential processing by contacting us.

You can also manage non-essential cookie and analytics consent through the cookie controls made available on the website.