We take your privacy seriously at Butterscotch Shenanigans, Inc. ("Bscotch"). We'll do our best to be open and transparent with what information we collect and how we use it.

This website and our products, customer accounts (Rumpus™ and BscotchID®), games, mobile applications, console or PC applications, and any additional services (collectively "Services") controlled by Bscotch and its affiliates ("we", "our", or "us") are governed by this Privacy Policy ("Policy"). This Policy will explain what information we collect, why we collect it, and how we use it. Additionally, this Policy explains the choices we offer, including how to access and update your information.

If you have any questions about this Policy, please contact us at privacy@bscotch.net.

By using the Services, you are consenting to this Policy and the processing and storage of your data, including your personal data, in the manner provided in this Policy. If you do not agree with these terms you may not use the Services.

See the Terms of Service for definitions.

Changes

This Policy may change from time to time to reflect changes in the law, in our Services, and in our business. We will post any Policy changes on this page and will provide notice (including, for certain Services, email notification of Policy changes) of such changes. Such changes will go into effect immediately upon your access of the Services after you are given notice, as described herein. Your continued use of the Services following the notice of any changes to this Policy constitutes your acceptance of such changes. Any information collected by the Services will be dealt with in accordance with the version of this Policy that was in place at the time of collection.

• Version 2.5.1 (Jan 10, 2024). Updated the Data Privacy Framework section to reflect the UK Extension to the EU-U.S. DPF. There have been no substantive changes to our actual privacy practices.
• Version 2.5.0 (Feb 15, 2024). Updated language to meet latest legal requirements for GDPR and various U.S. privacy laws and regulations. There have been no substantive changes to our actual privacy practices.
• Version 2.4.1 (March 30, 2021). Added explicit references to our use of YouTube, and link to the YouTube API.
• Version 2.4.0 (Jan 17, 2019). Updates for Privacy Shield participation.
• Version 2.3.0 (Dec 11, 2018). Tweaks to GDPR-related disclosures.
• Version 2.2.0 (May 25, 2018). Tweaks to GDPR-related disclosures.
• Version 2.1.0 (May 24, 2018). Additional disclosures made to comply with EU General Data Protection Regulation. Pending details for our Privacy Shield application.
• Version 2.0.0 (December 27, 2017). Major overhaul. Many updates in preparation for the launch of the Rumpus service. Updates include language clarification throughout, restructuring of the document, and more information about the kinds of data we collect and what we do with it.
• Version 1.1.0 (November 10, 2016). This Policy, written by real lawyers, entirely replaced our prior privacy policy.

Information we collect

Information we collect includes personal data. For the purposes of this Policy, "personal data" includes any information that can be used to identify you or your household or to contact you online or offline and includes, but is not limited to, your name, address, email, account name, handle, and phone number. We collect information to provide better Services to you and to improve our business. We collect information in the following ways:

Information you give us

We have access to and may store any personal data you directly provide when using our Services. Examples include when you use our Services to synchronize data across your devices, or to share content you have created with other users of our Services, or voluntarily submit support requests, and when you provide information while signing up for accounts, newsletters, beta tests, or promotions.

Information provided through a social network

We may obtain and store personal data through 3rd party social networking services (such as Discord, Google, YouTube, Twitter, and others) when you use them to log into our Services or connect them to your Accounts. In particular, we collect and store your unique identifiers from connected accounts. We will explicitly inform you about what personal data we will collect from your social network accounts at the time that you provide that information to us.

For example, if you choose to connect your Rumpus account to a YouTube account, we will use the YouTube API on your behalf to confirm the unique identifier for your YouTube channel and store that identifier with your Rumpus account.

Information given to us by others

Other users may make information about you available to us. For example, we may collect information regarding our games that you purchase from third party platforms such as Steam.

Unsolicited information you give us

While you use our services, or during your interactions with us, you might reveal information to us without us first asking for it. For example, you might share information with other users of our Services (which might then end up being stored by our Services), or an email you send us might include your phone number in the signature.

Information we get from your use of our Services

We may collect personal data about your use of the Services , like when you visit different parts of our site, when you accomplish feats within our video games, and what selections you make within the Services. We may also automatically collect certain technical information such as:

Device information

We may collect device-specific information (such as your hardware model and operating system version of devices used to access the Services). We will only collect general, high-level device information and will not use that information to identify specific users.

Personal data

We may collect and process the following personal data when you use our Services:

1. Identifiers: Your name, email address, IP address, and Username, as defined below are collected when you play our games or use our other services. We may also collect your Discord and social media handles ("Social Media IDs") and social media profile data, if you sign up to our Services via Discord or certain Social media platforms or connect with us on those platforms. For the purpose of this Policy, your "Username" may include your Rumpus User ID/Alias, and/or BscotchID.
2. Information that identifies, relates to, or can be associated with a particular individual: Your email address, IP address, platform ID, Social Media ID, or Username, when you access a game or our Services or send us a communication. Some of our Services use passwords as a security mechanism. We store your passwords after using one-way hashing algorithms so that not even we can discover your plaintext passwords. If you are an employee or a contractor or a prospective employee or contractor, we may also collect your physical address to verify your identity, send you correspondence, payment, and other materials related to your employment or work with us.
3. Internet activity and electronic network information: We collect login dates, gameplay data, email unopens, navigation paths, search queries, and timestamps, as well as information related to your activity within the Services. We also collect device event information such as crashes, system activity, hardware settings, browser type, browser language, the date and time of your request and referral URL. We process this information for the purpose of 1) generating analytics to improve the Services and the User experience; 2) to monitor activities and enforce our Terms of Service, and to perform content moderation; 3) to prevent fraud, spam, abuse and other malicious activities; and 4) to ensure security.
4. Geo-location Information: Coarse (imprecise) geographical location information to determine best server location for a particular user.
5. Commercial Activity and Information: We collect information from Xbox, Steam, and other third party platforms regarding your transaction and purchase history for our games in order to provide you with the Services, including our games that you may have purchased.
6. Employment Information: We process information regarding your employment history when you send us a resume, CV, or similar to apply for a job with us. We also process information related to your employment or work with us if you are an employee or a contractor.

We do not knowingly collect, or process any "special categories of personal data" as such term is defined by Article 9 of the GDPR, any "sensitive personal information" as such term is defined by Section 1798.140(ae) of the California Civil Code, or any similar information.

User Generated Content: Certain information, materials, and content that you upload or share via the Services including support requests, fan art submitted to us on our website, game save data, and custom game content created in level editors and communications shared via our Discord server or other communication methods may be referred to as "User Generated Content," for the purpose of this Policy. Any User Generated Content including any personal data therein, is subject to this Privacy Policy. By consenting to this Policy, you hereby consent to Bscotch’s use of any personal data contained in the User Generated Content for the reasons set forth herein and understand and agree that other users may have access to such personal data, by virtue of their access to the User Generated Content.

Cookies and other Tracking Technologies

To provide full functionality for some of our Services we may use cookies and related technologies (collectively "Cookies").

We collect Cookies for the following purposes:

• Authentication and Security. Cookies store your Account credentials and other information needed to provide functionality to our Services.
• Preferences & Site Features. When you make choices that customize your experience on our Services, we may store those choices in Cookies.
• Analytics & Research. To help us understand how our Services are being used and where there might be technical or other problems.

By using our Services you agree to our use of Cookies. You may opt out of cookies using software-specific settings in your browser, though this may make certain aspects of our Services non-functional.

How we use personal data we collect

The primary purpose of the personal data we collect is to provide our Services to you, since the Services' use of your personal data is synonymous with the function and value that they provide to you.

We use the personal data we collect from all of our Services to provide, maintain, protect and improve our Services, to develop new Services, and to protect us and our users. We also use this information to offer you tailored content, such as emails containing gameplay advice.

We may use your email address to inform you about our products and Services, such as letting you know about upcoming products or major changes to our Services. You will be able to opt out of receiving such information, either by unsubscribing from a particular type of content or by deleting your Service accounts.

When you contact us, we may keep a record of your communication as well as the other information described in this Policy to help solve any issues you might be facing.

Please keep in mind that comment sections, forums, shared User Generated Content, and other similar areas of our Services are public or partly public. Any personal data or other information posted in those areas is viewable and usable by anyone that has access, and we cannot control what others do with such information.

How long will your personal data be stored?

We will not use your personal data for any longer than is necessary to accomplish the purpose for which such data is processed, as described herein. Upon that purpose being complete, we will promptly remove such personal data. However, we will keep any removed personal data on our backup systems, solely for the purpose of archival storage and retrieval, for up to ninety (90) days (or 30 days in the case of log/telemetric data) or as otherwise required by law.

How we disclose personal data to third parties

WE DO NOT SELL OR LEASE YOUR PERSONAL DATA OR SHARE YOUR PERSONAL DATA FOR THE PURPOSE OF CROSS-CONTEXTUAL BEHAVIORAL ADVERTISING. FURTHER, WE DO NOT USE YOUR PERSONAL DATA TO CREATE PROFILES INCLUDING PROFILES FOR THE PURPOSE OF AUTOMATED DECISION MAKING.

However, there are certain circumstances in which we may disclose your personal data to third parties, without further notice to you.

We share personal data with companies, outside organizations, and individuals for the limited reasons, outlined below:

1. For external processing: We provide personal data to our affiliates, service providers, processors, or other trusted businesses or persons to process it for us, based on our instructions and in compliance with this Policy and any other appropriate confidentiality and security measures. In that respect, we may share personal data with companies that provide services to us, including companies that assist us with hosting, payment processing services, providing data process services, providing analytics services, account management, technical support, marketing, communication, measurement, and similar services.
2. For legal reasons: We will use and/or share personal data with companies, outside organizations or individuals if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to meet any applicable law, regulation, legal process or enforceable governmental request, detect, prevent, or otherwise address fraud, security or technical issues or protect against harm to the rights, property or safety of our users or the public as required or permitted by law.
3. In case of a sale or asset transfer: If we become involved in a merger, acquisition or other transaction involving the sale of some or all our assets, user information, including personal data collected from you through your use of our Services, could be included in the transferred assets. Should such an event occur, we will use reasonable means to notify you, either through email and/or a prominent notice on the Services.
4. In aggregated form for business purposes: We may use or share aggregated information and device information with our partners such as businesses with whom we have a relationship, advertisers or connected sites. For example, we may share information to show trends about the general use of our Services.
5. To generate and obtain analytics to improve our Services.
6. We may disclose your personal data to our owners, employees, and third-party contractors for the purpose of understanding user behavior and using such information to improve the Services.
7. We may disclose your personal data, without notice, if required to do so by law or in the good faith belief that such action is necessary to: i) conform to the edicts of the law or comply with legal process served on Company; ii) protect and defend the rights or property of Bscotch; and/or iii) act under exigent circumstances to protect the personal or economic safety of users, or the general public.
8. In circumstances not described above, we may disclose your personal data to other third parties with your consent or if you provide us with direction to do so.

In the past 12 months, we have disclosed the following personal data with the third parties described above for the business purposes described herein:

1. Identifiers
2. Information that identifies, relates to, or can be associated with a particular individual
3. Internet activity and electronic network information
4. Coarse Geolocation
5. Commercial Activity and Information
6. Employment Information, solely with respect to hosting, storage, and compliance with legal obligations.

Third Party Operators and Services

Our Policy does not apply to services offered by other companies or individuals, including products or sites that may be displayed to you on the Services, except as required by the DPF (as defined below) and applicable laws. For example, you might use Google to sign into our Services, but our Policy does not apply to your Google account. Similarly, you might purchase one of our games on the App Store, but our Policy does not apply to that transaction. We also do not control the privacy policies or your privacy settings on third-party sites, including social networks and the stores selling our digital and physical products.

For further information, please see the relevant privacy policies for each third party operator . Please note we do not control these privacy policies and are under no obligation to monitor such privacy policies or update you regarding any changes to the same. For convenience, we have included links to our major third party operators below (this is not an exhaustive list):

• Amazon: https://aws.amazon.com/privacy
• Apple: https://www.apple.com/legal/privacy/
• Discord: https://discord.com/privacy
• Facebook: https://www.facebook.com/about/privacy
• gog: https://www.gog.com/support/policies/gog_privacy_policy
• Google: https://www.google.com/policies/privacy/
• Humble: https://www.humblebundle.com/privacy
• Microsoft (Xbox): https://privacy.microsoft.com/en-us/privacystatement
• Nintendo: https://www.nintendo.com/us/privacy-policy/
• Steam: http://store.steampowered.com/privacy_agreement
• YouTube: https://www.youtube.com/t/terms

Choice

If we provide you with any mailings or other communication, you can always opt out of that communication. For any communications that are required to manage accounts you have with our Services you may only opt out by deleting the relevant accounts.

You have the right to remove your personal data from our databases. Some data, such as server logs and database backups, may not be directly deletable because of how they are stored, but will expire after a short time (our backups and logs are only stored for up to 30 days). Other information, such as content you have created by using our Services (e.g. a custom level you have created and shared with other users) might not be removed at all but will be anonymized so that the content can no longer be associated with your personal data.

Removal of certain data may require deletion of your accounts. To manage your Rumpus or BscotchID data, including account deletion, visit https://www.bscotch.net/account. For questions related to removal of your personal data you may contact us at privacy@bscotch.net.

Like many other companies, we do not honor "Do Not Track" flags but instead offer other choices with respect to third parties. Many third parties participate in self-regulation to offer you a choice regarding receiving targeted ads. Please note that you’ll still see generic ads after opting out, but they won’t be based on your activities online. On the web, you can opt out of participating companies by visiting the following sites:

• http://optout.networkadvertising.org/
• http://optout.aboutads.info/
• http://youronlinechoices.eu/ (EU users)

If you wish to similarly opt out of cross-app advertising on mobile devices, you can enable the Limit Ad Tracking flag on the device. Enabling Limit Ad Tracking sends a flag to third parties that you wish to opt out of targeted advertising on that device, and major mobile platforms require companies to honor this flag. Screenshots on how to find these options on various devices are available here:

• http://www.networkadvertising.org/mobile-choices

Accessing and updating your personal data

Whenever you use our Services, we aim to provide you with access to your personal data in your account. You may download your account data at https://www.bscotch.net/account. If your personal data is wrong, we strive to give you ways to update it quickly or to delete it unless we have to keep that information for legitimate business or legal purposes. When updating your personal data, we may ask you to verify your identity (usually via email) before we can act on your request.

To update your Rumpus or BscotchID accounts, visit https://www.bscotch.net/account. For any other updates you may contact us at https://www.bscotch.net/contact/topics/privacy.

Bases for Processing

The data we process may qualify for multiple legal bases for processing under the General Data Protection Regulation (GDPR) and similar laws. Below are the primary legal bases for each type of data that we process:

• It is contractually necessary to process your name, email address, Username and commercial purchase history when you elect to purchase our games or other content from our services so that we may provide you with the content you purchased.
• It is contractually necessary for us to process information contained in your support requests and the information you provide in your podcast questions, for us to provide the support service to you or respond to your questions on our podcast.
• It is contractually necessary for us to process the information contained in the User Generated Content you submit to us so that we may integrate the same into Levelhead.
• We have a legitimate interest to process your Social Media IDs when you voluntarily provide them to us so that we may communicate with you or display them on your behalf.
• We have a legitimate interest in processing email activity for emails we send to you, such as timestamps and un-opens, to generate analytics with respect to our email marketing and communications and determine when/if to send you emails.
• We have a legitimate interest in processing log data, network activity, your IP Address, and gameplay data to generate analytics to improve our Services.
• We have a legitimate interest in processing your coarse geo-location to determine how to best deliver you the Services.
• We have a legitimate interest in processing your Username and other content you upload onto the Services to perform content moderation to ensure our Services reflect our core values and those of our target audience.
• We have a legitimate interest to process your email address IP address, and network activity to conduct direct marketing, for our HR data, customer service, and for in-game analytics or telemetrics.
• We have a legitimate interest in processing your IP address and login data for rate limiting and other security purposes.
• We have a legitimate interest in processing your Social Media IDs to generate analytics with respect to the use of our Services.
• If you are a third party play-tester, we have a legitimate interest in processing your Username, network activity, and gameplay activity for the purpose of improving our Services.
• It is contractually necessary for us to collect basic login information (email, Username, Platform ID, password), gameplay data (your progress and achievements), IP addresses, cookies, and similar data to provide you access to full functionality of our games and Services.

Data Privacy Framework

Our Services are hosted in the United States. If you are outside of the United States, your information will be processed and stored in the United States and you are consenting to such processing and storage.

Bscotch complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Bscotch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Bscotch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Bscotch commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Bscotch at privacy@bscotch.net. Under certain conditions specified by the principles of each DPF, you may also be able to invoke binding arbitration to resolve your complaint. We are also subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Bscotch commits to cooperate and comply with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

We comply with the DPF for all onward transfers of personal information from the EU, the UK, and Switzerland to the US, including the accountability provisions regarding the actions of our data processors. This means that we will remain responsible for onward transfers of personal data and can be held liable for violations by our data processors. We may be legally obligated to disclose personal data to authorities to meet national security, law enforcement, or other legal requirements.

Information security

We work hard to protect our users from unauthorized access to or unauthorized alteration, disclosure or destruction of information we hold. In addition to our own security, we’ve vetted our data processors to ensure that your data is protected by strong security measures. However no website or storage system is entirely secure, and as such we make no guarantee for the safety of your information stored in associated with the Services. Learn more about our security practices as bscotch.net/security.

Enforcement

We regularly review our compliance with our Privacy Policy and will take complaints and concerns seriously. If we find that we or one of our processors are not acting in accordance with this policy, we will make a good faith effort to fix the problem as quickly as we can. If you believe you have found an issue, submit a report to bscotch.net/contact/topics/privacy with all information pertinent to the issue.

Your Rights

If you wish to access, update, correct, object to the processing of, or delete your personal data, you may make a request as described below. If you wish to access or delete your personal data, you may do so via our automated system at https://www.bscotch.net/account. For any other requests related to the rights set forth below, you may email us at privacy@bscotch.net.

We may ask you to verify your identity before we can act on your request. Making a verifiable consumer request does not require that you create an account with us. You must provide us with sufficient information to verify your identity, however we will only use personal data provided in a verifiable consumer request to verify the requestor’s identity.

In some cases, we may have to keep information for legitimate business or legal purposes and therefore will deny a request to delete the information.

Without limiting the foregoing, in certain circumstances, you have the following rights with respect to your Personal data:

• The right to access, update or to delete your personal data. Regardless of how we come into contact with your personal data, you have the right to request access to any personal data we hold about you. You may request access to your personal data by contacting us, as provided herein. If at any time you believe that personal data we hold about you is incorrect, incomplete or inaccurate, you may request that we amend and/or update your personal data. If we refuse your request, we will provide you with a written notice which will outline the reasons for such refusal and the complaint mechanisms available to you.
• The right of rectification. You have the right to have your personal data rectified if that information is inaccurate or incomplete.
• The right to object. You have the right to object to our processing of your personal data.
• The right of restriction. You have the right to request that we restrict the processing of your personal data.
• The right to data portability. You have the right to be provided with a copy of the personal data we have on you in a structured, machine-readable and commonly used format.
• The right to withdraw consent. You also have the right to withdraw your consent at any time where Bscotch relied on your consent to process your personal data
• The right to opt-out. You have the right to opt-out of the processing of your personal data for the purposes of (a) targeted advertising, (b) the sale of personal data, or (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Additionally we will disclose to you, at your request:

• The categories of personal data collected about you.
• The categories of sources for the personal data we collect about you.
• Our business or commercial purpose for collecting or selling that personal data.
• The categories of personal data that we share with third parties.
• The categories of third parties to whom we share that personal data.
• The specific pieces of personal data we collected about you.
• How you may exercise your consumer rights with respect to your personal data.
• If we sold or disclosed your personal data for a business purpose, two separate lists disclosing
• Sales identifying the categories that each category of recipient purchased; and
• Disclosures for a business purpose, identifying the categories that each category of recipient obtained.

You may make any of the foregoing requests yourself or through a designated agent. We may ask you to verify your identity before we can act on any request regarding your personal data. Additionally, if you choose to make a request through a designated agent, we may contact you to verify that you have given such agent the requisite permission.

If you are in the EEA, the UK, or Switzerland, you have the right to make complaint to a data protection authority about our collection and use of your personal data. For more information, please contact your local data protection authority in the EEA, the United Kingdom, or Switzerland.

Appeal

If you wish to appeal our decision denying any of the requests related to the rights set forth above, please email us at privacy@bscotch.net. In your appeal, please state that your message pertains to an appeal and include the date and subject matter of your original request.

Children Under 13 to 16

This Service is offered and made available only to users meeting the minimum legal age to provide their own consent (e.g., at least 13 years of age in the US and at least 13 to 16 years of age in the EU, depending on the country). If you do not meet the minimum legal age please discontinue using the Service immediately, or if for any reason you do not agree with all of the terms and conditions contained in this Agreement please discontinue using the Service immediately. By using or attempting to use the Service, you certify that you are at least the minimum age and meet any other eligibility requirements of the Service. If you are found to be under the minimum age, your account may be terminated without notice. Please contact us at privacy@bscotch.net if you believe your child has information stored on our Services.

Merger or Sale

The information collected pursuant to this Policy, including personal data, is considered an asset of Bscotch. In the event Bscotch or some or all of the assets related to the Services are acquired by another entity through a sale, merger, or some other change of ownership transaction, Bscotch reserves the right to transfer or assign the information, collected pursuant to this Policy.

Contact

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Bscotch commits to resolve DPF Principles-related complaints about our collection and use of your personal data. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Bscotch at: privacy@bscotch.net.

Data Protection Officer: You may contact our data protection officer at privacy@bscotch.net.