Privacy and Cookie Policy

MasterAi S.R.L.S., located at Via degli Aceri 77, 00172 Roma, with Tax Identification Number and VAT Number 17291571002, acting as the Data Controller for personal data (hereinafter also referred to as “Data Controller”), in compliance with EU Regulation 2016/679 of April 27, 2016 (General Data Protection Regulation, hereinafter “GDPR”) and with Italian Legislative Decree No. 196/2003 (Privacy Code) as amended by Legislative Decree No. 101/2018, hereby provides this privacy notice pursuant to Articles 13 and 14 of the GDPR, regarding the processing of your personal data for the purposes and in the manner set forth below.

Last updated: October 2026

The term “processing of personal data” refers to any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

We inform you that such data will be processed manually and/or with the support of computerized or electronic means for the following purposes.

Important Notice on Generative Artificial Intelligence

MasterAi is a service that uses generative artificial intelligence to produce game master narratives, character interactions, and immersive role-playing content. When you interact with MasterAi:

Your text prompts and interactions are processed by third-party generative AI providers, primarily based in the United States.
The Services may also generate illustrations of scenes and characters. Prompts for these illustrations are derived automatically from your gameplay by the AI and are transmitted to third-party image generation providers.
The AI may occasionally produce inaccurate, biased, or unexpected content.
You should not enter sensitive personal data, financial information, health information, or other confidential information into the AI prompts.
AI-generated content is provided for entertainment purposes only and does not constitute professional advice of any kind.

Transfers of data to AI providers located outside the European Economic Area are based on Standard Contractual Clauses approved by the European Commission under Decision 2021/914, in compliance with Article 46 of EU Regulation 2016/679.

1- Purposes of Personal Data Processing and Legal Basis

1.1 Purposes related to the provision of requested services.
- The processing of the required personal data aims to properly and completely establish and execute ongoing contractual relationships with you, and more specifically to effectively manage the contractual relationship and to fulfill the legal and contractual obligations arising from it.
1.2 Purposes of compliance with obligations under the law, regulations, or EU legislation.
- Personal data will also be processed to comply with obligations required by law, by a regulation, or by European Union legislation, and for civil, accounting, and tax purposes.
1.3 Purposes for Advertising and Promotional Communication
- Personal data will be processed to allow the sending of commercial communications via email about products similar to those that have already been the subject of a commercial relationship between the data subject and the Data Controller, in accordance with Article 130, paragraph 4, of the Code.
1.4 Fraud prevention purposes
- Limited categories of pseudonymized data (cryptographic hash of the email address used at the time of account deletion) are processed to prevent abuse of the welcome bonus system, where the same individual could otherwise repeatedly create and delete accounts to obtain the new-user welcome tokens multiple times. See Section 13 below for full details.

Legal Basis

The processing of personal data for the purposes set out in points 1.1 and 1.2 above is based on:

Article 6, paragraph 1, letter (b) of the GDPR: processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
Article 6, paragraph 1, letter © of the GDPR: processing is necessary for compliance with legal obligations to which the Data Controller is subject (in particular, civil, accounting, and tax obligations under Italian law).

The processing of personal data for the purposes referred to in point 1.3 above (direct marketing of similar products to existing customers) is based on the legitimate interest of the Data Controller pursuant to Article 6, paragraph 1, letter (f) of the GDPR, in conjunction with Article 130, paragraph 4, of the Italian Privacy Code (D.Lgs. 196/2003, as amended) which permits soft opt-in for direct marketing of products similar to those already purchased. The data subject retains the right to object to such processing at any time, easily and free of charge.

The processing of pseudonymized data for fraud prevention purposes referred to in point 1.4 is based on the legitimate interest of the Data Controller pursuant to Article 6, paragraph 1, letter (f) of the GDPR, with the legitimate interest being the protection of the welcome bonus system from systematic abuse.

2- Communication and Dissemination of Personal Data for the Pursuit of Primary Processing Purposes

Pursuant to Article 13, paragraph 1, letter (e) of the GDPR, the following categories of subjects may receive the user’s personal data as recipients or as processors acting on behalf of the Data Controller:

Staff of the Data Controller assigned to administrative and accounting management and marketing activities;
Personnel responsible for the maintenance and/or repair of computer equipment;
Personnel responsible for surveys and service provision;
Labor consultants and/or accounting firms, acting as managers;
Credit institutions;
Commercial information companies;
Professionals and consultants of the Data Controller;
Third-party generative AI providers, who process user prompts to generate game content;
Third-party image generation providers, who process automatically derived prompts to generate in-game illustrations;
Cloud infrastructure and content delivery providers for data storage, service operation, and security.

Furthermore, for the pursuit of the purposes indicated in point 1, the data may be communicated to any other third party when the communication is mandatory by law or contract.

a- Mandatory or Optional Consent for the Pursuit of Primary Data Processing Purposes

In all the cases illustrated above in Paragraphs 1 and 2 (for cases of communication to third parties) - and based on the applicable rules of the Privacy Code and the EU Regulation - the provision of personal data is strictly necessary for the performance of the activities referred to in points 1.1 and 1.2.

Any failure to provide the data referred to in points 1.1 and 1.2 above, in whole or in part, could result in the Data Controller’s inability to execute the contract or to properly fulfill all obligations, such as those of a remunerative, tax, and insurance nature, related to the contractual relationship.

b- Data Retention Period and Other Information

In compliance with the principles of lawfulness, purpose limitation, and data minimization, pursuant to Article 5 of the GDPR, personal data will be stored for the period necessary to achieve the purposes for which they are collected and processed according to the criteria specified below pursuant to Article 13, paragraph 2, letter (a) of the GDPR:

For the purposes referred to in points 1.1 and 1.2 above (contract performance, legal obligations): 10 years from the termination of the contractual relationship, in compliance with Italian civil and tax record-keeping obligations (Article 2220 of the Italian Civil Code);
For the purposes referred to in point 1.3 above (direct marketing): 24 (twenty-four) months from the last interaction with the data subject, in compliance with the guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali, Provision of 24 February 2005 and subsequent confirmations, most recently in 2024). The retention period may be terminated earlier upon the data subject’s objection;
For the purposes referred to in point 1.4 (fraud prevention): pseudonymized data are retained for a maximum of 12 (twelve) months from the date of account deletion, after which they are automatically and irreversibly removed.

3- Transfer of Personal Data

Pursuant to Article 13, paragraph 1, letter (f) of the GDPR, the user is informed that the collected personal data will be processed and stored as described below.

3.1 Storage of player chat data and application data

User chat data, account information, game state, and AI-generated in-game illustrations are stored on cloud infrastructure provided by:

Amazon Web Services Inc. (AWS) — region: Europe (Frankfurt), eu-central-1, within EU territory in compliance with Article 44 GDPR. Privacy information available at: https://aws.amazon.com/privacy/

3.2 Transfer to AI and image generation providers

When you interact with MasterAi’s game master features, your text prompts are transmitted in real time to third-party generative AI providers. The provider processes the prompt and returns a generated response, which is then displayed within the application.

The Services may also generate illustrations of scenes and characters. The prompts used for these illustrations are derived automatically by the AI from your gameplay and are transmitted to third-party image generation providers; the resulting images are stored on our cloud infrastructure as described in Section 3.1.

Where these providers are located outside the European Economic Area, transfers are based on Standard Contractual Clauses approved by the European Commission under Decision 2021/914, in compliance with Article 46 of EU Regulation 2016/679. These providers are contractually bound to confidentiality and data protection standards equivalent to those required by the GDPR.

3.3 Email communications

Email communications are processed using Google Workspace (Gmail). Privacy information available at: https://policies.google.com/privacy

3.4 Content delivery, security, and infrastructure

Content delivery, security, and traffic optimization services are provided by third-party infrastructure providers. Where such providers are located outside the European Economic Area, transfers are based on Standard Contractual Clauses approved by the European Commission.

a- Existence of Automated Decision-Making Process, Including Profiling

The Data Controller does not adopt any automated decision-making process producing legal effects or similarly significantly affecting the user, as per Article 22, paragraphs 1 and 4, of EU Regulation No. 679/2016. Generative AI is used solely to produce entertainment content for role-playing gameplay and does not produce decisions with legal or significant effects on users.

The fraud prevention mechanism described in Section 13 below performs an automated comparison between cryptographic hashes for the limited and proportionate purpose of determining whether to allocate the new-user welcome bonus. This processing does not produce legal effects on the user nor significantly affect them: in case of match, the user can still create the account and use all features of MasterAi, with the only difference being that the welcome bonus tokens are not granted.

b- Objection to Processing for Promotional and Marketing Purposes

The data subject may object at any time to the processing carried out for the purpose referred to in point 1.3 above, by sending an informal, clear communication to that effect to the email: [email protected]. Upon receipt of such opt-out request, the Data Controller will promptly proceed to remove and delete the data from the databases used for the aforementioned purpose and inform any third parties to whom the data have been communicated for the same deletion purposes. The mere receipt of the deletion request will automatically serve as confirmation of the deletion.

It is specifically and separately informed, as required by Article 21 of the EU Regulation, that if personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such purposes, and that if the data subject objects to processing for direct marketing purposes, the personal data may no longer be processed for such purposes.

c- Processing Methods

The processing of data for the purposes set out takes place both through automated means, on electronic or magnetic media, and through non-automated means, on paper, in compliance with the rules of confidentiality and security provided by law, by subsequent regulations, and by internal provisions. The data will be processed by subjects authorized to carry out the tasks referred to in point 1, constantly identified, appropriately trained, and made aware of the security obligations provided by the Code, the EU Regulation, and the provisions set forth by the Data Controller.

4- Data Controller and Data Processors

The identifying details of the Data Controller are as follows:

MasterAi S.R.L.S., located at Via degli Aceri 77, 00172 Roma, with Tax Identification Number and VAT Number 17291571002, email [email protected], certified email (PEC) [email protected].

The contact point for exercising rights under the GDPR (Articles 15-22) is MasterAi S.R.L.S., located at Via degli Aceri 77, 00172 Roma, email [email protected].

The identifying details of the principal Data Processors are as follows:

For application development and operation:
- OpenQuery Ltd., George House, 39 Fitzroy Square, London, England
For cloud infrastructure (data storage and processing):
- Amazon Web Services Inc. (AWS), Europe (Frankfurt) region — privacy: https://aws.amazon.com/privacy/
For generative AI content generation:
- Third-party generative AI providers. Where located outside the European Economic Area, transfers are based on Standard Contractual Clauses (Decision 2021/914 of the European Commission).
For image generation:
- Third-party image generation providers. Where located outside the European Economic Area, transfers are based on Standard Contractual Clauses (Decision 2021/914 of the European Commission).
For content delivery and security:
- Third-party infrastructure providers. Where located outside the European Economic Area, transfers are based on Standard Contractual Clauses.
For advertising:
- Google Ireland Limited (AdMob — also acts as mediation platform)
- Meta Platforms Ireland Limited (Meta Audience Network, delivered via AdMob mediation)
For email communication:
- Google Italy S.r.l., Via F. Confalonieri 4, 20100 Milan
For accounting:
- Dr. Stefano Fulvi, Via di Villa Patrizi 13, 00161 Rome

The updated list of Data Processors is maintained by the Data Controller and can be requested at [email protected].

5- Children’s Privacy

MasterAi is intended for users aged 13 years and older. We do not knowingly collect personal information from children under the age of 13.

If you are a parent or guardian and you become aware that your child under 13 has provided personal information to MasterAi, please contact us immediately at [email protected]. Upon verification of the request, we will promptly delete all personal information associated with the minor’s account.

In the European Union, the age of digital consent varies by country (between 13 and 16 years). For users in the European Union, MasterAi requires verifiable parental consent for users under the age of 16, in compliance with Article 8 of the GDPR. In Italy specifically, the age threshold is 14 years.

We comply with the U.S. Children’s Online Privacy Protection Act (COPPA) and do not knowingly direct our service toward children under 13. The application is rated 13+ on Google Play Store and equivalent app distribution platforms.

6- Exercise of Rights by the Data Subject

Pursuant to Articles 15-22 of EU Regulation 2016/679, the data subject is informed that they have the right to:

Request confirmation of the existence or non-existence of their personal data;
Obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated, and, when possible, the retention period;
Obtain the rectification and deletion of data;
Obtain the limitation of processing or object to processing;
Obtain data portability, i.e., receive their data from a Data Controller in a structured, commonly used, and machine-readable format, and transmit it to another Data Controller without hindrance;
Revoke consent at any time without affecting the lawfulness of processing based on consent given before revocation;
Lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali), following the procedures and indications published on the official website of the Authority at www.garanteprivacy.it.

Any rectifications or deletions or limitations of processing carried out at the request of the data subject - unless this proves impossible or involves disproportionate effort - will be communicated by the Data Controller to each of the recipients to whom the personal data have been transmitted.

The exercise of rights is not subject to any formal constraint and is free of charge. It can be exercised by sending a registered letter with return receipt to the address MasterAi S.R.L.S., Via degli Aceri 77, 00172 Roma, or via email to [email protected].

Acknowledgment of receipt

The Data Controller will respond to the request without undue delay and in any case within one month of receipt, in compliance with Article 12 paragraph 3 of the GDPR. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

7- Detailed Explanation of Your GDPR Rights

This section applies to users located in the European Economic Area (EEA) and outlines your rights under the General Data Protection Regulation (GDPR).

a) Right to Access You have the right to obtain confirmation about whether we process your personal data and, if so, to access this data and information about how we process it.

b) Right to Rectification You have the right to have inaccurate personal data corrected or incomplete data completed.

c) Right to Erasure (‘Right to be Forgotten’) You have the right to request the deletion of your personal data, subject to applicable laws and regulations. You can make this request using any of the methods outlined above.

Note on fraud prevention pseudonymized data: Following account deletion, a pseudonymized hash of your email is retained for up to 12 months for fraud prevention purposes, on the basis of the Data Controller’s legitimate interest under Article 6.1.f and Article 17.3.b GDPR. If you specifically wish this hash to be deleted before the standard 12-month period, you may request it at [email protected]. The Data Controller will perform a balancing of interests on a case-by-case basis.

d) Right to Restrict Processing You can request that we restrict the processing of your personal data in certain cases, for example, if you contest the accuracy of the data.

e) Right to Data Portability You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit this data to another controller.

f) Right to Object You have the right to object to the processing of your personal data in certain circumstances, particularly regarding processing for direct marketing purposes.

g) Rights Related to Automated Decision-making and Profiling You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. As stated in section 3a above, we do not perform automated decision-making with legal or significant effects on users.

h) Right to Withdraw Consent Where we process your data based on consent, you have the right to withdraw this consent at any time.

Limitations and Responses

We may need to retain certain information for legal or legitimate business purposes. If we cannot comply with your request, we will explain the reasons within the response timeframe mentioned above.

Complaints

If you believe that our processing of your personal data infringes data protection laws, you have the right to lodge a complaint with a supervisory authority responsible for data protection (in Italy, www.garanteprivacy.it).

No Fee Usually Required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

8- Cookies and Similar Technologies (“Tracking Technologies”)

What are cookies and tracking technologies?

Cookies are small data files, typically of letters and numbers, that are placed by a web server on your device. We and companies we work with may use cookies and similar technologies, including pixel tags, web beacons, mobile analytics features, and mobile identifiers (collectively, “tracking technologies”) to collect information for many reasons, such as to keep you logged in to your account, remember your preferences and settings, analyze usage of our Services, measure the performance of our Services and advertising campaigns, and ensure security on our Services.

What types of tracking technologies do we use?

Type	Description
Strictly Necessary	Necessary to provide our Services to you. They help you navigate from page to page, stay logged into your account, and enable security features.
Functional	Collect information about how you use our Services, provide certain functions, and remember your preferences.
Analytics, Performance and Research	Help us understand how well our Services are performing and how to improve them.
Marketing	Allow us to collect information about your interactions with our marketing activities and measure the performance of our Services and advertising campaigns.

Our Website (rpgmaster.ai)

This Section 8 applies both to the MasterAi application and to our website at rpgmaster.ai. On the website we use the following technologies.

Strictly necessary and security cookies. The website is delivered through Cloudflare, Inc., which may set strictly necessary cookies for security, bot detection and traffic routing (for example __cf_bm). They are used only to deliver and protect the website and never for advertising.

Audience measurement without cookies. We use Cloudflare Web Analytics, which does not use cookies, does not store any identifier on your device and does not follow you across websites. It processes your IP address and the technical characteristics of your request for the sole purpose of producing aggregate statistics about the website, on the basis of our legitimate interest under Article 6(1)(f) GDPR.

Google Ads measurement — visitors in the United States only. We advertise MasterAi on Google platforms with campaigns directed exclusively at the United States. For this purpose, and only when the country of your visit is identified as the United States by the content delivery network that serves the website, we load the Google Ads tag (gtag.js) of Google LLC, 1600 Amphitheatre Parkway, Mountain View, California. The tag sets first-party cookies on rpgmaster.ai (for example _gcl_au) and may set or read Google cookies, for the sole purpose of measuring whether a visit that originated from one of our advertisements ended with a click on the “Get it on Google Play” or “Download on the App Store” button. We receive aggregate campaign statistics only. Google processes these data both on our behalf and, for its own purposes described at https://policies.google.com/privacy, as an independent controller. Where Google transfers data outside the European Economic Area, the transfer relies on the EU-U.S. Data Privacy Framework and on the Standard Contractual Clauses approved by the European Commission under Decision 2021/914. The legal basis for this measurement is our legitimate interest in understanding whether our advertising works (Article 6(1)(f) GDPR), together with your right to opt out described below.

Visitors outside the United States. If the country of your visit is not identified as the United States — including every visit identified as coming from the European Economic Area, the United Kingdom or Switzerland — the Google Ads tag is not loaded at all: no Google advertising cookie is written and no advertising request is sent to Google from the website. If the country cannot be determined, the tag is not loaded either. This is why the website shows no cookie consent banner: the technologies that remain are either strictly necessary or work without cookies, and therefore require no consent.

Your choices, wherever you are. You can opt out of the Google Ads measurement described above at any time by any of the following means: (i) enabling the Global Privacy Control signal in your browser or browser extension — when that signal is present we do not load the Google Ads tag (see Section 9.3); (ii) using the “Your Privacy Choices” link in the footer of the website; (iii) blocking or deleting cookies in your browser settings; or (iv) writing to [email protected]. Opting out does not limit your use of the website or of the application in any way.

Campaign parameters in links. If you reach us from one of our advertisements, the links to the Google Play Store and to the Apple App Store may carry campaign parameters (for example utm_source, referrer, ct) so that the stores can attribute the installation to that campaign. These parameters travel inside the link only: they are not stored on your device, and the store then processes them under its own privacy policy.

Google AdMob

Provider: Google Ireland Limited
Purpose: Advertising
Collected Personal Data: Tracking tools, usage data, unique device identifiers for advertising (Google Advertiser ID)

For more details on Google’s data usage, refer to their Partner Policy and AdMob Partners.

You can opt-out from AdMob by following the instructions described by Google: https://support.google.com/ads/answer/2662922?hl=en

Meta Audience Network

Provider: Meta Platforms Ireland Limited
Purpose: Advertising (delivered via Google AdMob mediation)
Collected Personal Data: Device identifiers, IP address, usage data
Privacy Policy: https://www.facebook.com/about/privacy
Opt-out: https://www.facebook.com/help/568137493302217

MasterAi uses Google AdMob mediation to deliver advertisements from multiple ad networks, including Meta Audience Network. Through this mediation, the ad networks listed above may receive limited information (such as device identifiers and IP address) to provide and measure the performance of advertising. Each ad network operates as an independent data controller for the data it processes for advertising purposes.

9- U.S. State Privacy Rights

If you are a resident of a U.S. state with a comprehensive consumer privacy law, you have specific rights regarding your personal information. MasterAi respects these rights and provides the following information.

9.1 California (CCPA / CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to know what personal information we collect, use, disclose, and sell or share;
Right to delete personal information we have collected from you;
Right to correct inaccurate personal information;
Right to opt-out of the sale or sharing of your personal information;
Right to limit use and disclosure of sensitive personal information;
Right to non-discrimination for exercising your privacy rights.

We do not sell your personal information as defined under the CCPA. We use data for advertising via Google AdMob mediation and Meta Audience Network, which under CCPA may be considered “sharing” for cross-context behavioral advertising. California residents may opt-out by emailing [email protected] with subject line “California Opt-Out”.

California residents may also opt out of the sharing described in Section 8 for our website by using the Your Privacy Choices link in the footer of rpgmaster.ai, or by transmitting a Global Privacy Control signal, which we process as a valid opt-out request in a frictionless manner, with no need to create an account or to provide any additional information.

To exercise any other right, contact [email protected]. We will respond within 45 days as required by the CCPA.

9.2 Other U.S. State Privacy Rights

As of 2026, the following U.S. states have enacted comprehensive consumer privacy laws that may grant you additional rights: Colorado (Colorado Privacy Act), Connecticut (CTDPA), Delaware (DPDPA), Florida (FDBR), Indiana (INCDPA), Iowa (ICDPA), Kentucky (KCDPA), Maryland (MODPA), Minnesota (MCDPA), Montana (MCDPA), Nebraska (NEDPA), New Hampshire (NH SB 255), New Jersey (NJ SB 332), Oregon (OCPA), Rhode Island (RIDTPPA), Tennessee (TIPA), Texas (TDPSA), Utah (UCPA), and Virginia (VCDPA).

If you reside in one of these states, you generally have the following rights with respect to your personal data:

Right to know / access: confirm whether we process your personal data and obtain a copy;
Right to delete: request the deletion of personal data we have collected from you;
Right to correct: request the correction of inaccurate personal data (most states except Iowa and Utah);
Right to data portability: receive your data in a portable, machine-readable format;
Right to opt-out of targeted advertising: opt-out of the processing of personal data for purposes of targeted advertising;
Right to opt-out of sale: opt-out of the sale of personal data, where applicable;
Right to opt-out of profiling: opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not perform such profiling, see Section 3a);
Right to appeal: appeal a denial of a privacy rights request (Virginia, Colorado, Connecticut, and most other state laws).

To exercise any of these rights, contact [email protected] with subject line indicating your state of residence and the right you wish to exercise. We will respond within the timeframe required by the applicable state law (typically 45 days, extendable by 45 additional days for complex requests).

9.3 Global Privacy Control (GPC) Signal

In compliance with the privacy laws of California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, New Hampshire, New Jersey, Oregon, Texas, and other states that recognize universal opt-out mechanisms, MasterAi honors the Global Privacy Control (GPC) signal. If your browser or device transmits a GPC signal, we will treat it as a valid opt-out request for the sale or sharing of your personal information.

We currently do not respond to legacy “Do Not Track” browser signals, as these have been deprecated in favor of the GPC standard.

9.4 Sensitive Personal Information

Several U.S. state laws provide additional protections for “sensitive personal information” (which may include precise geolocation, racial or ethnic origin, religious beliefs, health information, sexual orientation, citizenship status, biometric data, and children’s data). MasterAi does not knowingly collect, use, or disclose sensitive personal information of users, except as strictly necessary to provide the Services. We do not sell sensitive personal information.

9.5 Children and Minors

Several state laws (particularly California, Connecticut, and Maryland under the Age-Appropriate Design Code) provide enhanced protections for minors. As stated in Section 5, MasterAi is intended for users aged 13 and older and we do not knowingly collect data from children under 13.

Do Not Sell or Share My Personal Information — Your Privacy Choices

MasterAi does not sell personal information for money. For U.S. visitors, the advertising measurement described in Section 8 may qualify as “sharing” for cross-context behavioral advertising under California law. You can stop it in any of these ways, at no cost and without creating an account:

Automatic (recommended): enable Global Privacy Control in your browser or in a browser extension. We read that signal on every page and, when it is present, the advertising tag is not loaded at all.
In your browser: block or delete cookies for rpgmaster.ai.
By email: write to [email protected] with the subject “Opt-Out”. We reply within 45 days, as required by California law.

The same choices are available to residents of every other U.S. state and to visitors from any country.

10- Data We Collect

A. Data Collected Automatically

Device identification data, operating system, language;
Usage data and game session metadata;
IP address (for security and geolocation);
Crash reports and diagnostic information;
The approximate country of your visit to our website, derived from your IP address by the content delivery network that serves it, used only to decide whether the advertising measurement tag described in Section 8 may be loaded.

B. Data You Provide Us

Email address (for account registration and communication);
Game preferences and settings;
Text prompts entered into the AI game master interface;
Payment information (processed by Google Play, not stored by MasterAi).

C. Data Generated by the Services

AI-generated narrative content produced in response to your prompts;
In-game illustrations of scenes and characters. The prompts used to generate these illustrations are derived automatically by the AI from your gameplay and are not written by you.

Customer Support

If you contact us through our support system at [email protected] or [email protected], we keep your email and a copy of that correspondence for the duration necessary to respond and resolve your inquiry.

11- Sensitive Information

We will not actively obtain or record sensitive information (racial or ethnic origin, political opinions, religious beliefs, health information, etc.).

Important note on AI prompts: Users are advised NOT to enter sensitive personal information into AI prompts. Prompts pass through an AI gateway whose logs are retained for a maximum of 24 hours. Our AI providers process prompts under contractual terms that limit retention to what is necessary for service provision and abuse prevention. MasterAi cannot guarantee the absence of incidental processing of sensitive information voluntarily provided by the user. Users assume responsibility for the content of prompts they submit.

12- Account Deletion

You can delete your account at any time directly from within the MasterAi application, in the account settings section. Account deletion is also available via the web at https://rpgmaster.ai/account-deletion or by emailing [email protected].

When you delete your account:

Your email, game state, character data, chat history, generated in-game illustrations, and personally identifiable information are permanently and irreversibly removed from our systems and from active database storage.
Backup copies are overwritten according to our standard backup rotation policy (typically within 30 days).
A pseudonymized cryptographic hash derived from your email address is retained for up to 12 months for fraud prevention purposes only (see Section 13 for details). This pseudonymized data does not allow MasterAi to identify you, contact you, or reconstruct your email; it serves exclusively to detect repeated welcome bonus claims by the same email address.

After 12 months from account deletion, the pseudonymized hash is automatically and irreversibly removed by an automated cleanup process.

13- Fraud Prevention — Welcome Bonus System

MasterAi grants new users a one-time welcome bonus of game tokens upon first registration. To prevent abuse of this system (where a single individual could repeatedly create and delete accounts using the same email to obtain multiple welcome bonuses), MasterAi implements a privacy-preserving fraud prevention mechanism.

13.1 How it works

When a user deletes their account, MasterAi retains a single piece of pseudonymized data: a cryptographic hash of the email address used at the time of deletion. The hash is computed using a one-way cryptographic function combined with a server-side secret. This means:

The hash is irreversible: it is mathematically infeasible to reconstruct the original email from the hash.
The hash is unique per email: the same email always produces the same hash, but two different emails produce two completely different hashes.
Without the original email, the hash cannot be linked to any individual: MasterAi cannot use this hash to identify, contact, or profile any user.

When a new user registers, MasterAi computes the hash of their email and checks whether it matches any hash retained from previously deleted accounts (within the 12-month retention window). If a match is found, the welcome bonus is not granted, but the user can still create the account and use all features of MasterAi normally.

13.2 Why this is privacy-friendly

Minimization: only one piece of pseudonymized data is retained — no IP, no name, no device ID, no behavioral data.
Limited purpose: the hash is used solely to determine welcome bonus eligibility, never for marketing, profiling, or any other purpose.
Limited duration: 12 months maximum, after which automatic deletion occurs.
No automated decisions with significant effects: the user can always create and use their account normally; only the welcome bonus is affected.
Pseudonymization (Article 4(5) GDPR): the data is processed in a manner that the data subject can no longer be identified without additional information (the original email).

13.3 Legal basis

The processing is based on the legitimate interest of the Data Controller pursuant to Article 6(1)(f) of the GDPR, namely the protection of the welcome bonus system from systematic abuse. The legitimate interest has been balanced against the fundamental rights and freedoms of data subjects, taking into account:

the limited and pseudonymized nature of the data retained;
the limited retention period (12 months);
the absence of any significant effect on the user (the account can still be created and used);
the user’s reasonable expectation that an anti-abuse measure is in place when a welcome bonus is offered.

13.4 Your rights regarding fraud prevention data

You can request the early deletion of your fraud prevention hash (before the standard 12-month period) by contacting [email protected]. The Data Controller will perform a case-by-case balancing of interests pursuant to Article 17(3)(b) GDPR. If the balancing favors deletion, the hash will be removed; otherwise, the Data Controller will explain the reasoning and the hash will remain until natural expiration.

You also have the right to object to this processing under Article 21 GDPR. Such objections will be evaluated in accordance with the same balancing-of-interests test.

Contact for any privacy-related inquiry: [email protected]