Privacy Notice

1) Data Controller

Barril Games Corp. ("Barril Games", "we"), a corporation organized under the laws of Delaware, United States, is responsible for the processing of your personal data under this notice.

• Address: 2093 Philadelphia Pike PMB 3140, Claymont, DE 19703, United States
• Privacy contact: legal@barril.games

2) Scope

This notice applies to:

(a) The barril.games website and sign-up to our waitlist, which is a Typeform form that opens in another tab.

(b) The User Testing / playtesting process (recruitment, sessions, recordings — Annex A).

(c) Test builds and telemetry distributed via TestFlight (Apple) or Google Play (internal/closed testing).

The website and testing program are directed to persons in Mexico, the rest of Latin America and the United States. They are not directed to residents of the European Union, the European Economic Area, the United Kingdom or Brazil.

3) Key Terms

4) Personal Data We Collect

Data we do NOT collect: financial data, facial biometrics, precise geolocation, or data from persons under 18. The participation gift card is delivered without requesting bank details.

5) Purposes

Primary (necessary):

• Manage your waitlist registration and tell you about early access and the game’s launch.
• Assess your profile and eligibility for testing sessions; coordinate logistics and follow-up.
• Deliver the participation compensation ($200 MXN gift card) upon session completion.
• Internally analyze recordings and telemetry to improve the game (balance, usability, stability).
• Operate, secure, and debug the website and test builds; prevent fraud and abuse.
• Handle your rights requests and comply with legal obligations.

Secondary (optional — refusing does not affect the primary purposes):

• Send you news and updates about the game, only if you ticked the optional box in the waitlist form.
• Invite you to future testing rounds, only if you signed up for the User Testing program (Annex A).
• Non-essential advertising measurement and analytics (cookies), which are only turned on if you accept them.
• Measuring and improving our ads by sending your hashed email and phone number to Meta, TikTok and Reddit, only if you tick the optional box in the testing sign-up form (section 7).

6) Consent

Unless otherwise indicated, processing is based on your implied consent: by submitting our forms you consent to processing for the primary purposes. To receive news and updates about the game we ask for your consent with an optional box in the waitlist form; if you leave it unticked, we will only write to you about early access and the launch. Analytics and advertising-measurement cookies are not turned on until you accept them in the website’s cookie banner. Sending your hashed email and phone number to Meta, TikTok and Reddit requires that you tick the optional box in the testing sign-up form; if you don’t, your registration is not affected. Screen and voice recording in playtesting sessions requires your express written consent before the session. Attendance confirmation by automated phone call is activated when you leave a contact number; for new registrations, your express acceptance is requested in the recruitment form. You may object to secondary purposes at any time by replying to any of our emails or by writing to legal@barril.games.

7) Cookies and Tracking Technologies

We use technical cookies so the website works and, only if you accept them, analytics cookies (Google Analytics 4, through Google Tag Manager) and advertising-measurement cookies (Meta, TikTok and Reddit pixels). You can accept, reject or configure optional cookies in the website banner and change your choice at any time with the "Cookie settings" link at the bottom of any page. For now, the banner and the settings panel appear in Spanish on every page: "Aceptar todas" means accept all, "Rechazar opcionales" means reject optional cookies, "Configurar" opens the settings and "Guardar mis preferencias" saves your choice. Each cookie is listed in the table below. The Meta, TikTok and Reddit pixels also store technical data about your visit in your browser’s storage (localStorage and sessionStorage), under the same rules as their cookies.

Website security. The website is hosted by Elementor and reaches your browser through Cloudflare, the delivery and security network Elementor uses. To protect the website against bots and abuse, on every page Cloudflare analyzes technical signals from your browser and sets its technical cookies (__cf_bm, _cfuvid and cf_clearance, listed in the table above). Also, like any web server, Elementor and Cloudflare receive your IP address, your browser type, the address of the page you request and the time of each visit. This layer is needed for the website to work securely, so it is always on and does not depend on your choice in the cookie banner.

Website speed measurement. Elementor and Cloudflare also measure, on every page, how long each page takes to load. Our hosting provider runs this measurement, and it does not depend on your choice in the cookie banner: it stays on even if you reject optional cookies. Cloudflare receives the address of the page and of the page you came from (without campaign tags or other parameters), load times, your browser and operating system type, and some technical data about your device. Elementor receives the full address of the page, including any campaign tags or ad identifier it carries (for example, "utm_source" or "fbclid"), network times and the size of the response. Neither measurement tool uses cookies or stores anything in your browser, and Barril Games does not use this data for advertising.

Advertising pixels (Meta, TikTok and Reddit). If you accept advertising-measurement cookies, Meta, TikTok and Reddit receive data about your visit to the website: the pages you view, whether you open a form, identifiers of your browser and device, and your IP address. We use it to measure the results of our ads. From the website we do not send them your name, email, phone number or what you type into the forms. Each platform may also use this data under its own privacy policy: Meta (https://www.facebook.com/privacy/policy/ (opens in a new tab)), TikTok (https://www.tiktok.com/legal/page/us/privacy-policy/en (opens in a new tab)) and Reddit (https://www.reddit.com/policies/privacy-policy (opens in a new tab)).

Testing sign-up form: optional box. The sign-up form for our testing program (User Testing, Annex A) has an optional ad-measurement box. Only if you tick it do we send Meta, TikTok and Reddit, from our server, your email and phone number in hashed form, the identifiers of the ad that brought you (for example, Meta’s "fbc" and "fbp") and an identifier of your registration. "Hashed" means they go through a function that turns them into a string of characters; they cannot be read at a glance, but the platforms use it to recognize whether you saw or tapped one of our ads, so it is still personal data. We use it to measure and improve our ads. If you leave the box unticked, we send nothing to any advertising platform, and your registration is not affected. You can withdraw your consent at any time by writing to legal@barril.games; from then on we stop sending your data.

Campaign tags. If you reach the website from an ad or a link with campaign tags ("utm" parameters and the ad version), the website keeps them in your browser’s session memory for the duration of your visit, to know which campaign brought you. On their own they contain no personal data, and they are deleted when you close the tab or the browser. If you join the waitlist or sign up for the testing program, we link those tags to your registration to learn which campaign worked.

How to control them: use the "Cookie settings" link at the bottom of any page; limit or delete cookies in your browser settings; disable Google Analytics with Google’s official opt-out add-on; manage ad preferences in your Meta, TikTok and Reddit settings; or write to legal@barril.games to opt out of measurement purposes.

Global Privacy Control. If your browser sends the Global Privacy Control signal, on this website we treat it as a rejection of advertising-measurement cookies (Meta, TikTok and Reddit), even if you accepted them. In the testing sign-up form, which runs on Typeform, your box is what counts.

Do Not Track. Some browsers send a "Do Not Track" signal. Because there is no common standard for interpreting it, we do not commit to responding to it. To limit tracking, you can reject optional cookies, delete or block them in your browser, or write to legal@barril.games.

8) Processors and Transfers

These providers process data on our behalf (processors), under data processing agreements:

We do not sell your personal data for money. With the providers in the table, except Meta, TikTok and Reddit, we do not share your data for their own purposes. Cloudflare also uses technical data from the traffic that passes through its network (such as your IP address) to protect that network against attacks and abuse, under its privacy policy (https://www.cloudflare.com/privacypolicy/ (opens in a new tab)). Meta, TikTok and Reddit receive data only if you accept advertising-measurement cookies on the website or tick the box in the testing form, and may use it under their own policies (section 7). We will only disclose data without your consent where required by a competent authority or permitted by law. Providers may store data outside your country, primarily in the United States.

9) Minors

The website, waitlist, and User Testing process are directed exclusively to persons 18 or older. We do not knowingly collect data from minors; any detected registration by a minor will be deleted. If the game is later directed to children’s audiences, we will first publish a specific notice and verifiable parental consent mechanisms compliant with COPPA and applicable law.

10) Retention

11) Your Rights

Mexico (Federal Law on the Protection of Personal Data Held by Private Parties, DOF March 20, 2025): Access, Rectification, Cancellation, and Objection (ARCO), revocation of consent, and limitation of use or disclosure. We will respond within the statutory deadlines of the law.

United States (applicable state laws): know, access, correct, and delete your data, and opt out of sale or sharing for advertising. Using the Meta, TikTok and Reddit pixels and sending them your hashed email and phone number may count as "sharing" data for advertising under some of those laws. That is why it only happens if you accept advertising-measurement cookies (on the website) or tick the box (in the testing form). To opt out, reject advertising-measurement cookies with the "Cookie settings" link, send the Global Privacy Control signal (on the website), leave the box in the testing form unticked, or write to legal@barril.games. We do not sell data for money.

How to exercise them: write to legal@barril.games with (i) your full name, (ii) the email you registered with, (iii) a clear description of the right you wish to exercise, and (iv) any element that helps locate your data. We will verify your identity before responding. For recording-related requests, include your session date.

12) Revocation and Limitation

You can unsubscribe from the waitlist by replying to any of our emails, or request deletion, revoke consent, or limit use of your data at any time by writing to legal@barril.games. We will delete or anonymize your information except where retention is legally required. Revocation has no retroactive effect on processing already performed. You can withdraw your consent to optional cookies at any time with the "Cookie settings" link.

13) Automated Decision-Making

We do not make automated decisions with legal or similarly significant effects, with one operational exception: if you do not confirm your attendance at a scheduled session before a deadline, the system may automatically cancel that session to free up the slot. This cancellation does not penalize you or affect your eligibility to book future sessions. If you think it was cancelled by mistake, write to legal@barril.games and a person will review it. Playtester selection still includes human review.

14) Security

We apply reasonable administrative, technical, and physical safeguards: role-based access, encryption in transit, least-privilege accounts, and providers holding industry-standard security certifications. If a security breach significantly affects your rights, we will notify you as required by applicable law.

15) Changes to This Notice

We may update this notice. The current version, with its date, will always be available on the website; material changes will be communicated by email where appropriate. Changes to purposes requiring consent will not apply without obtaining it.

16) Acceptance

By submitting any of our forms you confirm you have read and accept this Privacy Notice with respect to the primary purposes. The secondary purpose of news and updates applies only if you tick the optional box; you can refuse the other secondary purposes at any time without affecting your registration.

Annex A — User Testing / Playtester Recruitment

(Applies specifically to those who register for the playtesting program.)

A.1 Data. Recruitment form: identification and contact (name, email, phone), profile (age range, gender, phone/OS, gaming habits and style, availability), and the campaign, ad and technical data listed in section 4. If selected and you participate: recording of your phone screen and voice during the session. We do not record your face or image.

A.2 Purposes. Primary. Assess eligibility; coordinate the session; track the recruitment pipeline; deliver the $200 MXN gift card; internally analyze recordings to improve the game. Secondary (optional). Invitations to future rounds — opt out at legal@barril.games. Measuring and improving our ads with your hashed email and phone number, only if you tick the ad-measurement box (section 7).

A.3 Express consent for recording. Voice recording may qualify as sensitive data. It is collected only if you agree to participate, with express written consent obtained before the session, and used exclusively internally. Retained for a maximum of 24 months.

A.4 Processors in the recruitment flow. Typeform (form) → n8n (automation) → Google Sheets/Workspace (candidate database). Only if you tick the ad-measurement box: n8n → Meta, TikTok and Reddit (section 7).

A.5 Age. The program is open only to persons 18+. We may ask you to confirm you are of legal age before the session.

A.6 Deletion and limitation. You may request removal or limitation of use at legal@barril.games; we will delete or anonymize your information except where retention is legally required.

A.7 Attendance confirmation calls. If you left a contact number, we may call you to confirm your attendance at the scheduled session. The call is answered by an automated voice assistant (artificial intelligence), which identifies itself as such at the start. We do not record the audio; we generate a transcript and a structured outcome (you confirmed, cancelled, asked to reschedule, or asked not to be called again) to follow up on your session. You can say "do not call me again" at any time and it is respected immediately and permanently. Processor: Telnyx LLC (United States) — see Section 8.