How we collect and manage your personal data.
Game: Xplot Tower Defense — Meta Quest
Publisher and data controller: AAA Game Studios S.L.
Developer: Lenya Digital
Version: 2.0
Last updated / effective: 25 August 2026
In short: the game uses the player’s Meta/user ID only to identify the player and operate/display leaderboard entries. It does not require an email address or request access to other Meta account or user information.
This Privacy Policy explains how AAA Game Studios S.L. (“AAA Game Studios”, “we”, “us” or “our”) processes personal data in connection with the Meta Quest game Xplot Tower Defense (the “Game”). It applies only to processing controlled by AAA Game Studios. Meta separately processes information to operate the Meta Quest platform, accounts and store under Meta’s own terms and privacy notices.
AAA Game Studios is the publisher and data controller. Lenya Digital is the Game’s developer. If Lenya Digital is given access to personal data on AAA Game Studios’ behalf, it will process that data only under AAA Game Studios’ instructions and appropriate confidentiality and data-processing obligations.
The Game is designed to use a very limited set of data. AAA Game Studios processes the categories below. “Process” includes accessing, using, transmitting or storing data, as applicable to the relevant function.
Data minimisation. The Game does not require an email address and does not request access to other Meta/user information such as the player’s email, contacts, friends list, payment information, precise location, voice recordings, camera images or biometric information.
We do not sell personal data. We do not use the limited data described here for behavioural advertising, data-broker activity, unrelated marketing or profiling. Leaderboard ordering is an automated calculation based on gameplay results, but it does not produce legal effects or similarly significant effects for the player.
The Meta/user ID and the leaderboard result linked to it are required only for the leaderboard functionality described above. If that data cannot be processed, the Game may be unable to identify or display the player correctly on the leaderboard. An email address is optional and is not required to install or play the Game; without it, we may be unable to reply by email to a support request.
We keep personal data only for as long as necessary for the purposes stated in this Policy:
If residual copies exist in secure backups, they will remain protected and will be deleted or overwritten through the applicable backup cycle, unless preservation is legally required.
Personal data is kept within AAA Game Studios’ controlled environment and is accessible only to authorised personnel who need it for the purposes above. We do not sell personal data or share it with independent third parties for their own commercial purposes.
Where necessary, a developer or technical service provider may process data on our behalf—for example, Lenya Digital if it needs access to support or maintain the Game, or a hosting/IT provider if one is used. Any such provider must act on our documented instructions, use the data only to provide the contracted service, protect it appropriately and delete or return it when required.
We may disclose data to courts, regulators, law-enforcement bodies or other public authorities where required by applicable law, a valid legal process, or where necessary to establish, exercise or defend legal claims.
Based on the information currently available for the Game, AAA Game Studios does not plan to transfer the personal data described in this Policy outside the European Economic Area. If a necessary service provider later involves an international transfer, we will ensure a valid transfer mechanism and appropriate safeguards, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, and will provide information about the applicable safeguard on request.
We apply technical and organisational measures appropriate to the limited nature of the data and the relevant risks. These measures are designed to protect confidentiality, integrity and availability and to prevent unauthorised access, alteration, loss or disclosure. They include, as appropriate, limiting access to authorised persons, secure development and maintenance practices, protected transmission and storage, vulnerability management and incident-response procedures. No system can be guaranteed completely secure.
The Game may be used only in accordance with the age eligibility, parental supervision and store-rating requirements that apply to the player’s Meta account and region. The Game does not ask the player to provide an age or an email address and does not intentionally request additional personal data from children.
Where processing is based on consent under Spanish law, a child’s own consent is valid only from age 14; consent for a child under 14 must be provided or authorised by a parent or legal guardian, unless another lawful basis applies. A parent or guardian may contact us to exercise rights for a child or ask us to delete the child’s data.
Subject to the conditions in the GDPR and Spanish Organic Law 3/2018 (LOPDGDD), you may ask us to:
Rights requests are free of charge. We normally respond within one month. That period may be extended by up to two further months where permitted by law because of complexity or the number of requests; if so, we will explain the extension. We may request only the limited information reasonably necessary to verify identity and match the request to the correct record.
You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), particularly if you believe your request has not been handled properly: www.aepd.es.
Every user, regardless of region, may request deletion of personal data held for the Game. No fee is charged.
If a legal obligation or claim requires limited retention, we will explain the reason and restrict the retained data to that purpose. Protected backup copies may be overwritten later through the applicable backup cycle.
We may update this Policy to reflect changes to the Game, our processing or applicable requirements. The current version and date will appear at the top. For a material change, we will provide additional notice through an appropriate channel where reasonably possible, and we will obtain any notice or consent required by law.
Questions, rights requests and deletion requests may be sent to:
AAA GAMES STUDIOS, S.L.
Calle Poeta Joan Maragall, 22, 1º
CP 28020, Madrid, Spain
CIF: B-88246574
Email: users@aaagamestudios.com