1. Who is the controller and the Data Protection Officer
The controller of personal data processed by the TopGames platform is Diogo Véras. For purposes of the Brazilian LGPD (Law No. 13.709/2018), the controller is the party that decides about personal data processing.
Data Protection Officer (DPO), as per art. 41 of LGPD: requests and communications about data protection can be directed to the channel below, which is the contact point between you, the controller and the ANPD (Brazilian data protection authority).
- DPO: Diogo Véras.
- DPO contact channel: support@topgames.app.br.
Note on size: TopGames is treated as a small-size agent under Brazilian Res. CD/ANPD No. 2/2022. In that condition, appointing a DPO is optional, but the Platform chose to keep an identified communication channel with the data subject as a good-faith governance measure.
2. Data collected
We collect the following personal data:
| Category | Data | Origin |
|---|---|---|
| Identification | name, email, profile picture | registration / social login (Google) |
| Authentication | password (encrypted), session tokens | registration / login |
| Payment | last 4 digits of card, subscription status, billing history | Paddle as Merchant of Record (we do not store full card data; payment via card, PayPal, Google Pay, Apple Pay or Pix depending on the country) |
| Usage | games played, playtime, sessions, achievements, settings | launcher and games |
| Technical | IP, device identifier, operating system, launcher version | launcher (anti-fraud and device binding) |
| TikTok LIVE | TikTok @username, gifts received during the live, aggregated counters | TikTok LIVE integration (only during active use) |
| Voice (optional features) | text you type for speech conversion; audio sent for voice features, when you use those features | voice features in the launcher/games (TTS and voice conversion) |
We do not collect sensitive data (LGPD art. 5, II) and we do not use advertising tracking cookies on the site. Voice features are optional and are only triggered when you actively use them.
3. Processing purposes
We process your data for the following purposes:
- authenticate your account and prevent unauthorized use;
- process the Subscription, charges and renewals via payment providers;
- provide access to Catalog games and manage the license;
- enforce the bond between account and device as anti-fraud;
- integrate with TikTok LIVE during active use of the feature (gifts → in-game actions);
- save game progress and settings on your device (and optionally in the cloud);
- provide optional voice features (TTS speech synthesis and voice conversion), processing the text or audio you provide;
- answer questions, support and refund requests;
- comply with legal obligations (tax, regulatory and judicial);
- analyze aggregated Platform usage for service improvement (with no individual identification).
4. Legal bases
Each purpose is supported by a LGPD legal basis:
| Purpose | Legal basis (LGPD art. 7) |
|---|---|
| Authentication, account and license | contract execution (V) |
| TikTok LIVE integration (opt-in) | consent (I) |
| Voice features / TTS (opt-in) | consent (I) |
| Payment and billing | contract execution (V) + legal obligation (II) |
| Anti-fraud (device binding, IP) | legitimate interest (IX) |
| Support and service | contract execution (V) |
| Legal/tax compliance | compliance with legal obligation (II) |
| Account communications | contract execution (V) |
| Aggregated usage analysis | legitimate interest (IX), with anonymization |
5. Who we share with (processors and subprocessors)
To run the Platform we rely on providers that process personal data on our behalf (processors, art. 5, VII of LGPD). Each one handles only what is strictly needed for its function and is, or will be, bound by a data processing agreement (DPA). The list below is kept up to date:
| Processor | Function | Data accessed | Location |
|---|---|---|---|
| Supabase | database and authentication | identification, authentication, usage, technical data | United States |
| Railway | application server hosting | data in transit during Platform use | United States |
| Cloudflare R2 | storage for builds, updates and cloud saves | game files and saves; technical identifiers | United States / global |
| Paddle.com Market Limited | payment processing as Merchant of Record, responsible for payment methods (card, PayPal, Google Pay, Apple Pay, Pix) and for tax obligations on charges | email, name (when provided by the payment method), amount, transaction identifiers, status, country and last 4 digits of card (when applicable) | United Kingdom / United States |
| ElevenLabs | speech synthesis (TTS) for voice features | text you provide for speech conversion | United States |
| Replicate | voice conversion (RVC) for voice features | audio you provide for conversion | United States |
| Eulerstream | technical signing of the TikTok LIVE connection | technical session identifiers; does not receive registration data | United States |
The following also receive data, when applicable: TikTok, only during active use of the "TikTok LIVE" feature, we receive public live events (gifts, comments); we do not send registration data to TikTok. Competent authorities, when required by court order, law or regulatory authority.
We do not sell, rent or transfer personal data to third parties for marketing or profiling purposes.
6. International transfer
Part of the processors listed above (Supabase, Railway, Cloudflare R2, Paddle, ElevenLabs, Replicate and Eulerstream) processes data on servers outside Brazil, mainly in the United States and the United Kingdom. This constitutes an international data transfer, informed under art. 33 of LGPD.
These transfers are supported by:
- the commitment, in the process of being formalized, to maintain with each processor a data processing agreement and to incorporate into it the Standard Contractual Clauses approved by ANPD (Annex II of Res. CD/ANPD No. 19/2024), adopted in full and without modification;
- security mechanisms applied by the processors (encryption in transit and at rest);
- assessment that the processors adopt protection standards compatible with LGPD.
You can request more information about the safeguards applied to any transfer through the DPO channel.
7. Retention and deletion
We keep personal data only for the time needed for the purposes, observing legal deadlines:
| Category | Term |
|---|---|
| Active account | while the account exists |
| Closed account (no active subscription) | 6 months (recovery) → deletion |
| Billing history | 5 years (tax obligation) |
| Technical logs (IP, device identifier) | 90 days after last activity |
| TikTok LIVE data (aggregated gifts) | 1 year for ranking, 30 days for raw details |
| Voice features (text/audio sent) | processed transiently; not retained by TopGames after the result is generated. Retention policy of processors (ElevenLabs and Replicate): up to 90 days after the interaction or as long as necessary to provide the service |
After the term, data is deleted or anonymized, except when legally required to keep it.
8. Your rights
Under art. 18 of LGPD, you have the right to:
- confirmation of the existence of processing;
- access to the data we process about you;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed in non-compliance;
- data portability (export in structured format);
- deletion of data processed under consent;
- information about public and private entities with which we share your data;
- information about the possibility of not providing consent and its consequences;
- revocation of consent, with effect on future processing.
You may also object to processing based on legitimate interest, providing justification, and request review of automated decisions that affect your interests.
To exercise any right, send your request to the DPO at support@topgames.app.br. Service is free of charge. We confirm receipt and respond within the term of art. 19 of LGPD: up to 15 days for access and confirmation. Since we are a small-size agent (Res. CD/ANPD No. 2/2022), this term may be extended by double upon justification; in that case you will be informed of the extension and the reason.
9. Security
We apply technical and administrative measures to protect the data:
- passwords stored in encrypted form (never in plain text);
- encrypted communication (HTTPS) across the entire site and launcher;
- session tokens with expiration and automatic renewal;
- permission-level access control on the database;
- monitoring of suspicious events and anti-fraud;
- total separation between test environment and real environment.
Even with our measures, no system is 100% immune. In case of a security incident that may bring relevant risk or harm to you, we will notify you and ANPD within a reasonable term, as per art. 48 of LGPD.
11. Children and adolescents
The Platform is not directed at children under 13 and its use by children is not allowed. Teens between 13 and 17 may only use the Platform with the consent and under the supervision of at least one parent or legal guardian, as per art. 14 of LGPD, which determines that the processing of data of children and adolescents must always be done in their best interest.
Subscription contracting and payment features are intended for adults over 18 or for minors duly assisted or represented by their legal guardians.
We do not condition participation in games or activities on providing personal data beyond what is strictly necessary (art. 14, §3). If we identify a minor registration without proper authorization, we will suspend the account and delete the data, unless we receive confirmation from the responsible guardian.
The legal guardian may, at any time, request information about the minor data or its deletion through the DPO channel.
12. Changes to this policy
This Policy may be updated to reflect legal, technical or operational changes. Material changes will be communicated with 30 days notice by email and/or notice on the Platform.
Version history: v1.0.0 (05/09/2026), initial version. v1.1.0 (05/17/2026), inclusion of processors PayPal, ElevenLabs, Replicate and Eulerstream; detail on international transfer and Standard Contractual Clauses; identification of the DPO and contact channel; adjustments to data collected (voice features) and to data subject rights. v1.2.0 (05/27/2026), replacement of payment processors Mercado Pago and PayPal by Paddle.com Market Limited (United Kingdom), now Merchant of Record responsible for card, PayPal, Google Pay, Apple Pay and Pix; update of the international transfer section to include the United Kingdom.
Current version: 1.2.0 · effective from May 27, 2026.
13. How to get in touch
- DPO / data protection: support@topgames.app.br
- General support: support@topgames.app.br
- Discord: link available at /support
You may also file a complaint with the Brazilian National Data Protection Authority (ANPD) at www.gov.br/anpd.