Privacy Policy

1. Who is responsible

This policy applies to BuyBox Arena. BuyBox Arena operates in partnership with Purple Fig Creatives. Purple Fig Creatives provides the support channel listed below. The legal operator of BuyBox Arena is responsible for the personal information used to provide the service and acts as the data controller. Privacy questions and requests can be sent to support@purplefigcreatives.com.

2. Information we collect

• Account information: email address, authentication identifier, display name, username, and sign-in security records.
• Profile information: profile image or selected avatar, profile trim, skills-assessment answers, and training preferences.
• Training activity: tutorial status, campaign and scenario decisions, simulated metrics, runs, progress, XP, rewards, and action history.
• Product activity: feature events, route and workflow context, and safe diagnostics used to understand errors and service health.
• Support and privacy requests: contact details, request category, messages, status, verification notes, and completion records.
• Technical information: device and browser details, IP-derived security signals, request timestamps, infrastructure logs, and abuse-prevention records.

The simulation does not connect to your Amazon Ads account and does not place real advertisements. Do not submit passwords, API keys, payment details, or confidential live-account data in support fields.

3. Why we use information

We use the information above to:

• create and secure accounts, authenticate users, and prevent abuse;
• save training progress and provide the requested simulation features;
• personalize the starting point and show relevant training guidance;
• measure reliability, diagnose errors, and improve the public beta;
• respond to support, privacy, safety, and abuse reports; and
• meet applicable legal, security, and record-keeping obligations.

Depending on the law that applies, these activities rely on providing the service you requested, our legitimate interests in running and protecting the service, your consent where required, or a legal obligation. We do not sell personal information or use it for third-party behavioural advertising.

4. Service providers and disclosures

We use a limited set of providers to run the beta:

• Clerk: account authentication, account security, and authentication-related email.
• Convex: application database, functions, file storage, and internal product-event storage.
• Vercel: web hosting, content delivery, deployment, and infrastructure logs.
• Neo: the Purple Fig Creatives mailbox used for direct support and privacy email.

These providers may use their own subprocessors and may process information outside your province, state, or country. We may also disclose information when required by law, to protect users or the service, or as part of a business reorganization with appropriate safeguards. Payment providers and public multiplayer services are not part of the public-beta data flow. Resend is reserved as a possible service-notification provider but is not part of the launch data flow unless it is configured and this policy is updated.

5. Cookies and similar storage

BuyBox Arena uses authentication cookies and related security storage needed to keep users signed in and protect accounts. The app also uses browser storage for limited session and interface state. The launch version does not use advertising cookies or third-party marketing analytics. Because the current cookies are necessary to provide and secure the service, there is no non-essential-cookie consent banner. We will update this policy and reassess consent before adding non-essential analytics or advertising technology.

6. Retention and deletion

Account, profile, and training records are kept while the account is active so progress can be restored. When a verified deletion request is completed, we remove or anonymize personal information from active application systems unless it must be retained for security, fraud prevention, legal obligations, dispute handling, or proof that the request was completed. Provider backups and logs expire under the provider's own controlled schedules. Abuse and avatar-security events in the application are scheduled for deletion after 90 days; short-lived rate-limit buckets are scheduled for deletion after two days.

Support and privacy-request records are retained only as long as reasonably needed to resolve the request, protect the service, and demonstrate the action taken. Retention may be extended when a legal hold or active security investigation applies.

7. Your choices and privacy requests

Subject to the law that applies, you may ask to access, export, correct, or delete personal information and may withdraw consent where processing depends on consent. Signed-in users can submit a request from Account → Data & Privacy. You can also email support@purplefigcreatives.com from the address connected to your account.

We may ask for enough information to verify the account before acting. Our service target is to acknowledge a request within 2 business days and complete a verified request within 30 calendar days after identity verification. Applicable law may require a different deadline or allow an extension; if so, we will explain it. We do not charge for routine requests, but the law may allow limits on requests that are manifestly unfounded, excessive, or cannot be verified.

8. Security

We use access controls, environment separation, input validation, rate limits, restricted operator tools, and provider security controls. No service can guarantee absolute security. If you believe your account or personal information is at risk, use the support page and choose Authentication or Privacy.

9. Age limit

BuyBox Arena is not directed to children. You must be at least 16 years old to create an account. If you believe a person under 16 has submitted personal information, contact support@purplefigcreatives.com so we can investigate and delete it where appropriate.

10. Changes and contact

We may update this policy as the beta changes. Material updates will receive a new effective date and, when appropriate, an in-product notice. Questions, complaints, and requests can be sent to support@purplefigcreatives.com. You may also contact the privacy regulator available in your jurisdiction.