Privacy Policy

1. Information We Collect

Following the principle of data minimization, we collect only the information necessary to keep our services running:

• Basic account information:Email address, username, and Discord User ID (if you sign in quickly with Discord).
• Payment and subscription data:Transaction IDs, subscription plans and expiry dates (note: credit card numbers and sensitive banking details are processed directly by third-party payment gateways such as Stripe, and M.NationWorld never stores your sensitive payment credentials).
• System and log information:Login IP addresses, browser types, device information and API call logs (used for security risk control and protection against DDoS attacks).
• Local data:To improve loading speed and offline experience, some interface preferences (such as theme settings) and draft states may be temporarily stored in your browser's localStorage; your official data is stored in the cloud (see Section 5).

2. AI Data Processing

• How processing works:When you use AI features, the relevant text content is sent by purpose to third-party AI service providers for processing: DeepSeek for AI customer support, Smart Search, article publication review/summaries and content moderation; Google Gemini for FluidCanvas AI Edge Generation. Only the text required for the corresponding feature is transmitted.
• Data control:The platform does not use your AI interaction content to train its own models; content transmitted to third-party AI service providers is retained and processed in accordance with each provider's own privacy policy.
• Suggested content:Please do not submit sensitive information you are unwilling to have processed by third-party services through the AI features.

3. How We Use Information

Collected data is used only for the following core business purposes:

• Providing you with the core features of the M.NationWorld platform and customized computing services.
• Processing your subscription orders, issuing invoices and resolving after-sales technical issues.
• Monitoring system health, and identifying and defending against malicious cyberattacks or fraudulent activity.
• Sending you necessary system notifications, version updates or legal document change notices.
• We keep visit analytics to understand how the service is used; you can turn off non-essential analytics under Settings → Data & Privacy.

4. Information Sharing and Disclosure

M.NationWorld will never sell your personal data to any third party. We share necessary information only in the following extremely limited circumstances:

• Essential service providers:We transfer the data required to provide the corresponding services to our hosting infrastructure provider (Google Cloud) and our payment processing provider (Stripe).
• AI service providers:When you use AI features, the relevant text is transmitted to the corresponding AI service providers (DeepSeek / Google Gemini) for the purposes described in Section 2.
• Legal and compliance requirements:We disclose information in accordance with the law only upon receipt of legally valid court subpoenas or lawful requests from government enforcement authorities.

5. Cloud Data Storage and Security

• Cloud storage:Your account data, world content and subscription records are stored in cloud infrastructure hosted on Google Cloud Run, and are managed and backed up centrally by the platform.
• Encrypted transmission:Platform network communications are transmitted using HTTPS/TLS encryption.
• Access control:Core databases are protected by access control permissions, and data backups are performed periodically.

6. International Data Transfers

• Cross-border transfers:To provide globally distributed services, your data may be transferred to servers outside your country or region (such as Google Cloud data centers) for processing and storage.
• Safeguards:We only work with providers that commit to an equivalent level of data protection, and we take appropriate measures to ensure your data remains protected to the standards described in this policy during cross-border transfers.

7. Data Retention Periods

• Retention after sign-out:After you sign out (stop using the service), your data will be retained for 3 years. If you log in again within those 3 years, the retention period restarts from the date of your new login.
• Deletion upon expiry:Accounts that remain inactive for more than 3 years will have their associated data permanently deleted with no possibility of recovery.
• Account deletion:After you voluntarily request account deletion, there is a 30-day grace period during which you can log in again at any time to restore your account; once the grace period expires, all your associated data will be permanently erased and cannot be recovered.
• Security logs:Login and security logs are retained for 90 days and then automatically cleared.
• Deletion request and 30-day recovery period:After you request account deletion, there is a 30-day recovery period during which you can log in again to cancel the deletion and restore your account; once the recovery period expires, deletion proceeds by category as follows:
• No violations and no payment account:The account and all of its content are permanently deleted.
• No violations but with a payment account:The account and content are deleted; only de-identified minimal accounting records are kept for 7 years (transaction ID, amount, currency, time, plan, refund/dispute status, tax records), fully disconnected from the email, nickname and any sign-inable account.
• Ordinary violation records:The account and content are deleted; only a minimal risk-control record is kept for 2 years.
• Fraud, chargebacks or serious security incidents:The account and content are deleted; only a minimal risk-control record is kept for 7 years.
• Never retained in any case:Post content, private message content, images, drafts, avatars, email addresses, nicknames, passwords, sessions, full IP addresses and full device information of deleted users.
• Scope of risk-control records:Risk-control records contain only an irreversible account identifier, event type, handling result, time, and appeal and chargeback status; they cannot be used to restore a former account's profile.

8. Protection of Minors' Data

• Minimum age:We do not provide services to children under 13 years of age, nor do we knowingly collect their personal data.
• Parental consent:Users aged 13-18 must use this service with the knowledge and consent of their parent or guardian.
• Deletion requests:Parents or legal representatives may contact us to request the deletion of their minor child's personal data.

9. Your Rights (PDPA)

Under applicable law (including Malaysia's Personal Data Protection Act 2010, the PDPA), you have the following privacy rights:

• Right of access and portability:You can view or export your personal data and world configuration at any time under Settings → Data & Privacy.
• Right to correction:You may correct your personal information at any time.
• Right to deletion:You may apply to delete your account, and we will handle your data in accordance with Section 7 (Data Retention Periods) (data cannot be recovered after deletion).
• Right to withdraw consent:You may withdraw your consent to non-essential data processing at any time.
• Right to complain:If you believe our data processing infringes your rights, you have the right to lodge a complaint with your local data protection authority.
• Analytics control:You can turn off non-essential analytics under Settings → Data & Privacy; turning them off does not affect core features.

10. Data Breach Notifications

• Incident handling:The platform handles data security incidents according to its operational capabilities; in the event of a data breach, tampering or loss, the platform will respond and notify as required by applicable law.
• Notification obligation:In the event of a data security incident that may affect your rights and interests, we will notify you within a reasonable time through in-platform announcements, the Discord community and other channels, informing you of the incident overview, possible impacts and our response measures, and will report to regulatory authorities as required by law.

11. Changes to This Privacy Policy

• Change notifications:This policy may be updated from time to time. Material changes (such as adjustments to the scope of data collection, retention periods or user data rights) will be announced in advance through in-platform announcements, the Discord community and other channels.
• Continued use constitutes acceptance:Continuing to use the platform after changes take effect constitutes your acceptance of the revised Privacy Policy.

12. Contact Us

If you have any questions, suggestions or privacy complaints regarding these Terms of Service or this Privacy Policy, please contact the M.NationWorld team through the following channels:

• General inquiries (AI support):For routine questions about accounts and features, you can consult the AI support agent (available 24/7) at any time; its replies are for reference only.
• Formal requests (human support):Formal privacy requests and complaints are handled manually. The ticket system is the unified entry point for manual support: important status updates appear in your backend console and are sent to you by email; you may also contact the administrators through the official Slati Studio Discord community server (Slati Studio team).
• Official email:Official support and privacy email: service@mnationworld.com (active).