Slot Creator by Code Creations

Privacy Policy

• Effective date: 17 September 2026
• Last updated: 17 September 2026
• Version: 1.2

1. Who we are

1.1 Slot Creator is provided by Eight Galaxies, 254 Chapman Road, Newark, Delaware, USA, trading as Code Creations ("Eight Galaxies", "Code Creations", "we", "us" or "our"). For the purposes of data protection law, we are the controller of the personal data described in this policy, except where section 5 or section 13 says otherwise.

1.2 Contact us about privacy at legal@8galaxies.com. Eight Galaxies has not appointed a representative in the European Union or the United Kingdom. If you are in the European Economic Area, the United Kingdom or Switzerland, our GDPR statement summarises your rights and explains how to ask us to remove your data.

1.3 Capitalised terms not defined here have the meanings given in the Terms & Conditions.

2. Scope

2.1 This policy covers personal data we process when you visit slotcreator.app or www.slotcreator.app, create or use an Account, use Studio, the creator, the demo games or the AI studio, contact us, or, when available, buy a Paid Plan.

2.2 Desktop App. The Desktop App runs its own local service and keeps its account, project, artwork and AI key data on your device. We do not receive that data. If you connect an AI Provider from the Desktop App, requests go from your device to that provider.

2.3 Exported Kits and published games. This policy does not cover games that creators export, host or publish, or the Third-Party Platforms on which they appear. See section 13.

3. Personal data we collect

3.1 Data you give us

• Account data: your email address, display name and password. Your password is stored only as a salted scrypt hash, never in readable form. We also record when your Account was created.
• Projects and content: project names, slugs, descriptions and game configuration, including titles, taglines, channel handles, symbol names and theme settings; artwork you upload (PNG, JPEG, WebP and supported GIF backgrounds), its size, dimensions and SHA-256 digest; WAV or MP3 audio and its duration; and presentation actions you configure. Project creation also records the version and time of your express Project Creation Terms acknowledgment.
• AI studio settings: your chosen AI Provider and model names, and the API key you save. The key is encrypted with AES-256-GCM before it is stored, and the Service shows only its last four characters.
• AI jobs: the brief you submit (for example project title, tagline, channel handle, game family, theme colours, symbol and bonus names and your creative-direction notes), job status and log messages, and generated items.
• Billing records: the package or plan you choose, invoices, payment method and status, provider order and transaction references, receipt delivery status, amounts, currencies, timestamps and idempotency keys. Cryptocurrency checkout also records the sending wallet address and transaction details needed to verify payment. We record your express authorization for each new paid invoice, including the policy version, agreement-text digest, exact package, price, currency, payment method and server timestamp. We do not receive or store full payment card numbers or wallet private keys.
• Signed agreements: for the PayPal verification flow, the full legal name you type as your electronic signature, your express agreement, the terms version, agreement-text digest and server timestamp. This signature record is separate from the provider's photo-ID verification result.
• Communications: messages you send us and the information in them.

3.2 Data we collect automatically

• Session and security data: session records containing a SHA-256 hash of your session token (never the token itself), a CSRF token, creation, expiry and last-seen times, and whether and why a session was ended. Once password reset is available, this also includes single-use password-reset tokens.
• Abuse-prevention data: your IP address (or, for IPv6, its /64 network), used as the key for rate-limit counters on sign-in, registration and other requests; and counters of failed sign-ins, which are keyed by a keyed hash (HMAC) of the email address entered, not the address itself.
• Technical logs: our servers log the request method, path, response status, response time, a request identifier and error codes. Our logs are designed to omit request bodies, cookies, email addresses and secrets. Our hosting provider also processes request data such as IP addresses, user agents and timestamps to deliver and protect the site.

3.3 Data we do not collect

We do not use analytics, advertising or social-media tracking tools or collect precise location. Our application does not receive or store ID document images, document numbers, full card numbers, wallet private keys or biometric templates. Do not put sensitive information, including photo IDs, into project artwork, audio, briefs or other content.

3.4 Hosted identity verification for PayPal

Before a new PayPal checkout and before spending PayPal-funded build credits, the Service requires a verified government-issued photo ID and your express typed signature to the current agreement. When this feature is available, you choose to continue to Stripe Identity's hosted page. You provide the document directly to Stripe. This integration requests a document check, not a selfie-matching check. Stripe processes that document under the applicable Stripe Identity terms and Stripe Privacy Policy.

We send Stripe an opaque account identifier and verification-attempt identifier. We retain the provider session reference, live/test marker, verification status and the time our server first observed successful verification. We do not request expanded document reports or verified identity details. The one-use hosted link is returned only to the signed-in account holder and is not saved in our account records or project exports.

We use this limited information to check eligibility for PayPal checkout, prevent misuse and record agreement to the purchase and project terms. Verification does not prove that a typed signature name matches the document, prevent every fraudulent payment or eliminate refund, dispute or chargeback rights. If verification is unavailable or unsuccessful, other configured payment methods remain available. Existing payments remain recorded. Contact us if you need help or believe a verification restriction is mistaken.

4. How we use it and our legal bases

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases.

4.1 Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see section 10).

4.2 Rate limits and sign-in lockouts are automated security measures. They temporarily limit requests and do not produce legal or similarly significant effects. If you believe you have been limited in error, contact us.

4.3 We do not use your content to train AI models, and we do not use your data for advertising or profiling.

5. Who we share it with

5.1 We use service providers that process personal data on our behalf, under contracts that restrict their use of it:

5.2 AI Providers you choose. When you run an AI job, we send your chosen AI Provider (currently Anthropic or OpenAI) your job brief and the API key you saved. The AI Provider processes that information under its own terms and privacy policy, under your agreement with it, and not as our service provider. We do not send outcome books, weights, entry costs, balances, player data or your uploaded artwork to AI Providers.

Stripe may also process identity or payment information for its own purposes as described in its privacy policy. The hosted provider's privacy and cookie notices apply on its pages.

5.3 Cryptocurrency. If you pay with cryptocurrency, the transaction is recorded on a public blockchain that we do not control and cannot change.

5.4 Other disclosures. We may also disclose personal data: to professional advisers such as lawyers, accountants and auditors; to courts, regulators, law enforcement or other authorities where we are legally required to or where it is necessary to protect rights, safety or property; to a buyer or successor in a merger, acquisition, reorganisation or sale of assets, subject to this policy; and to anyone else with your consent or at your direction.

5.5 We do not sell personal data, and we do not share it with third parties for their own marketing.

6. International transfers

6.1 We and our providers process personal data in the United States, including our database in AWS us-east-1 (Northern Virginia) and stored artwork in Vercel's iad1 region (Washington, D.C.). This may be outside your country, including outside the European Economic Area, the United Kingdom and Switzerland.

6.2 Where the GDPR requires it, we protect such transfers with appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or the EU-US Data Privacy Framework and its UK extension where the recipient is certified. You can ask us for more information about these safeguards at legal@8galaxies.com.

7. How long we keep it

We may keep data for longer where the law requires it, or where it is needed to establish, exercise or defend legal claims.

8. How we protect it

8.1 Our safeguards include: passwords stored only as salted scrypt hashes; session tokens stored only as SHA-256 hashes; session cookies that are HttpOnly, Secure and SameSite=Strict; CSRF protection and exact origin checks on every change; HTTPS with HTTP Strict Transport Security; a restrictive Content Security Policy; AI keys encrypted with AES-256-GCM; artwork held in private storage and served only to its owner; per-account data separation; and rate limiting.

8.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password secret and your devices secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where the law requires.

9. Cookies and browser storage

9.1 We use only cookies and browser storage that are needed to provide the Service and the features you ask for. We do not use analytics, advertising or tracking cookies, and our pages load no third-party scripts. For that reason we do not show a cookie consent banner. If we ever add non-essential cookies, we will update this policy and ask for your consent where the law requires.

9.2 You can block or delete cookies and browser storage in your browser settings, but the Service may not work properly without them.

10. Your rights

10.1 Rights under the GDPR (EU, EEA and UK)

Subject to conditions and exceptions in the law, you have the right to: access your personal data; have inaccurate data corrected; have your data erased; restrict our processing; receive your data in a portable format; object to processing based on legitimate interests; withdraw consent where we rely on it, without affecting earlier processing; and complain to a supervisory authority (see section 15).

10.2 Rights in other places

Depending on where you live, you may have similar rights under other laws, for example Canada's Personal Information Protection and Electronic Documents Act, Australia's Privacy Act 1988, or US state privacy laws (see section 11).

10.3 How to exercise your rights

Email legal@8galaxies.com from your Account email address, saying which right you want to exercise. Studio > Account > Delete account deletes your Account and its projects immediately; associated provider ID redaction is queued and confirmed separately as described in section 7. To ask us by email to delete your Account, or specific projects or artwork, follow the data removal request process in our GDPR statement, which is open to every user. Some actions are available directly in the Service: you can edit or delete projects and artwork, remove your AI key and sign out. We may need to verify your identity before acting on a request. We respond within the time the law requires, normally one month under the GDPR or 45 days under US state laws, and we may extend that where the law allows. We do not charge for requests unless they are manifestly unfounded or excessive. If we decline a request, we will explain why, and where the law provides a right of appeal we will tell you how to appeal.

11. US state privacy notice

11.1 This section applies to residents of US states with comprehensive privacy laws, including California, where and to the extent those laws apply to us.

11.2 Categories we collect (sources: you, your device and browser, and our service providers):

• identifiers, such as email address, display name, account ID, channel handle and IP address;
• customer records, such as your display name, typed agreement-signature name and email address;
• commercial information, such as package, invoice, payment authorization and subscription records;
• limited identity-verification session references, statuses and timestamps; the underlying photo ID is submitted directly to Stripe Identity as described in section 3.4;
• internet or network activity, such as request logs and security records; and
• sensitive personal information, limited to your account log-in (email address and password), which we use only to provide and secure your Account.

11.3 We collect and use these categories for the purposes in section 4, keep them for the periods in section 7, and disclose them for business purposes to the service providers in section 5.

11.4 No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. Because we neither sell nor share, an opt-out preference signal such as Global Privacy Control has nothing further to opt you out of, but we treat it as a valid request where the law requires.

11.5 Your rights. Subject to the law, you may ask to know or access the personal information we hold about you, to delete it, to correct it, and to receive a portable copy. We do not use sensitive personal information for purposes that would give you a right to limit its use. You may use an authorised agent, and we may ask the agent for proof of authority and ask you to verify your identity. We will not discriminate against you for exercising your rights. To make a request or appeal a decision, email legal@8galaxies.com.

12. Children

The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe that someone under 18 has given us personal data, contact legal@8galaxies.com and we will delete it.

13. Third-party platforms and your players

13.1 The Service may link to third-party websites and platforms. Their own privacy policies apply, and we are not responsible for them.

13.2 If you publish a Creator Game on a Third-Party Platform or your own website, you or that platform decide how players' personal data is collected and used, and you are responsible for your own privacy notices and compliance. Slot Creator does not receive personal data about the players of published games.

13.3 If you include anyone else's personal data in your content, for example a collaborator's name or channel handle, you are responsible for having a lawful basis to do so.

14. Changes to this policy

We may update this policy from time to time. We will publish the updated version with a new "last updated" date and, for material changes, notify you by email or in the Service before they take effect.

15. Contact and complaints

15.1 Contact us at legal@8galaxies.com, or write to Eight Galaxies, 254 Chapman Road, Newark, Delaware, USA. Eight Galaxies has not appointed a representative in the European Union or the United Kingdom.

15.2 We would like the chance to address your concern first, but you have the right to complain to a data protection authority, including:

• in the United Kingdom, the Information Commissioner's Office;
• in the EU or EEA, the supervisory authority where you live or work, listed by the European Data Protection Board;
• in Switzerland, the Federal Data Protection and Information Commissioner;
• in Australia, the Office of the Australian Information Commissioner;
• in Canada, the Office of the Privacy Commissioner of Canada; and
• in California, the California Privacy Protection Agency, or your state attorney general elsewhere in the United States.