Evil Corp — Privacy notice
Android · Version 1.1 · Updated:
Evil Corp is an Android building and progression game for people aged 13 and older. There is no Evil Corp account or cloud save. The game stores data locally. Google services provide advertising and payment processing; Unity IAP supplies the technical integration between the app and Google Play.
Who is responsible?
Digital-e UG (haftungsbeschränkt), represented by managing director Kurt Laabs, Norderstraße 47, 25436 Tornesch, Germany, is responsible for the processing described here. Email: anfrage@digital-e.org. Commercial register: Amtsgericht Pinneberg, HRB 18836 Pi.
This notice covers the Android app. It does not cover a browser or YouTube Playables version. German and English versions contain the same information; mandatory rights under applicable law remain unaffected.
Game data on your device
Evil Corp stores progress, resources, divisions, equipment, upgrades, language, sound and display settings, and timestamps for offline progress in a local save file. A checksum and local backup help detect and recover damaged saves.
The local save also contains your advertising age choice, whether bonus videos are switched on or off, bonus claims and timestamps, purchased entitlements, signed receipts for permanent purchases and hashes used to prevent the same purchase being delivered twice. Bonus history older than 48 hours is removed when the next successful bonus is recorded; other local records remain until updated or deleted.
We do not upload the save to a Digital-e server. There is no chat, multiplayer profile or player registration.
The Android app excludes its app data from Android cloud backup and system device transfer. The local backup file within the app’s storage is used only to recover a damaged save on this device. It is not a cloud save. Clearing app data or uninstalling the app can permanently remove progress and consumable purchases. Permanent purchases can be restored using the same Google Play account.
Necessary processing to provide the game and remember your selected settings is based on Article 6(1)(b) GDPR, insofar as personal data are involved. Required device storage relies on § 25(2)(2) TDDDG. Without this storage, progress and purchases cannot be reliably retained on the device.
Age choice and young players
The advertising age choices are unknown, under 13, 13–17 and 18 or older. No date of birth is collected. You can change the choice in Options → Privacy & contact. The value is stored locally, but the resulting age-treatment flags are sent to Google when an ad or consent request is made.
The app does not request bonus ads if the age is unknown or under 13. For ages 13–17, requests are marked for teen and under-age-of-consent treatment and non-personalised advertising. Google disables personalised ads and remarketing for teen treatment. Technical connection, delivery and diagnostic data may still be processed; non-personalised does not mean anonymous.
The age choice controls advertising, not the start of the purchase service. Google Play purchase connection and product/purchase queries can start when the game opens. The game is not directed at children under 13. The age protection settings are based on our legitimate interest in protecting young players (Article 6(1)(f) GDPR). A parent or guardian can contact us about a child’s data.
Bonus videos and advertising choices
AdMob provides optional rewarded videos for gold, production and offline bonuses. There are no automatic interstitial or banner placements in this version. A Bonus Pass replaces the videos with direct bonuses, subject to the game’s bonus limits.
Bonus videos are switched off by default. The app initializes its advertising feature only after you switch them on under Options → Privacy & contact → Enable optional ad videos, select an eligible age group and the UMP status permits ad requests. It may then preload ads before you choose to watch a video. You can switch videos off again there using “Disable ad videos”; this feature will then make no new ad requests. Normal gameplay and free gifts remain available without videos. Enabling the feature does not replace legally required consent.
When Google Mobile Ads is active, Google can process IP addresses and approximate location derived from them, available advertising/app-set or other device identifiers, app and ad interactions, and technical performance and diagnostic data. Purposes include delivery, advertising measurement and fraud prevention. The game does not request GPS access.
Google UMP loads the applicable consent information using connection and app data, including the IP address and age-treatment flag. Ads are requested only after its ad-request status permits them. Refusing consent does not prevent normal play; depending on region and privacy choices, limited or non-personalised ads may remain available and may still process technical data.
Use Options → Privacy & contact → Ad privacy choices to change or withdraw consent when Google requires that form for your region. The form identifies the purposes and advertising providers. Clicking a bonus-video button does not itself provide consent to tracking. You can also reset or delete the advertising ID in Android settings.
Google Play and Unity In-App Purchasing
Optional purchases include the permanent Bonus Pass, a permanent gold upgrade and consumable gold tickets. There are no subscriptions. Google Play shows the current price and handles payment; we do not receive full card numbers or banking credentials.
The app uses Unity In-App Purchasing (IAP) to connect to Google Play and receive products, prices, purchase tokens, transaction identifiers, purchase status and signed receipts. Receipt signatures are verified locally, entitlements are saved and completed purchases are confirmed to Google Play. No Digital-e verification server is involved.
Purchase and restoration checks can replace cached permanent entitlements, for example after a refund. Permanent purchases can be restored using the same Google Play account. Already delivered consumable tickets are not restored as unused purchases.
Unity IAP integration
The app uses Unity In-App Purchasing 5.3.1 with Google Play Billing 8.3.0. This integration verifies purchase receipts locally and processes purchases through Google Play. It does not include the additional transmission of purchase events and receipts to Unity Insights found in later IAP versions. Evil Corp does not initialize Unity Gaming Services and does not use Unity Analytics, a Unity player login or a Unity web shop. Digital-e does not operate a receipt-validation server.
Purposes and legal bases
The bases below concern processing for which we are responsible. Google explains its own controller processing in its privacy information. A technical SDK setting is not a substitute for legally required consent. Access to non-essential information on your device requires consent under § 25(1) TDDDG; necessary access is covered by § 25(2)(2) TDDDG.
| Purpose | Legal basis |
|---|---|
| Game operation, purchase delivery and restoration | Article 6(1)(b) GDPR — performance of the game or purchase contract. You do not need to buy anything to play. |
| Age restrictions, local receipt verification and prevention of duplicate purchase delivery | Article 6(1)(f) GDPR — protecting young players, preventing duplicate delivery or fraud and operating reliable purchase processing. This basis is limited to necessary and proportionate processing. |
| Consent management | Article 6(1)(c) GDPR with Article 7 GDPR and § 25 TDDDG — recording and respecting privacy choices. |
| Personalised advertising and non-essential advertising measurement | Article 6(1)(a) GDPR — consent for the purposes and providers selected in the privacy form. |
| Limited non-personalised ad delivery | Article 6(1)(f) GDPR — funding the free game, only where consent is not legally required and the player’s rights and choices permit processing. Required device-access consent is not replaced by this basis. |
| Accounting and responding to privacy requests | Article 6(1)(c) GDPR with § 257 HGB / § 147 AO or Articles 12–22 GDPR, as applicable. |
Other diagnostics and security
The game has no separate Firebase or attribution integration and does not send its own gameplay statistics to our server. General Unity Analytics, engine diagnostics and cloud crash reporting are disabled. This does not disable AdMob diagnostics or reports provided by Google Play.
Local checksum and signature checks protect save and purchase integrity. Google states that data sent by its Mobile Ads SDK are encrypted in transit with TLS. Local storage and signature verification do not prevent access by someone who controls your unlocked or compromised device.
Support, external links and store reports
Contacting support opens your email app. Nothing is sent until you send the message. We then receive your email address, message, any name you provide and any attachments. Only send information needed for your Evil Corp question; do not send passwords or full payment card details.
We use messages about purchases or the game contract to deal with that contract (Article 6(1)(b) GDPR). We answer other enquiries on the basis of our legitimate interest in providing support (Article 6(1)(f) GDPR). Our email and IT service providers assist with delivery and storage. Disclosures to advisers or authorities occur where needed to fulfil legal duties or pursue or defend legal claims.
Google Play can provide us with order and settlement reports containing product, order reference, date, amount, country and purchase/refund status. The source is Google Play. We use these for purchase support, accounting and preventing duplicate delivery. Google Play may also provide technical crash or performance reports, depending on the platform and device settings.
Opening the privacy notice, legal notice or another external link connects your browser to that website. The recipient receives connection data such as your IP address. This website uses Firebase Hosting (Google); its separate website privacy notice explains that processing.
Google and other recipients
Google provides AdMob, its User Messaging Platform (UMP) and Google Play. For users in the EEA or Switzerland, Google names Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the controller for its services, subject to any service-specific terms. Google Play sales and payments can also involve Google Commerce Limited and the payment provider identified during checkout. Outside these regions, the Google entity depends on the service and your location.
Google processes advertising, platform and payment data under its own privacy terms as well as the terms applicable to the service. Additional advertising technology providers may receive ad requests or measurement data according to the choices and purposes shown in the consent message. You can inspect the relevant providers and their privacy information there. An app without extra mediation SDKs is not necessarily limited to Google as its only advertising recipient.
We do not operate a server for your game saves or purchase-receipt verification. A supplier receiving data directly through its SDK is still a recipient, even if we cannot view those individual records.
Processing outside the EEA
Google processes data internationally, including in the United States. Its published transfer safeguards include the EU–US Data Privacy Framework for transfers to certified Google LLC entities (Article 45 GDPR) and the European Commission’s Standard Contractual Clauses where applicable (Article 46 GDPR). Processing is not limited to Germany or the EU.
The linked provider documents explain the safeguards. You can also contact us for information or a copy of the safeguards relevant to your data.
How long data are kept
| Data | Period or deletion rule |
|---|---|
| Game saves, settings including the video choice, and local age choice | Until you change or delete the data, clear app storage or uninstall the app. Local backups are replaced as the game is saved and deleted along with app data. The app excludes its data from Android cloud backup and system device transfer. |
| Local purchase receipts and entitlements | While needed to recognise the purchase on your device, until replaced by a store reconciliation or deleted with app data. Google Play keeps its own purchase records. |
| Consent preferences and advertising data | Consent choices remain on the device until changed, reset or deleted. Google’s storage periods depend on the data and purpose: some data are removed or anonymised automatically, some remain until deletion, and security, legal or financial records may be retained longer. See Google’s retention explanation. |
| Support messages | Until the issue and follow-up questions are resolved, unless specific legal claims or a statutory retention duty require continued storage. |
| Business and accounting records, where held by us | Normally 6 years for commercial correspondence, 8 years for accounting vouchers and 10 years for books and annual accounts, starting at the end of the relevant calendar year (§ 257 HGB, § 147 AO). Statutory extensions, for example during a tax proceeding, can apply. These periods do not mean that every game save or support email is retained for that long. |
Deleting data
In Android Settings, open Apps → Evil Corp → Storage (or Storage & cache) → Clear storage / Clear data. Uninstalling also removes local app data. This removes progress, local save backups, settings including the video choice, age choice, bonus history, purchase hashes and locally saved receipts.
The app excludes its data from Android cloud backup and system device transfer. Its local backup file is not a cloud save and is removed when app data are deleted. Progress and already delivered consumable purchases can therefore be lost permanently. Permanent purchases can be restored using the same Google Play account.
There is no Evil Corp account to delete. Clearing local storage does not delete records held by Google and does not request a refund. Contact us for deletion of support data or other information we hold. For data Google processes as an independent controller, its privacy contacts and account controls are available.
Your privacy rights
Subject to the legal conditions, you can request access and a copy of your data, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR). You can withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing before it.
Contact anfrage@digital-e.org or write to the address above. Tell us the game and the processing your request concerns. We ask for additional identification only where proportionate and necessary; we do not require an identity-document copy as a standard step. We cannot identify or remotely retrieve a save stored only on your device.
We normally respond within one month. If the law permits an extension because a request is complex or there are many requests, we explain the reason within that month. Requests are generally free of charge.
You can complain to a data protection authority, including in your place of residence or work. Our local authority is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.
We do not make solely automated decisions with legal or similarly significant effects on you under Article 22 GDPR. Personalised advertising, where chosen, can involve profiling of interests by advertising providers; this does not determine your game progress or purchase entitlement.
Your right to object
You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
Where your data are processed for direct marketing, you may object at any time without giving a reason. This also applies to profiling connected with such direct marketing. Use the advertising privacy choices or contact anfrage@digital-e.org.
Changes to this notice
The date above identifies this version. We update the notice when the app’s data processing changes. If a new purpose or a new consent is required, we provide the relevant information or request consent before starting that processing.
Version 1.1 reflects the Unity IAP 5.3.1 integration, exclusion of Android system backups and bonus videos being switched off by default.