Privacy Policy

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• Names
• Phone numbers
• Email addresses
• Contact preferences

Sensitive Information. We do not intentionally collect sensitive personal information through the public website unless it is necessary for a specific service and subject to an applicable written agreement.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information, such as your Internet Protocol (IP) address and browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called “crash dumps”), and hardware settings).
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
• Approximate Location. We may receive an approximate location, such as country, region, or city, derived from an IP address as part of ordinary hosting, security, or analytics functions.

In Short: Our online arcade is free and has its own account system. If you create an account, we store your email address, the display name and badge you choose, and your scores. Your name, badge, and scores on the leaderboard are visible to other players.

We operate a free online arcade at arcade.colonycreative.com (the “Arcade”). It is a separate website from colonycreative.com, it is provided free of charge, and it is not a sales channel. This section describes what happens to your information there. Where this section and the rest of this Notice differ, this section governs the Arcade.

Playing without an account

You can browse and play in guest mode without creating an account. Your settings and local progress are stored in your own browser rather than in Colony’s application database. If you choose to post a score as a guest, the display name you type and the score are sent to us and shown on the shared leaderboard alongside other players. Guest scores are not linked to any account. Standard hosting, security, and network information may also be processed when your browser communicates with the Arcade.

Information you provide if you create an account

Creating an Arcade account is optional. An account lets your scores and badge follow you between devices and lets you manage or delete them later. If you create one, we collect:

• Email address and password. Your password is hashed by our authentication provider; we never see or store it in readable form.
• Display name. Free text, up to 24 characters, chosen by you.
• Badge choices. Your initials, a badge style, an accent colour, and optionally a playing card chosen from the decks in the game. The card is stored as a reference to that card, not as a file.
• Scores and game results you submit, including the game played, the difficulty or level reached, and the time of the run.
• Your wizard-chattiness preference, a number from 0 to 3 controlling how often the Arcade’s resident wizard speaks.

Players cannot upload images or any other file. Your badge is built from your initials and a style, or from a playing card chosen from the decks in the game, stored as a reference to that card rather than as an uploaded file. A small number of Colony staff accounts carry a picture set by an administrator.

We use your email address to sign you in, to let you reset your password, and to send you transactional messages about your account. We do not send marketing email to Arcade accounts.

What other players can see

In Short: Your display name, badge, and scores on the leaderboard are visible to other players. Your email address is not.

The Arcade has a single shared leaderboard. If you post a score, whether as a guest or from an account, your display name, badge, accent colour, score, and the game and difficulty you played are shown on that leaderboard to other players. Please choose a display name you are comfortable showing to strangers.

Your email address and password are never displayed to other players.

Information stored only in your browser

The Arcade stores gameplay preferences and certain local progress information in your browser rather than in Colony’s application database: your sound and volume settings, your chosen card deck, your progress and personal bests in each game, any items you have unlocked, which of the wizard’s lines have already played, and interface state such as which panels you have opened. A session token is also stored so that you stay signed in between visits; it is presented to our authentication provider when you use your account. Standard hosting, authentication, security, and network information may be processed when your browser communicates with the Arcade.

None of this is advertising or tracking technology. There is no advertising identifier, no cross-site identifier, and nothing that follows you to any other website. It is functional storage: your preferences, your progress, and your session.

Analytics and tracking on the Arcade

Colony does not use advertising pixels, behavioural advertising, retargeting, session-replay tools, or cross-site tracking in the Arcade, and does not currently use a general-purpose product analytics platform there.

Who we share Arcade information with

We use service providers such as the following to provide database, authentication, hosting, security, and related infrastructure for the Arcade:

• Supabase provides the Arcade’s database, account authentication, and file storage. Arcade data is stored on infrastructure located in the United States.
• Cloudflare hosts and serves the Arcade, and provides the bot check shown when you sign up or sign in. As with any web host, Cloudflare receives the IP address and browser information of anyone who requests a page.

We do not sell Arcade information, we do not share it for advertising, and we do not combine it with information collected through colonycreative.com. The Arcade and our main website are separate systems.

The voice of the Arcade’s wizard was created using AI voice synthesis, but every line is recorded in advance and served as an ordinary audio file. Nothing you do or type in the Arcade is sent to any AI provider.

How long we keep it, and deleting your account

We keep your Arcade account information for as long as your account exists. You can delete your account at any time from your profile in the Arcade, which removes your account, your profile, and your scores. If you would rather we did it for you, email info@colonycreative.com and we will take care of it. Deletion removes the active account, profile, and score data, subject to ordinary backup-retention and legal or security requirements.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To evaluate and improve our Services, products, marketing, and your experience. We may process your information when we believe it is necessary to identify usage trends, determine the effectiveness of our promotional campaigns, and to evaluate and improve our Services, products, marketing, and your experience.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To determine the effectiveness of our marketing and promotional campaigns. We may process your information to better understand how to provide marketing and promotional campaigns that are most relevant to you.
• To comply with our legal obligations. We may process your information to comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

• Service Providers. We may share limited information with vendors that help us operate, secure, analyze, and provide the Services, such as our hosting, analytics, spam-protection, and infrastructure providers, as described in this Notice. They may use it only to perform those services for us.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

In Short: When we handle personal information for a client’s project, the client’s agreement with us governs it, and questions about that information should go to the client.

When Colony processes personal information on behalf of a client in connection with a project or managed service, Colony may act as a service provider, processor, or Business Associate rather than as the organization that determines the purposes of the processing. In those circumstances, the applicable client agreement, DPA, BAA, and documented client instructions govern the processing. Individuals with questions about information controlled by a Colony client should contact that client directly.

In Short: We use cookies to run the site and understand how it is used. We do not use them for third-party behavioural advertising.

We may use cookies and similar technologies to operate the Services, maintain security, remember preferences, and understand how the Services are used.

Analytics

We use Google Analytics to understand aggregate website traffic, performance, and usage. You can opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout.

Spam protection

Our contact form is protected by Google reCAPTCHA, which analyses browser and interaction signals to distinguish people from automated abuse. Its use is subject to Google’s Privacy Policy and Terms of Service.

We do not use cookies or tracking technologies on this website for third-party behavioural advertising or retargeting.

In Short: We do not offer a public AI product on this website. In providing professional services we may use third-party AI tools, and information is shared with them only as appropriate for the applicable work.

In providing professional services, Colony may use third-party artificial-intelligence, cloud, development, automation, and creative-production tools. Information is provided to those services only as appropriate for the applicable work and subject to the relevant client agreement, confidentiality requirements, and provider terms. Clients with special data-handling or regulatory requirements should ensure those requirements are documented in the applicable agreement before restricted information is provided.

The Colony Arcade’s resident wizard was voiced using AI voice synthesis, but every line is recorded in advance and served as an ordinary audio file. Nothing you do or type in the Arcade is sent to any AI provider.

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

In Short: We do not knowingly collect information from children under 13. Between 13 and the age of majority, a parent or guardian should be involved.

We do not knowingly collect, solicit, or market to children under 13 years of age, and we do not knowingly sell personal information belonging to them. Our online arcade is not directed at children under 13.

If you are at least 13 but under the age of majority where you live, you may use our Services only with the involvement and consent of a parent or guardian, who agrees to these terms on your behalf.

Where the law in your country or region sets a higher minimum age for consenting to the processing of your personal information, that higher age applies to you, and you may use our Services only with the authorization of a parent or guardian.

If we learn that personal information from a user under 13 has been collected, we will deactivate the account and take reasonable measures to promptly delete the information from our records. If you believe we may have collected information from a child under 13, please contact us at info@colonycreative.com.

In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section “HOW CAN YOU CONTACT US ABOUT THIS NOTICE?” below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services.

If you have questions or comments about your privacy rights, you may email us at info@colonycreative.com.

Some browsers offer a legacy “Do Not Track” (DNT) setting. Because there is no uniform DNT standard, we do not currently respond to DNT signals. Where applicable law requires us to recognise a legally valid opt-out preference signal, such as the Global Privacy Control, we will process it as required by that law.

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

Categories of Personal Information We Collect

We have collected the following categories of personal information in the past twelve (12) months:

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels
• Participation in customer surveys or contests
• Facilitation in the delivery of our Services and to respond to your inquiries

We retain personal information for as long as reasonably necessary for the purposes described in this Notice, including legitimate business, contractual, tax, accounting, legal, and security needs. Arcade account, profile, and score data is retained while the Arcade account exists, subject to ordinary backup and deletion processes.

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including Minnesota’s privacy law)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including California’s and Delaware’s privacy law)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including Minnesota’s and Oregon’s privacy law)
• Right to review, understand, question, and correct how personal data has been profiled (as permitted by applicable law, including Minnesota’s privacy law)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including California’s privacy law)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including Florida’s privacy law)

How to Exercise Your Rights

To exercise these rights, you can contact us by submitting a privacy request. If you are unable to use the form, you can email us at info@colonycreative.com instead, or use the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at info@colonycreative.com. Where applicable law requires, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If your appeal is denied, you may submit a complaint to your state attorney general.

California “Shine The Light” Law

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section “HOW CAN YOU CONTACT US ABOUT THIS NOTICE?”

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated “Revised” date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

If you have questions or comments about this notice, you may contact our Privacy Contact by email at robbie@colonycreative.com, by phone at 1-629-777-5660, or contact us by post at:

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please submit a privacy request.