Privacy Policy

1. Controller, Processor and contacts

For data processed within the Organization (content, User accounts, usage data), the professional Customer (typically the user’s employer) is the Data Controller; Virsion Sagl is the Processor and processes data on behalf of and under the Customer’s instructions. Processing is governed by the contract between Controller and Processor and its data-processing annexes.

For data necessary to manage the contractual relationship (Organization registration, billing and payments, administrative communications), Virsion acts as an independent Controller.

Virsion Sagl, Canton Ticino, Switzerland. UID: CHE-452.458.064. Contact: info@virsion-studio.com.

2. Applicable law

nFADP (Switzerland) and, for EU users, the GDPR.

3. Data processed

Depending on how the Service is used, Virsion processes:

• Account: name, username, email, role and Organization; language and preferences.
• Authentication and security: password (encrypted), MFA data where enabled, and a token for biometric login from the mobile app (stored as a hash; biometric data never leaves the device).
• Usage: access logs, date and time, IP address (in application logs only in pseudonymised form; in full in the access logs of the delivery network, Azure Front Door, kept 31 days for security purposes), country of access (country-level geolocation derived from the IP, processed internally), actions performed (audit log), AI token consumption and AI conversation history.
• Active sessions (account security): for each sign-in, the browser or app identifier declared by the device, and an approximate location (city and country) derived from the IP using a local database — the IP itself is not stored with the session. These are shown to the account holder alone, in Settings → Security, so that a sign-in they did not perform can be recognised and revoked; they are never used for any other purpose, are not visible to administrators or colleagues, and are not kept as a history: they are erased when the session ends or is revoked, and at most after its maximum lifetime. The location is approximate by nature and may be inaccurate.
• Presence and activity: real-time presence status, application heartbeats and, where the Customer uses the Agent, inactivity indicators based on the timestamp of the last OS-level input (for the “away” status). Informing Users about the use of such features in the employment context is the Controller’s (Customer’s) responsibility.
• Content: tasks, wiki pages, documents, messages and channels, comments, moodboards, attachments, custom emojis and any other content uploaded to the Organization, including any personal data therein; voice recordings (voice-acting takes) uploaded by the Customer, for which the Customer is responsible for rights and releases.
• Perforce metadata: file names and paths, states, locks, changelists and counts transmitted by the Agent. The content of files versioned in Perforce is not transmitted to Virsion.
• Unreal Engine crashes (only if the Customer enables reception for a project): crash reports from internal builds and from the editor, namely error message, callstack, versions, changelist, Unreal machine identifier (kept only as a hash), minidump and the final part of the application log, which may contain the system user name, the computer name, local paths and data present in memory. The sender’s IP address is not kept. Where the Customer uses the Agent, it also reports the workstation’s Unreal machine identifier, kept only as a hash and used to give editor crashes the changelist of the workspace and, only if the Customer enables the option «Record who had the crash» for the project, the User of the Agent installed on that workstation. In that case the User associated with the crash is visible to those who can read the project’s bugs.
• Prompts and AI outputs.
• Billing (Virsion as Controller): Organization billing data and payment outcomes. Full card data is processed exclusively by Stripe; Virsion does not store it.
• Mobile app (only if the user enables the features): device installation identifier, push token (Firebase Cloud Messaging), platform. No personal content in notification payloads.
• Demonstration organizations only: aggregate engagement measurements, kept as daily counts and never as a record of an individual. These are sign-in counts, distinct demo accounts used, distinct visitor networks (counted, not stored), country of access, session length, rejected sign-in attempts, which areas of the product were opened and how many times, and the broad device category, operating system family, browser family and preferred language declared by the browser. Deliberately excluded: the full IP address, the raw browser identifier and its version numbers, screen or device characteristics, and any ordered trail of what a person did. Because demo credentials are issued by Virsion and shared among several people at the evaluating company, these counts describe an organization evaluating the Service, not an identified individual. Visible to Virsion administrators and kept 90 days. The measurement is disclosed when the demo credentials are issued. None of this applies to customer organizations.
• "Notify me" requests (public site, no account needed): the email address you enter in the form, the studio name if you choose to give it, and the dates of the request and of its confirmation. No IP address is stored with the request.
• Public site statistics (only with your consent): pages visited, referring site, device and browser type, approximate country and city, events such as submitting the registration form or a "notify me" form, and a random identifier stored in a Google Analytics cookie. They are collected only on the public pages of the site (presentation, pricing, documentation, legal pages, registration), never inside the Service, in the mobile app or on the sign-in pages. Google Analytics does not store the IP address.
• Biometric data: not collected (handled by the device, never leaves it).
• Providing account data is necessary to deliver the Service; without it the Service cannot be used.

4. Purposes and legal bases

As Processor, under the Controller’s instructions, Virsion processes data to: deliver the Service; index and search; generate AI outputs (RAG); provide collaboration and presence features; receive and analyse crashes; ensure security, monitoring and abuse prevention; and comply with legal obligations. Identifying the legal bases is the Controller’s responsibility.

As an independent Controller, Virsion processes registration and billing data for contract performance (art. 6(1)(b) GDPR), compliance with legal, accounting and tax obligations (art. 6(1)(c) GDPR), and protection of its rights and abuse prevention (legitimate interest, art. 6(1)(f) GDPR).

Also as an independent Controller, and only within demonstration organizations, Virsion measures engagement with the demo — audience measurement and statistical analysis — under legitimate interest (art. 6(1)(f) GDPR), so that it can tell whether an evaluation actually started, follow it up, and notice when someone is unable to sign in. The measurements are the aggregate counts described in section 3: no full IP address, no browser fingerprint, no ordered record of an individual’s activity, and no cookie or identifier stored on the device for this purpose. The measurement is disclosed to recipients when their demo credentials are issued. You may object at any time using the contact address below.

Also as an independent Controller, Virsion uses the email address given in a "notify me" form on the public site only for the purpose named in that form: today, to write to you about the availability of Lore support in Gameheim. Each form has its own purpose, and an address given for one is never used for another. The legal basis is your consent (art. 6(1)(a) GDPR), given by submitting the form and confirmed by following the link sent to that address; until then the only email sent is the request for confirmation. You can withdraw consent at any time with the removal link in every email or by writing to the contact address below: the address is then deleted.

Also as an independent Controller, and only if you accept it in the site banner, Virsion measures the use of the public pages of the site with Google Analytics, to understand which pages are read and where visitors come from. The legal basis is your consent (art. 6(1)(a) GDPR). Without consent Google Analytics is not loaded and no data is sent to Google. You can withdraw consent at any time from the "Cookie settings" link at the bottom of every page of the site: the Google Analytics cookies are then deleted.

5. Recipients (sub-processors and providers)

Virsion does not sell personal data. It shares data only with providers that process it on Virsion’s behalf under contract, and only as needed to run the Service:

• Microsoft Corporation: hosting, database, storage, AI services (Azure OpenAI, Azure AI Search), key management, WAF/CDN, monitoring. European data centers. Gameheim’s AI features run entirely within the Azure infrastructure.
• Stripe: payment processing and subscription management; also processes payment data as an independent controller under its own privacy notice.
• Google LLC (Firebase Cloud Messaging): push notification delivery on Android and iOS (token and device identifier only; no personal data in payloads).
• Apple Inc. (APNs): on iOS, Firebase Cloud Messaging delivers notifications through Apple’s service, which receives the device token and the service message (no personal data in payloads); Virsion does not send data to Apple directly.
• Hostinger International Ltd (Cyprus, EU): transactional emails (account verification, service notifications).
• Epic Games: only if the Customer enables the forwarding of Unreal Engine editor crashes, it receives the reports as an independent controller, under its own privacy notice. It is not a sub-processor of Virsion.
• Google Ireland Limited (Google Analytics): statistics on the public pages of the site, only with your consent; acts as a processor on Virsion’s behalf. It receives no data from the Service.
• External applications connected by you: if the Customer allows it, you may connect an external application to Gameheim, for example an AI assistant. The data the application reads from Gameheim, within the permissions granted when connecting it, is sent to the provider of that application and handled under its terms and the relationship between that provider and the Customer or you, including outside the European Economic Area and Switzerland. The provider is not a sub-processor of Virsion. You can revoke the connection at any time from your account settings.
• Country-level geolocation is performed internally using a local database, so the IP is not sent to any third party for this purpose. The up-to-date list of sub-processors, the regions used and their terms are governed by Annex 1 of the contract, published at https://www.gameheim.com/subprocessors.

6. International transfers

Data is processed in European data centers. Any transfers outside the EU or Switzerland are covered by the safeguards in the sub-processors’ DPAs (EU-US Data Privacy Framework and/or Standard Contractual Clauses).

The optional forwarding of editor crashes to Epic Games goes, for Unreal Engine users residing outside the United States, to Epic Games Commerce GmbH (Switzerland): from the European Economic Area it relies on the European Commission’s adequacy decision.

Site statistics data may be transferred by Google to Google LLC in the United States, under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework, to which Google LLC is certified.

7. Retention

Organization data is retained for the duration of the contract; on termination, the export (30 days) and deletion terms set out in the contract apply. Billing data is retained for statutory periods. Unreal Engine crash minidumps and logs are deleted after 90 days; full reports kept in test mode after 7 days. Longer statutory retention obligations and the sub-processors’ technical retention remain reserved.

An email address given in a "notify me" form is kept for the purpose it was given for and never beyond it. It is deleted after 24 hours if it is not confirmed and when consent is withdrawn. An address given to hear about a specific release, such as Lore support, is deleted once that release has been announced, and in any case 24 months after its confirmation. Where a form is for a recurring newsletter, the address is kept for as long as the subscription lasts.

Site statistics are kept in Google Analytics for 14 months; the Google Analytics cookies expire after 13 months. The choice you make in the banner is saved in your browser for 12 months, then asked again.

8. Security

Virsion implements appropriate technical and organisational measures, including encryption in transit and at rest with per-organization keys where available, Organization segregation, MFA, role-based access controls and audit logs, detailed in Annex C of the contract.

9. Automated decision-making

The Service does not carry out automated decision-making producing legal or similarly significant effects on data subjects.

10. Your rights

Users have the right of access, rectification, erasure, portability, objection and restriction. For data processed within the Organization, since Virsion acts as Processor, users exercise their rights first towards their employer or Organization (the Controller); Virsion assists the Controller. For data for which Virsion is an independent Controller (registration, billing), contact info@virsion-studio.com.

Users also have the right to lodge a complaint with the competent supervisory authority (in Switzerland the FDPIC; in the EU their national authority).

Account deletion: request to the administrator of the user’s Organization (Controller), who manages the account lifecycle.

11. Cookies

Inside the Service, only strictly necessary technical cookies (session/authentication, language, security). On the public pages of the site, and only with your consent, Google Analytics statistics cookies (section 4). No advertising or profiling cookies. See the Cookie Policy for details.

12. Mobile app

Optional native features: push notifications (content always impersonal, only a technical token transmitted) and biometric login (biometric data stays on the device; the server only handles an encrypted, revocable token).

13. Minimum age

The Service is intended exclusively for adult users in a professional context. Virsion does not knowingly collect data from minors.

14. Changes

Changes will be published on this page with their date; material changes will be communicated through the platform.

15. Contact

Virsion Sagl, Canton Ticino, Switzerland. info@virsion-studio.com.