Privacy Policy
Last updated: August 4, 2026 • DPDP Act 2026 Compliant Framework
This Privacy Policy ("Policy") governs how XYON, a cloud gaming management platform developed and maintained by BCN Studio ("XYON", "BCN Studio", "we", "us", "our"), processes personal data under India's Digital Personal Data Protection (DPDP) Act 2023, DPDP Enforcement Rules 2026, and CERT-In Cyber Security Guidelines 2026.
BY CREATING AN ACCOUNT OR USING XYON, YOU GIVE EXPLICIT CONSENT FOR DATA PROCESSING AS SPECIFIED IN THIS POLICY. YOU MAY MANAGE YOUR PRIVACY AND EMAIL PREFERENCES AT ANY TIME.
1. Categories of Personal Data Collected
1.1 Identity & Account Credentials
- Player Profiles: Username, Name, Verified Email Address, Phone Number, Encrypted Argon2 Password Hash, Avatar Image, Bio.
- Profile Update Tracking: `emailUpdateCount` and `phoneUpdateCount` metadata to enforce the lifetime 2-update security quota.
- Cafe Operator & Staff: Registered Cafe Name, Business Address, GSTIN, Staff Names, System Privileges.
1.2 Device Telemetry & IP Security Records
- IP Address, Browser User-Agent, Device Signature, Primary Device Flag (`isPrimary`), and `lastSeenAt` timestamps stored in `UserDevice` model.
- Automated login alert triggers via Resend SDK whenever authentication originates from an unrecognized device signature.
1.3 Geolocation & Distance Calculation
- Browser latitude/longitude coordinates captured via HTML5 Geolocation API when visiting the `/cafes` page.
- Used in-memory to compute Haversine proximity distances (in km) to nearby cafes. Geolocation coordinates are not stored permanently in our database.
2. Purpose of Data Processing
Under the DPDP Rules 2026, XYON acts as a Data Fiduciary and processes data solely for legitimate purposes:
- Authentication & Security: Validating session tokens, preventing unauthorized account access, and issuing security alerts.
- Session Operations & Receipts: Calculating session durations, billing costs, GX Points rewards, and emailing automated receipts.
- Proximity Discovery: Calculating nearby cafe distances and displaying interactive map pins.
- Legal & Tax Compliance: Maintaining audit records for GST tax invoicing and CERT-In cyber logging.
3. Data Retention & Automated Cleanup Policy
To eliminate unnecessary data bloat and protect user privacy under August 2026 data minimization standards:
- 30-Day Inactive Device Cleanup: Non-primary devices with no login activity for over 30 days are automatically deleted at 01:00 AM daily.
- 90-Day Periodic Device Rotation: Non-primary device records older than 90 days are purged to enforce quarterly re-verification.
- Account Data Erasure: Players may request complete account deletion by contacting BCN Studio Support.
4. Email Communication & Unsubscribe Rights
All platform email operations are delivered via Resend API SDK:
- Email Preference Controls: Users have granular control over Promotional, Security, and Session Receipt emails at https://xyon.bcnstudio.tech/player/settings.
- Direct Unsubscribe: Every transactional and marketing communication features a direct unsubscribe link leading to the Email Preferences management section.
5. Data Principal Rights & Grievance Officer
Under the DPDP Act 2023 / 2026 Rules, you hold the right to Access, Correct, Erase, and Redress grievances regarding your personal data.
BCN Studio Grievance Officer
Email: admin@bcnstudio.tech (CC: xyon@bcnstudio.tech)
Entity: BCN Studio, Pune, Maharashtra, India