Privacy Policy

Mystonic LLC (“Mystonic,” “DuelForge,” “we,” “us,” or “our”) respects your privacy and is committed to protecting personal information associated with your use of DuelForge.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

• Visit the DuelForge website;
• Create or use a DuelForge account;
• Use a DuelForge game, mobile application, or other product that links to this Privacy Policy;
• Make an in-game or in-app purchase;
• Subscribe to email communications;
• Interact with our official social media pages, including the DuelForge Facebook Page; or
• Otherwise interact with our websites, applications, games, communications, and related services.

Together, these are referred to as the “Services.”

This Privacy Policy also explains the privacy rights that may be available to you under applicable laws, including the California Online Privacy Protection Act (“CalOPPA”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and the European Union General Data Protection Regulation (“GDPR”).

By using the Services, you acknowledge the practices described in this Privacy Policy. Where consent is required by law, we will request your consent before carrying out the relevant processing.

The operator of the Services and controller of the personal information described in this Privacy Policy is:

Mystonic LLC

1209 Mountain Road Pl NE, Ste N Albuquerque, New Mexico 87110 United States

Privacy questions and requests may be submitted through the Contact page available on the DuelForge website.

This Privacy Policy applies only to Services operated by Mystonic LLC that display or link to this Privacy Policy.

It does not govern third-party websites, applications, games, social networks, payment providers, app stores, advertising platforms, or other services that maintain their own privacy policies. Those third parties may independently determine how they collect and use information.

The information we collect depends on how you interact with the Services, which features you use, the permissions you grant, and the technologies currently enabled.

4.1Information You Provide to Us

We may collect information that you provide directly, including:

Account and registration information

This may include:

• Your email address;
• Your account identifier;
• Your selected username or display name, when applicable;
• Your communication and language preferences; and
• Information needed to authenticate or maintain your account.

Social sign-in information

When you choose to sign in through a third-party account or social sign-in provider, we may receive information authorized by you and the provider, such as:

• Your email address;
• Your name or display name;
• Your profile image;
• A provider-specific account identifier; and
• Other basic profile information that you authorize the provider to disclose.

We do not receive your password for the third-party service.

You may be able to review or revoke a social sign-in connection through the settings offered by the relevant provider.

Communications

When you contact us, we may collect:

• Your email address;
• The contents of your message;
• Attachments or screenshots you choose to send;
• Support history; and
• Information necessary to investigate and respond to your request.

Marketing subscriptions

If you subscribe to announcements, newsletters, game updates, promotions, or similar communications, we may collect:

• Your email address;
• Your subscription preferences;
• The date, time, and source of your consent;
• Email delivery and engagement information; and
• Unsubscribe or suppression records.

4.2Information Collected Automatically

When you use the Services, we and our service providers may automatically collect technical and usage information, such as:

• Internet Protocol address;
• Browser type and version;
• Device type, model, and operating system;
• Device, cookie, application, installation, session, or advertising identifiers;
• Language and regional settings;
• Approximate location derived from your IP address;
• Referring and exit pages;
• Pages, screens, buttons, links, or features you view or use;
• Dates, times, duration, and frequency of activity;
• Game progress and feature interaction data;
• Performance, diagnostic, error, and crash information;
• Network and connection information;
• Security and fraud-detection information; and
• Interactions with emails, advertisements, and promotional campaigns.

We do not intend to collect precise GPS location unless a specific feature clearly requests it and you give any permission required by applicable law.

4.3Purchase and Transaction Information

When you purchase virtual items, subscriptions, downloadable content, or other products through the Services, payment may be handled by a third-party platform or payment provider, including:

• Apple App Store In-App Purchase;
• Google Play Billing;
• PayPal;
• Alipay;
• WeChat Pay; or
• Another payment processor identified at the time of purchase.

These providers may collect payment credentials, billing details, and other financial information directly from you under their own privacy policies.

We generally do not receive your complete payment card number, bank-account credentials, or digital- wallet credentials. We may receive limited transaction information, such as:

• A transaction or receipt identifier;
• The product or virtual item purchased;
• Purchase date and time;
• Price and currency;
• Country or region;
• Payment status;
• Refund or chargeback status; and
• The platform or payment method used.

We use this information to complete purchases, deliver products, maintain transaction records, provide support, prevent fraud, and comply with accounting, tax, and legal obligations.

4.4Facebook Page Information

When you visit or interact with the official DuelForge Facebook Page, we may be able to view information that you make available through Facebook, such as:

• Your public profile name and image;
• Comments, reactions, shares, follows, or other interactions;
• Messages you send to the Page;
• Information contained in your public posts; and
• Aggregated Page Insights and engagement statistics provided by Meta.

Meta separately collects and processes information through Facebook under Meta’s own privacy terms. Additional information about Page Insights appears in the “DuelForge Facebook Page” section below.

4.5Information Collected Through CAPTCHA and Security Tools

We may use security and abuse-prevention tools such as Google reCAPTCHA, including invisible reCAPTCHA.

These tools may collect and analyze information such as your IP address, browser and device characteristics, cookies, interaction patterns, referring page, and other signals in order to distinguish legitimate users from automated activity, spam, fraud, or abuse.

The provider of the CAPTCHA service may process this information under its own terms and privacy policy.

4.6Information From Other Sources

We may receive information from:

• Social sign-in and identity providers;
• App stores and payment providers;
• Analytics, advertising, and attribution providers;
• Email-delivery providers;
• Social media platforms;
• Fraud-prevention and security providers;
• Publicly available sources;
• Business partners; and
• Other users when they contact us about activity involving your account.

We may combine information from these sources with information collected through the Services when permitted by law.

We may use personal information for the following purposes:

Providing and maintaining the Services

This includes:

• Creating and authenticating accounts;
• Maintaining account sessions;
• Delivering game features and content;
• Saving preferences or progress;
• Processing purchases;
• Providing customer support;
• Sending service-related messages;
• Troubleshooting technical problems; and
• Maintaining availability and performance.

Improving and developing DuelForge

We may use information to:

• Understand how users interact with the Services;
• Measure feature usage;
• Diagnose crashes and errors;
• Improve performance and usability;
• Conduct testing and research;
• Develop new features, games, products, and content; and
• Create aggregated or de-identified statistics.

Security, integrity, and fraud prevention

We may use information to:

• Detect spam, bots, fraud, cheating, abuse, and unauthorized access;
• Protect accounts, users, and systems;
• Enforce our terms and policies;
• Investigate suspicious activity;
• Prevent payment fraud and chargeback abuse; and
• Maintain the security and integrity of the Services.

Communications

We may use information to:

• Respond to questions and support requests;
• Send account, security, purchase, and service notices;
• Provide information that you request;
• Administer surveys or feedback requests; and
• Send marketing communications when permitted by law.

Analytics

We may use analytics information to:

• Measure website and game traffic;
• Understand how users find and use the Services;
• Measure retention and engagement;
• Evaluate campaigns;
• Identify technical problems; and
• Improve the design and operation of the Services.

Advertising and remarketing

Subject to applicable consent and opt-out requirements, we may use information to:

• Measure advertising effectiveness;
• Attribute downloads or visits to campaigns;
• Create advertising audiences;
• Show advertisements to people who previously interacted with the Services;
• Limit how frequently advertisements are displayed; and
• Deliver or measure interest-based advertising.

Legal and compliance purposes

We may use information to:

• Comply with applicable laws, regulations, legal processes, and governmental requests;
• Maintain required business, accounting, and tax records;
• Establish, exercise, or defend legal claims;
• Investigate violations of our terms;
• Protect the rights, safety, and property of Mystonic, our users, and others; and
• Complete a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets.

Where the GDPR or another law requiring a legal basis applies, we rely on one or more of the following bases:

Performance of a contract

We process information when necessary to provide Services that you request, maintain your account, deliver purchased content, or fulfill our obligations to you.

Legitimate interests

We may process information when necessary for legitimate business interests, including:

• Operating and improving the Services;
• Understanding usage;
• Protecting users and systems;
• Preventing fraud and abuse;
• Providing customer support;
• Measuring performance; and
• Marketing our products where permitted.

We consider the nature of the information, the purpose of processing, and the potential impact on your rights before relying on legitimate interests.

Consent

We rely on consent where required, including for:

• Certain cookies and similar technologies;
• Certain analytics or advertising activities;
• Marketing emails;
• Accessing device permissions; and
• Other optional processing presented to you.

You may withdraw consent at any time. Withdrawal does not affect processing that occurred lawfully before withdrawal.

Legal obligations

We may process information when necessary to comply with tax, accounting, consumer-protection, law- enforcement, regulatory, or other legal obligations.

Protection of vital interests

In unusual circumstances, we may process information when necessary to protect the life, safety, or vital interests of an individual.

We and our providers may use cookies, software development kits, pixels, tags, local storage, mobile identifiers, and similar technologies.

These technologies may be used for:

• Authentication and account security;
• Remembering preferences;
• Maintaining sessions;
• Preventing fraud and abuse;
• Measuring traffic and usage;
• Diagnosing technical issues;
• Email measurement;
• Advertising attribution;
• Remarketing; and
• Interest-based advertising.

Essential technologies

Some technologies are necessary to operate, secure, or provide the Services. Disabling them may prevent portions of the Services from functioning.

Analytics technologies

Analytics technologies help us understand visits, activity, performance, and engagement.

Advertising technologies

Advertising technologies may be used to measure campaigns, create audiences, or show interest-based advertisements.

Where applicable law requires consent, nonessential analytics and advertising technologies will not be activated until the required consent is obtained.

You may be able to manage nonessential technologies through our cookie banner or preference center. You may also adjust browser or device settings, although those settings may not control all application technologies.

We may use Google Analytics and Firebase products to operate, analyze, secure, and improve the Services.

Depending on the Firebase or Google features enabled, these services may process information such as:

• IP address;
• Device and application identifiers;
• Browser and operating-system information;
• Application instance information;
• Usage events;
• Session information;
• Approximate location;
• Crash and diagnostic information; and
• Advertising or campaign information.

We may configure analytics retention periods, advertising features, identifier collection, and consent settings based on our operational needs and applicable legal requirements.

Google may process information under its own privacy terms. Where required, we will seek consent before enabling nonessential analytics or advertising functionality.

We do not currently display third-party advertisements on the DuelForge website.

We may display advertisements within a DuelForge game, application, or other platform. We may also use advertising or remarketing services in the future, including:

• Google Ads;
• Google AdSense;
• Meta or Facebook advertising tools;
• X advertising tools; and
• Similar advertising, attribution, or audience services.

When enabled, these providers may use cookies, pixels, software development kits, device identifiers, advertising identifiers, IP addresses, usage information, and campaign information to measure or personalize advertisements.

Remarketing may allow advertisements for DuelForge to be displayed to people who previously visited the website, used a game, interacted with an advertisement, or otherwise engaged with the Services.

Where required by law, we will request consent before using information for nonessential advertising or remarketing. Users may also exercise applicable opt-out rights through our privacy controls, device settings, advertising-platform settings, or legally recognized browser preference signals.

We will update this Privacy Policy if our advertising practices materially change.

We may use an email provider such as Brevo to send:

• Account and security notices;
• Purchase confirmations;
• Service announcements;
• Support messages;
• Newsletters;
• Game updates;
• Promotional offers; and
• Other communications you request or consent to receive.

Service-related communications may be necessary to maintain your account or provide requested Services and may not offer an unsubscribe option when the communication is legally or operationally necessary.

Marketing communications will include a method to unsubscribe. You may also withdraw marketing consent through our Contact page.

After you unsubscribe, we may retain limited information in a suppression list so that we can honor your request and avoid sending additional marketing messages. Unsubscribing from marketing does not prevent necessary account, security, transaction, or support communications.

Email providers may process email addresses, delivery information, message interaction data, IP addresses, and device or browser information on our behalf.

If you use a social sign-in provider, the provider may inform you what information will be shared before you authorize the connection.

We use information received through social sign-in to:

• Authenticate you;
• Create or connect your DuelForge account;
• Prevent duplicate or fraudulent accounts;
• Display account information; and
• Provide requested Services.

Your relationship with the social sign-in provider remains governed by that provider’s terms and privacy policy.

Revoking access through the provider may prevent future sign-ins but may not automatically delete information that we previously received. You may request deletion separately as described in this Privacy Policy.

We may disclose personal information to the following categories of recipients:

Service providers and contractors

These may include providers that perform:

• Website and application hosting;
• Cloud storage and infrastructure;
• Authentication;
• Analytics;
• Crash reporting;
• Customer support;
• Email delivery;
• Payment processing;
• Fraud prevention;
• Cybersecurity;
• CAPTCHA and bot detection;
• Advertising;
• Attribution;
• Database management; and
• Other operational services.

These providers may process information only for authorized purposes, subject to applicable contracts and legal requirements.

App stores and payment providers

We disclose or receive transaction information as needed to process purchases, validate receipts, issue refunds, investigate fraud, and provide customer support.

Advertising and analytics partners

When enabled and permitted by law, we may disclose identifiers, internet or application activity, approximate location, campaign information, and similar data to advertising, analytics, attribution, and remarketing providers.

Social media platforms

Information may be disclosed when you interact with social media integrations, share content, use social sign-in, visit our social media pages, or engage with our advertising.

Legal and governmental recipients

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with law, regulation, subpoena, court order, or legal process;
• Respond to lawful governmental requests;
• Investigate fraud, abuse, or illegal activity;
• Enforce our terms or agreements;
• Protect our users, employees, systems, property, or rights; or
• Address an emergency involving safety.

Business transfers

Personal information may be disclosed or transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction.

Where required, we will provide notice before personal information becomes subject to a materially different privacy policy.

With your direction or consent

We may disclose information when you direct us to do so, request an integration, or provide consent.

We do not sell personal information in exchange for money.

However, certain disclosures to advertising or remarketing providers may be considered a “sale,” “sharing,” or use for “targeted advertising” under some U.S. state privacy laws, even when no money is exchanged.

When advertising and remarketing tools are enabled, the categories potentially disclosed for these purposes may include:

• Online identifiers;
• Cookie identifiers;
• Device and advertising identifiers;
• IP addresses;
• Internet or application activity;
• Approximate location;
• Advertising engagement information; and
• Inferences regarding interests or likely preferences.

Recipients may include advertising, social media, analytics, and attribution providers such as Google, Meta, and X.

Where applicable, you may opt out through our cookie preference center, an in-product privacy setting, the Contact page, or a legally recognized opt-out preference signal.

We do not knowingly sell or share the personal information of consumers under 16 years of age without any affirmative authorization required by applicable law.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide Services, comply with legal obligations, resolve disputes, prevent fraud, and enforce agreements.

Retention is determined using factors such as:

• The duration of your account or relationship with us;
• Whether information is needed to provide a requested feature;
• The sensitivity and volume of the information;
• Security, fraud, and abuse-prevention needs;
• Applicable limitation periods;
• Tax, accounting, and recordkeeping obligations;
• Pending disputes or legal claims;
• Provider configuration and backup cycles; and
• Whether you have requested deletion.

For example:

• Account information may be retained while your account is active and for a reasonable period after closure;
• Purchase and transaction records may be retained for tax, accounting, fraud-prevention, and legal purposes;
• Support communications may be retained while relevant to the request, account, dispute, or legal obligation;
• Marketing information may be retained until you unsubscribe, after which limited suppression information may remain;
• Analytics and technical records may be retained according to our configured retention periods; and
• Backup copies may remain temporarily until overwritten through ordinary backup cycles.

We may retain aggregated or de-identified information when it can no longer reasonably identify you.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

These safeguards may include access controls, authentication measures, encryption, monitoring, logging, backups, vendor review, and security procedures appropriate to the nature of the information.

No website, application, database, or transmission method is completely secure. We therefore cannot guarantee absolute security.

You are responsible for protecting your account credentials and for notifying us if you believe your account or information has been compromised.

Mystonic LLC is located in the United States. Personal information may be stored or processed in the United States and in other countries where our providers operate.

These countries may have privacy laws that differ from those in your jurisdiction.

Where required by applicable law, we use recognized safeguards for international transfers, which may include:

• Adequacy decisions;
• Standard contractual clauses;
• Contractual data-protection commitments;
• Transfer-risk assessments; and
• Other lawful transfer mechanisms.

You may contact us for additional information about transfer safeguards applicable to your information.

Depending on your location and the Services you use, you may have the following choices:

Account information

You may be able to review or update certain account information through account settings.

Marketing emails

You may unsubscribe using the link in a marketing email or by contacting us.

Cookies

You may manage nonessential cookies through our consent or preference tools where available.

Device permissions

You may manage application permissions through your mobile device or operating-system settings.

Advertising identifiers

Mobile devices may permit you to reset or limit use of an advertising identifier.

Social sign-in

You may revoke the DuelForge connection through your third-party account settings. Revoking access does not necessarily delete your DuelForge account.

Privacy requests

You may submit an access, correction, deletion, objection, restriction, portability, or opt-out request through the Contact page or by postal mail at the address listed in this Privacy Policy.

Some rights apply only in particular jurisdictions and may be subject to legal exceptions.

This section applies to California residents. When presented at or before collection, it is also intended to supplement our Notice at Collection.

The CCPA/CPRA applies only to businesses meeting applicable statutory requirements. To the extent it applies to Mystonic, we will comply with its requirements. We may also voluntarily extend some of the rights described below even when the law does not require us to do so.

18.1Categories of Personal Information

Depending on the Services and features used, we may collect the following categories of personal information:

Identifiers

Examples include email address, account identifier, social-provider identifier, display name, IP address, cookie identifier, device identifier, and advertising identifier.

Sources may include you, your device, social sign-in providers, service providers, app stores, and advertising or analytics providers.

Uses may include account creation, authentication, support, security, analytics, communications, advertising, and legal compliance.

Customer-record information

Examples may include name, email address, account details, and transaction-related contact information.

Commercial information

Examples include purchase history, products or virtual items purchased, transaction identifiers, payment status, refunds, and chargebacks.

Internet or electronic network activity

Examples include browsing activity, interactions with pages or screens, gameplay events, session information, advertisement interactions, referring pages, and application usage.

Approximate geolocation

We may infer an approximate city, state, region, or country from an IP address. We do not intend to collect precise geolocation unless clearly requested for a feature.

Audio, electronic, visual, or similar information

This may include a social profile image, screenshots, attachments, or other content you voluntarily send to support.

Inferences

Advertising or analytics providers may create inferences regarding likely interests, preferences, or audience categories.

Sensitive personal information

We do not seek to collect government identification numbers, precise geolocation, racial or ethnic origin, religious beliefs, health information, sexual orientation, biometric identifiers, or other sensitive personal information unless a feature expressly requires it and provides appropriate notice.

We do not use or disclose sensitive personal information for purposes that would require a right-to-limit notice under the CCPA/CPRA, unless we first provide the required notice and control.

18.2Business or Commercial Purposes

We may collect, use, or disclose these categories for:

• Providing the Services;
• Authentication;
• Processing purchases;
• Customer support;
• Analytics;
• Product development;
• Security and fraud prevention;
• Communications;
• Marketing;
• Advertising and attribution;
• Auditing interactions;
• Debugging;
• Maintaining service quality;
• Legal compliance; and
• Business transactions.

18.3Categories of Recipients

Personal information may be disclosed to:

• Cloud and hosting providers;
• Authentication providers;
• Analytics providers;
• Advertising and attribution providers;
• Email providers;
• Customer-support providers;
• Payment processors and app stores;
• Security and fraud-prevention providers;
• CAPTCHA providers;
• Social media platforms;
• Professional advisers;
• Governmental or legal recipients; and
• Parties to a corporate transaction.

18.4Sale and Sharing

We do not sell personal information for money.

When remarketing, audience, or interest-based advertising tools are enabled, we may share identifiers, internet activity, approximate location, and inferences with advertising partners for cross-context behavioral advertising. This activity may constitute “sharing” under California law.

You may request to opt out of sale or sharing through our available privacy controls, the Contact page, or a recognized opt-out preference signal.

18.5California Rights

Subject to applicable exceptions, California residents may have the right to:

• Know whether we process their personal information;
• Request the categories and specific pieces of personal information collected;
• Request the sources, purposes, and categories of recipients;
• Request deletion;
• Request correction of inaccurate information;
• Obtain a portable copy of certain information;
• Opt out of the sale or sharing of personal information;
• Limit certain uses or disclosures of sensitive personal information, when applicable; and
• Receive equal service and pricing without unlawful discrimination for exercising privacy rights.

18.6Submitting and Verifying Requests

Requests may be submitted through the Contact page or by mail to the business address listed above.

We may need to verify your identity before completing a request. Verification may require confirming control of an email address, account, transaction, or other information reasonably related to the request.

We will use verification information only to process the request.

An authorized agent may submit a request on your behalf. We may require evidence of the agent’s authority and may ask you to verify your identity directly unless the agent holds a valid power of attorney.

We generally respond within 45 days when the CCPA/CPRA applies. We may extend the response period when legally permitted and will provide notice of the extension.

18.7Non-Discrimination

We will not unlawfully discriminate against you because you exercised an applicable privacy right.

This does not prevent us from offering a different service or price when a difference is reasonably related to the value of information and is otherwise permitted by law.

We do not currently offer a financial-incentive program in exchange for personal information.

CalOPPA requires qualifying operators of commercial websites or online services that collect personally identifiable information from California consumers to conspicuously post and follow a privacy policy.

Do Not Track

Some browsers offer a traditional “Do Not Track” or “DNT” setting.

Because there is not a universally accepted technical or legal standard for interpreting traditional DNT signals, the Services may not respond to DNT headers alone.

Global Privacy Control and opt-out preference signals

Where required by applicable law, we treat a recognized opt-out preference signal, such as Global Privacy Control, as a request to opt out of the sale or sharing of personal information for the browser or device sending the signal.

A preference signal may not apply to activity on a different browser, device, or account unless the signal is associated with your account as permitted by law.

Third-party tracking

Analytics, advertising, social media, and other third parties may collect information about your online activity over time and across different websites, applications, or services when their technologies are enabled.

You may manage certain tracking through our privacy controls, provider settings, browser settings, device settings, or legally recognized preference signals.

This section applies when the GDPR governs our processing of personal data relating to individuals in the European Economic Area.

Mystonic LLC is the controller for the processing described in this Privacy Policy unless another party is identified as an independent or joint controller.

Subject to applicable conditions and exceptions, you may have the right to:

• Obtain confirmation that we process your personal data;
• Access your personal data;
• Correct inaccurate or incomplete personal data;
• Request erasure;
• Restrict processing;
• Object to processing based on legitimate interests;
• Object to direct marketing;
• Receive certain personal data in a structured, commonly used, machine-readable format;
• Request transmission of eligible data to another controller where technically feasible;
• Withdraw consent at any time;
• Lodge a complaint with a competent data-protection supervisory authority; and
• Receive information about applicable international-transfer safeguards.

When processing is based on legitimate interests, you may object based on your particular circumstances. We may continue processing if we demonstrate compelling legitimate grounds or if processing is necessary to establish, exercise, or defend legal claims.

You have an unconditional right to object to processing for direct marketing.

We generally respond to valid GDPR requests within one month. That period may be extended where permitted because of the complexity or number of requests.

We do not currently use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects concerning you. Advertising and analytics systems may perform profiling for audience measurement or advertising, subject to applicable consent and objection rights.

You may submit a GDPR request through the Contact page or by mail to the address listed above.

You may also lodge a complaint with the data-protection authority in the EEA country where you live, work, or believe a violation occurred.

The Services are not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13.

A child under 13 must not create an account, subscribe to communications, make a purchase, or otherwise provide personal information through the Services.

If we learn that we have collected personal information from a child under 13 without legally valid parental authorization, we will take reasonable steps to delete it.

Parents or legal guardians who believe that a child under 13 has provided personal information may contact us through the Contact page.

In jurisdictions where consent to online data processing requires a person to be older than 13, users below the applicable age must not provide consent without legally sufficient authorization from a parent or guardian.

We do not knowingly sell or share personal information belonging to users under 16 without the affirmative authorization required by applicable law.

Mystonic operates the Facebook Page named “DuelForge.”

When you interact with the Page, Meta may collect information about your visit and activity. Meta controls much of the technical collection and processing performed through Facebook.

We may receive:

• Public comments, reactions, shares, and posts;
• Messages directed to the Page;
• Public profile information;
• Notifications concerning interactions; and
• Aggregated Page Insights.

For processing of Page Insights that is governed by the GDPR, Mystonic and the applicable Meta entity may act as joint controllers for certain processing.

Meta generally determines how Facebook collects information and is primarily responsible for providing information concerning Meta’s processing and for enabling the exercise of rights relating to Page Insights. Mystonic remains responsible for information that we independently collect or use through administration of the Page.

Communications sent directly to the DuelForge Facebook Page may be processed by both Meta and Mystonic.

Questions concerning Meta’s independent processing should be directed to Meta through the privacy controls it provides. Questions concerning Mystonic’ use of Page interactions may be submitted through the DuelForge Contact page.

The Services may contain links to third-party websites, applications, stores, social networks, videos, communities, or services.

We do not control the privacy or security practices of those third parties. Accessing a third-party service may allow that party to collect information independently.

You should review the applicable third party’s privacy policy before providing personal information.

We may update this Privacy Policy to reflect changes in:

• The Services;
• Technologies we use;
• Our business practices;
• Legal or regulatory requirements; or
• The providers with whom we work.

When we make changes, we will update the “Last Updated” date.

If a change is material, we may provide additional notice through the website, an application, an account notification, or email where appropriate.

Where required by law, we will obtain consent before applying a materially different use to personal information previously collected.

For questions, complaints, or privacy-rights requests, contact:

Mystonic LLC

1209 Mountain Road Pl NE, Ste N Albuquerque, New Mexico 87110 United States

You may also submit a request through the Contact page linked on the DuelForge website.

Please include enough information for us to understand and respond to your request. Do not send passwords, full payment-card numbers, government identification numbers, or other unnecessary sensitive information through the Contact page.