Who We Are
TNT Studio Ltd ("we", "us", "our") operates the TNT Studio gaming platform at tntstudio.uk. We are the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
- Company: TNT Studio Ltd
- Registered in England and Wales, Company No. 16371977
- Contact: founder@tntstudio.uk
Data We Collect
| Category | Data Collected |
|---|---|
| Account | Username, email address, password (bcrypt hashed), display name, avatar |
| Financial | Transaction history, PayPal email, Stripe account ID, RedotPay ID. We never store full card numbers. |
| Gameplay | Match results, statistics, rank, XP, game mode activity, earnings history |
| Technical | IP address, browser/device type, operating system, session duration |
| Social | Posts, messages, friend connections, squad membership, profile content |
| KYC | Government-issued ID, selfie photo (only when required for identity verification, stored encrypted) |
| Communications | Support tickets, in-app messages, email correspondence |
What we do NOT collect: Full credit/debit card numbers, biometric data (beyond KYC selfie), location data beyond IP geolocation, contacts from your device, or data from other apps.
How We Use Your Data
- To provide, maintain, and improve the Platform and your account.
- To process deposits, withdrawals, and payouts via PayPal, Stripe, or RedotPay.
- To prevent fraud, cheating, multi-accounting, and money laundering using our ML-powered detection systems.
- To match players fairly based on skill level and game history.
- To enable social features (feed, messaging, squads, reels).
- To comply with legal obligations including AML and KYC regulations.
- To communicate service updates, security alerts, and account notifications.
- To generate anonymised analytics that help us improve the Platform.
Legal Basis (UK GDPR)
| Legal Basis | Processing Activity |
|---|---|
| Contract | Account creation, gameplay, payment processing, withdrawals |
| Legal Obligation | AML/KYC compliance, tax reporting, fraud prevention |
| Legitimate Interest | Anti-cheat enforcement, platform security, analytics, matchmaking |
| Consent | Marketing emails, push notifications, optional cookies |
Payment Processors
We use the following third-party payment processors to handle financial transactions:
- PayPal - for deposits and withdrawals. PayPal processes your data under their own privacy policy.
- Stripe - for card deposits and bank payouts. Stripe is PCI DSS Level 1 certified.
- RedotPay - for alternative crypto-linked withdrawals.
We share only the minimum data required to process your transaction (amount, account identifier). We never send your password, gameplay data, or social content to payment processors.
Third-Party Services
- AWS (Amazon Web Services) - cloud hosting and infrastructure. Data stored in EU regions.
- Google Tag Manager & Analytics - anonymised website usage analytics.
- Meta Pixel - conversion tracking for advertising (anonymised).
- Sentry - error tracking to identify and fix bugs (no personal data sent).
We do NOT sell, rent, or trade your personal data to third parties for their marketing purposes.
Anti-Cheat & Fraud Detection
TNT Studio uses ML-powered systems (XGBoost, Isolation Forest) to maintain fair play and detect fraudulent activity. These systems analyse:
- Gameplay patterns and statistical anomalies
- Login behaviour and device fingerprints
- Transaction patterns for potential money laundering
- Multi-account indicators
Automated decisions: In some cases, our anti-cheat system may automatically restrict accounts pending human review. You have the right to request human review of any automated decision that significantly affects you.
Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data | Active + 5 years after deletion | Legal obligation / dispute resolution |
| Transaction records | 7 years | Financial regulations (HMRC) |
| KYC documents | 5 years after verification | AML regulations |
| Gameplay history | 3 years | Leaderboard integrity / dispute resolution |
| Chat messages | 1 year | Moderation and safety |
| Server/access logs | 12 months | Security and debugging |
| Marketing consent | Until withdrawn | Consent record |
Your Rights
Under UK GDPR, you have the following rights:
- Right of Access - request a copy of all personal data we hold about you.
- Right to Rectification - correct inaccurate or incomplete data.
- Right to Erasure - request deletion of your data (subject to legal retention requirements).
- Right to Data Portability - receive your data in a structured, machine-readable format.
- Right to Object - object to processing based on legitimate interest.
- Right to Restrict Processing - limit how we use your data while a dispute is resolved.
- Right to Withdraw Consent - withdraw consent for marketing at any time.
- Right regarding Automated Decisions - request human review of automated decisions.
To exercise any of these rights, email founder@tntstudio.uk. We will respond within 30 days.
You may also delete your account directly from the app settings. This initiates the data deletion process subject to the retention periods above.
Security Measures
We implement robust technical and organisational measures to protect your data:
- AES-256 encryption for sensitive data at rest
- TLS 1.3 for all data in transit (HTTPS enforced)
- Bcrypt password hashing with individual salts
- Rate limiting and DDoS protection
- JWT tokens with device fingerprinting for session security
- Strict Content Security Policy (CSP) headers
- Role-based access control for internal systems
- Regular security audits and penetration testing
Breach notification: In the event of a data breach that poses a risk to your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.
Cookies & Tracking
| Cookie | Purpose | Duration |
|---|---|---|
| tntstudio.sid | Session authentication (essential) | 24 hours |
| tnt_token | JWT authentication (essential) | 7 days |
| XSRF-TOKEN | CSRF protection (essential) | Session |
| _ga / _gid | Google Analytics (via GTM) | 2 years / 24 hours |
| _fbp | Meta Pixel conversion tracking | 90 days |
Essential cookies cannot be disabled as they are required for the Platform to function. Analytics cookies are loaded via Google Tag Manager and respect your browser's Do Not Track setting.
Children
TNT Studio is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If we discover that a user is under 18, their account will be terminated immediately and all associated data deleted (except where retention is legally required for financial records).
International Transfers
Our primary infrastructure is hosted on AWS in the EU/UK region. Where data is transferred outside the UK (for example, to payment processors in the US), we ensure adequate protections are in place through:
- Standard Contractual Clauses (SCCs) approved by the ICO
- Selecting processors certified under recognised frameworks
- Data minimisation - only essential data is transferred
Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or in-app notification at least 14 days before they take effect. Continued use of the Platform after changes constitutes acceptance of the updated policy.
Contact & Complaints
For any privacy-related questions or to exercise your data rights:
- Data Controller: TNT Studio Ltd
- Email: founder@tntstudio.uk
If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113