Privacy Policy

Burny Atlas (“Atlas”, “the service”) is an internal tool operated by Burny Games LTD (“Burny Games”, “we”) for its personnel. This policy explains what personal data the service processes and why. Access is restricted to verified @burny.games Google Workspace accounts.

Data we process

• Account & identity — when you sign in with Google SSO we receive your name, email address, and profile image, and store your assigned role and account status (active, disabled, offboarded).
• Authentication & security — session records (token, expiry), the IP address and user-agent of your requests, and OAuth tokens issued by Google (encrypted at rest). IP-keyed counters are kept to rate-limit sign-in and abuse.
• Audit log — security-relevant actions (who did what, to which resource, the outcome, time, and originating IP) are recorded to detect and investigate misuse.
• Agent access (MCP) — when you authorize an agent to act on your behalf, a hashed session token is stored and tied to your live account state.

Atlas does not use advertising or third-party analytics trackers, and we do not sell personal data.

Cookies

Atlas sets only strictly necessary cookies: an authentication cookie that keeps you signed in, and a security cookie used for sign-in and CSRF protection. They are essential to provide the service you request when you sign in, and are not used for analytics, advertising, or tracking.

Because these cookies are strictly necessary, we do not show a cookie consent banner — under the EU/Cyprus ePrivacy rules, consent is not required for essential cookies. If Atlas ever introduces non-essential cookies (for example analytics), we will ask for your consent first.

Why we process it

• To authenticate you and enforce access control (deny-by-default).
• To secure the service — rate limiting, audit logging, and abuse prevention.
• To provide the knowledge, structure, and ownership features.

The lawful basis is our legitimate interest in operating a secure internal tool and, where applicable, the employment relationship between you and Burny Games.

Where it lives & who can see it

Data is hosted in Burny Games’ Google Cloud Platform project (Cloud Run, Cloud SQL, Secret Manager). Sub-processors are Google (Workspace SSO and Cloud hosting). Within Atlas, access to any resource is mediated by a deny-by-default authorization layer; we do not share your data with other third parties except as required by law.

Retention

Sessions and rate-limit records are short-lived and expire automatically. We keep account and audit records no longer than necessary for the purposes above and for any applicable legal obligations, taking into account the amount, nature, and sensitivity of the data; account records are removed or anonymized after offboarding.

Your rights

Subject to applicable law (including the GDPR where it applies), you may request access to, correction of, or deletion of your personal data, and may object to certain processing. Because Atlas is an internal tool, these requests are handled through legal@burny.games. You also have the right to lodge a complaint with the Commissioner for Personal Data Protection of the Republic of Cyprus (our jurisdiction of registration).

Contact

Questions about this policy or your data: legal@burny.games. Data controller: Burny Games LTD, Louki Akrita 21-23, Bellapais Court, 7th floor, Flat/Office 46, 1100 Nicosia, Cyprus.

Changes

We may update this policy as the service evolves. Material changes will be communicated through internal channels, and the “last updated” date above will change.