This Privacy Policy explains how ARFA processes your personal data when you visit our websites at www.arfa.eu (corporate site) and www.arfa-studio.eu (app publishing and download portal), use our mobile application TerraSweep, or otherwise interact with us. We follow the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data ("Belgian DPA Act"), and Article 129 of the Belgian Act of 13 June 2005 on electronic communications ("Belgian Cookie Law").
The controller responsible for processing your personal data within the meaning of Art. 4(7) GDPR is the natural person operating under the trade name "ARFA":
Philipp Hansmann, sole proprietor (zelfstandige in hoofdberoep / indépendant à titre principal) trading as ARFA
Rue Nothomb 75
1040 Etterbeek, Belgium
Enterprise number (KBO/BCE): 1036.008.104
VAT number: BE 1036.008.104
Email: legal@arfa-studio.eu
Websites: www.arfa.eu and www.arfa-studio.eu
ARFA operates as a sole proprietor based in Belgium. We have not appointed a Data Protection Officer because none of the conditions in Art. 37(1) GDPR apply to us: our core activities do not require regular and systematic monitoring of data subjects on a large scale, and we do not process special categories of data on a large scale. You can address all privacy-related requests to the email above.
This policy applies to:
It does not apply to third-party websites or stores that this site or the App may link to (e.g. the Apple App Store, Google Play, partner websites). Those operators are independent controllers.
We do not knowingly process special categories of personal data (Art. 9 GDPR). Please do not send us such data through any contact channel.
| Purpose | Data categories | Legal basis |
|---|---|---|
| Providing the website and core App functionality (account creation, sign-in, delivering features) | Account, profile, device, log data | Art. 6(1)(b) GDPR — performance of a contract / pre-contractual steps |
| Securing the service, preventing fraud, abuse and attacks | IP address, device data, log data | Art. 6(1)(f) GDPR — legitimate interest in operating a secure service; Art. 6(1)(c) for legal record-keeping |
| Responding to your contact requests | Communication data, account data | Art. 6(1)(b) or Art. 6(1)(f) GDPR — depending on whether the request relates to a contract |
| Web analytics (Google Analytics 4) | Cookie identifiers, IP, browser/device data, page events | Art. 6(1)(a) GDPR + Art. 129 Belgian Electronic Communications Act — consent |
| Mobile analytics and product telemetry (Firebase Analytics) | Pseudonymous installation ID, app events, device data | Art. 6(1)(a) GDPR + Art. 129 Belgian Electronic Communications Act — consent (read/write to terminal equipment) |
| Crash and error monitoring (Firebase Crashlytics, Sentry) | Stack traces, app/OS version, pseudonymous device ID, optionally user ID if logged in | Art. 6(1)(f) GDPR — legitimate interest in service stability; access to terminal equipment beyond what is strictly necessary requires consent under Art. 129 Belgian Electronic Communications Act |
| Serving non-personalized contextual ads (web and App) | Coarse context (URL, app screen), IP-derived country, ad-request technical data | Art. 6(1)(f) GDPR — legitimate interest in monetization; storage of any ad-related identifier on your device requires consent under Art. 129 Belgian Electronic Communications Act |
| Serving personalized ads (Google AdSense, Google AdMob, AppLovin MAX) | Advertising ID, IP, behavioural data, interest segments | Art. 6(1)(a) GDPR + Art. 129 Belgian Electronic Communications Act — consent |
| "Recharge Boost" rewarded ads — granting in-App rewards in exchange for watching an ad | Advertising ID (if consented), ad-event data, reward fulfilment records | Art. 6(1)(b) GDPR for the contractual reward fulfilment + Art. 6(1)(a) GDPR / Art. 129 Belgian Electronic Communications Act consent for the ad-tech component |
| Marketing pixels (Meta, TikTok, LinkedIn) — measuring campaign performance and retargeting | Pixel/cookie identifiers, hashed email (CAPI), browser/device data | Art. 6(1)(a) GDPR + Art. 129 Belgian Electronic Communications Act — consent |
| Complying with statutory obligations (tax, accounting, responses to authorities) | Contract, billing and contact data | Art. 6(1)(c) GDPR — legal obligation (e.g. Art. 60 of the Belgian VAT Code; Art. III.86 of the Belgian Code of Economic Law) |
Where we rely on consent, you may withdraw it at any time with effect for the future via the consent settings link in the website footer or in the App settings (see Section 5). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Where we rely on legitimate interest (Art. 6(1)(f)), you have a right to object under Art. 21 GDPR (see Section 14).
When you first open the website or the App, we display a consent banner provided by our Consent Management Platform (CMP). The CMP records your choices and ensures that cookies and SDKs that are not strictly necessary are only activated after you give your consent. You can change or withdraw your choices at any time:
We use the following categories of cookies and tracking technologies:
| Category | Examples | Legal basis | Default state |
|---|---|---|---|
| Strictly necessary | Session cookies, security/CSRF tokens, consent state, load balancing | Art. 129 §1, 3° Belgian Electronic Communications Act (strictly necessary exemption); Art. 6(1)(b)/(f) GDPR | Always active |
| Analytics | Google Analytics 4 (web), Firebase Analytics (App) | Art. 129 Belgian Electronic Communications Act + Art. 6(1)(a) GDPR — consent | Off by default |
| Crash & performance | Sentry, Firebase Crashlytics | Art. 129 Belgian Electronic Communications Act + Art. 6(1)(a)/(f) GDPR | Off by default beyond what is strictly necessary for diagnostics |
| Advertising | Google AdSense, Google AdMob, AppLovin MAX | Art. 129 Belgian Electronic Communications Act + Art. 6(1)(a) GDPR — consent | Off by default |
| Marketing & retargeting | Meta Pixel, TikTok Pixel, LinkedIn Insight Tag | Art. 129 Belgian Electronic Communications Act + Art. 6(1)(a) GDPR — consent | Off by default |
The CMP also signals your choices to advertising partners via the IAB Transparency & Consent Framework (TCF v2.2) and to Google partners via Google Additional Consent Mode v2 where applicable.
If you consent, we use Google Analytics 4, a service operated in the EU/EEA by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and in third countries by Google LLC (USA). GA4 helps us understand how visitors use the website. We have activated IP anonymization (the IP address is truncated within the EU before being transmitted to Google servers in the US), data sharing with other Google products is disabled by default, and we have concluded a Data Processing Agreement based on Art. 28 GDPR with Google.
Information on Google's data handling: policies.google.com/privacy. Opt-out via the consent banner or browser add-on: tools.google.com/dlpage/gaoptout.
In the App we use Firebase Analytics and Firebase Crashlytics, provided by Google Ireland Limited / Google LLC. These SDKs collect pseudonymous event data, installation identifiers and, if a crash occurs, stack traces and device state. We collect this data based on your in-App consent (analytics) and our legitimate interest in keeping the App stable (Crashlytics — with consent where required for non-essential identifiers). Information: firebase.google.com/support/privacy.
ARFA is partly funded by advertising. We display ads on the website (via Google AdSense) and inside the App (via Google AdMob, mediated by AppLovin MAX). Showing personalized ads, or storing/reading any ad-tech identifier on your device, requires your prior consent under Art. 129 Belgian Electronic Communications Act and Art. 6(1)(a) GDPR.
Provider: Google Ireland Limited / Google LLC. AdSense uses cookies and similar technologies to serve and measure ads. With your consent we share information such as your IP address, ad-interaction data and browsing context with Google for the purposes of ad delivery, frequency capping and measurement. More information: policies.google.com/technologies/ads.
Provider: Google Ireland Limited / Google LLC. AdMob uses your advertising identifier (IDFA on iOS, GAID on Android) and ad-request data to serve ads in the App. On iOS, AdMob may only use the IDFA if you grant permission via Apple's App Tracking Transparency (ATT) dialog. On Android, ad personalization requires consent through our CMP.
Provider: AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA. AppLovin MAX is a mediation layer that decides which ad network fills a given ad slot. With your consent, AppLovin and its participating ad networks may process your advertising identifier, IP address and ad-event data to deliver and measure ads. More information: applovin.com/privacy.
"Recharge Boost" is a feature where you can choose to watch a video ad in exchange for an in-App reward (e.g. additional credits or a feature unlock). Participation is always voluntary; you can use ARFA without ever using Recharge Boost.
When you start a rewarded ad we process:
Legal bases: Art. 6(1)(b) GDPR (delivering the reward you requested) combined with Art. 6(1)(a) GDPR / Art. 129 Belgian Electronic Communications Act for the underlying ad-tech.
On the website we use marketing pixels to measure the performance of our campaigns and, if you have consented, to retarget visitors. The pixels run only after you give consent through the CMP.
We use Sentry (Functional Software, Inc. dba Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) to capture errors and exceptions from the website and App. Sentry typically receives stack traces, browser/OS information, request metadata and — depending on the error — a pseudonymous user identifier. We have concluded a Data Processing Agreement with Sentry and rely on EU Standard Contractual Clauses for the transfer of personal data to the US. Legal basis: Art. 6(1)(f) GDPR for the legitimate interest in service stability; access to terminal-equipment information beyond what is strictly necessary takes place only after consent under Art. 129 of the Belgian Electronic Communications Act.
We share personal data only with the following categories of recipients and only to the extent necessary:
Some of our processors and joint controllers are based outside the EU/EEA, in particular in the United States (Google LLC, AppLovin Corporation, Sentry, Meta, TikTok, LinkedIn — to the extent that they process data on US servers).
For these transfers we rely on the following safeguards under Chapter V GDPR:
We can provide a copy of the relevant transfer mechanism on request to legal@arfa-studio.eu.
| Data | Retention |
|---|---|
| Account data | For the duration of your account; deleted within 30 days after account closure, unless retention is required by law. |
| Communication data (support emails) | Up to 3 years after the last contact for evidentiary purposes, in line with the limitation periods set by the Belgian Civil Code (Art. 2262bis old Civil Code / Book 5, Title 9 new Civil Code). |
| Web server log data | Up to 14 days, then automatically deleted or anonymized. |
| Analytics data (GA4, Firebase) | GA4 default of 14 months; Firebase event data up to 14 months. |
| Crash & error data (Crashlytics, Sentry) | Up to 90 days. |
| Advertising / consent-mode data | Up to 13 months (technical lifetime of the cookies/identifiers). |
| Consent records (CMP log) | Up to 3 years to demonstrate compliance with Art. 7(1) GDPR. |
| Invoices, contracts, tax-relevant records | 10 years from the close of the financial year, under Art. 60 §4 of the Belgian VAT Code and Art. III.86 of the Belgian Code of Economic Law. |
We implement appropriate technical and organisational measures under Art. 32 GDPR — including TLS encryption in transit, encrypted backups, access controls, principle-of-least-privilege for staff and third-party processors, and regular review of these measures. No method of transmission over the internet is 100% secure; we therefore cannot guarantee absolute security but we work to maintain a level of protection appropriate to the risk.
Subject to the conditions set by the GDPR, you have the right to:
To exercise any of these rights, write to legal@arfa-studio.eu. We may ask for information to verify your identity. We will respond within one month of receiving your request (Art. 12(3) GDPR), with a possible extension of two further months for complex requests.
ARFA is not directed at children. The App and websites are intended for users aged 13 and over, which corresponds to the age of digital consent set by Article 7 of the Belgian Act of 30 July 2018 in conjunction with Art. 8 GDPR for information-society services in Belgium. If you are under 13, please do not use the service or provide personal data without the consent of a holder of parental responsibility. If we become aware that we have collected personal data from a child under 13 without such consent, we will delete it without undue delay.
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. Ad personalization (where consented) is based on automated processing but does not produce legal or similarly significant effects.
We may update this Privacy Policy from time to time, for example to reflect changes in our services, in the providers we use, or in applicable law. The current version always carries the "Last updated" date at the top of this page. For material changes we will inform you in the App or by email before the changes take effect.