Privacy Policy

Effective Date: 19 November 2025

Last Updated: 24 August 2026

1. Who we are and how to contact us

This Privacy Policy explains how Impact Forge LLC ("Impact Forge", "we", "us" or "our") collects, uses, shares and protects personal data. Impact Forge LLC is a Limited Liability Company registered in the State of Minnesota, United States. We are an independent video game developer and publisher, and we are the developer and publisher of Battlespace.

For the purposes of the UK and EU General Data Protection Regulation ("GDPR") and equivalent laws, Impact Forge LLC is the data controller of the personal data described in this policy. That means we decide why and how your personal data is processed, and we are accountable for it.

We are not currently required to appoint a Data Protection Officer. Privacy enquiries are handled by the studio directly at the address above.

2. Scope of this policy

This policy applies to personal data we process in connection with:

• our games, including Battlespace, and any playtests, betas or early access builds of them;
• this website at https://battlespace.dev;
• our player support, community and press channels; and
• our business contacts, applicants and partners.

We refer to all of these together as the "Services".

This policy does not apply to the practices of third parties we do not control — including Epic Games, Inc., digital storefronts, and platform holders. Those parties process your data under their own privacy policies, and Section 16 explains how to find them.

3. Age requirements and children's privacy

Battlespace is a military-themed first-person shooter containing realistic violence, and it is not directed at children.

3.1 Minimum age

You must be at least 13 years old to create an account or use our Services. Where the law of your country sets a higher minimum age for consent to the processing of personal data by information society services, that higher age applies to you instead. In the EU and EEA the digital consent age is between 13 and 16 depending on the Member State; in the United Kingdom it is 13; in South Korea it is 14.

If you are under the applicable age of digital consent in your country, you may only use our Services with the consent of, and under the supervision of, a parent or legal guardian, and only where that consent has been given in a manner we can verify.

3.2 Age assurance

Where we collect a date of birth or otherwise apply an age gate, we retain the resulting age-status flag rather than the underlying date where we are able to, and we use it only to apply age-appropriate restrictions.

3.3 If we learn a child has given us data

We do not knowingly collect personal data from children below the applicable minimum age. If we become aware that we have done so without the required parental consent, we will delete that data and close the associated account promptly.

If you are a parent or guardian and believe your child has provided personal data to us, contact [email protected]. We will verify your relationship to the child, tell you what data we hold, and delete it on request. Parents and guardians may also refuse any further collection of their child's data.

4. Personal data we collect

The categories below describe what we may collect. Not all of it applies to every player — what we actually hold depends on which features you use.

4.1 Data we do not collect

We do not intentionally collect special category data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, sex life or sexual orientation), biometric data, precise geolocation, or government identifiers. Please do not send us this kind of information; if you do, we will delete it.

4.2 Providing data is your choice

Some data is necessary to provide the Services — without an account identifier we cannot run a multiplayer session for you. Other data is optional, and the policy makes clear below where that is the case. You are never required to give us optional data in order to play.

5. How we use your data and our legal bases

Under the GDPR and similar laws, we must have a lawful basis for each purpose for which we process your personal data. The table below sets out each purpose, the data involved, and the basis we rely on.

Where we rely on legitimate interests, we have assessed that our interest is not overridden by your interests or fundamental rights. You may ask us for a summary of that assessment, and you have the right to object — see Section 13.

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing carried out before you withdrew it, and it does not affect processing we carry out on another basis.

5.1 No automated decision-making with legal effects

We use automated systems to detect cheating and abuse. Where such a system contributes to a sanction that meaningfully affects your access to the Services — such as a permanent ban — you may request human review by contacting [email protected]. We do not carry out profiling that produces legal effects concerning you or similarly significantly affects you outside this context.

6. Epic Games, Epic Account Services and Unreal Engine

Battlespace is built with Unreal Engine 5 and uses Epic Online Services, including Epic Account Services, provided by Epic Games, Inc. This section explains exactly what that means for your data.

6.1 Signing in with an Epic Games account

You may choose to sign in to Battlespace using an Epic Games account. If you do, Epic Account Services will ask you, in a consent screen presented by Epic, to permit the sharing of certain information with Impact Forge LLC. Depending on what you approve, we may receive:

We request the minimum set of permissions the feature needs. We do not receive your Epic Games password, your payment details, or your purchase history on the Epic Games Store.

6.2 Withdrawing your Epic consent

You can review and withdraw the permissions you granted to Battlespace at any time in the Apps or Connected Accounts section of your Epic Games account settings at epicgames.com/account/connections. Withdrawing a permission stops any further sharing of that information with us. It may also disable the feature that depended on it — for example, removing friends-list access will stop your Epic friends appearing in-game.

Withdrawing consent at Epic does not by itself delete the data we have already received. To have that deleted, make a request under Section 13.

6.3 Epic as an independent controller

When you use an Epic Games account, Epic Games, Inc. processes your data as an independent controller under its own privacy policy, not as our processor. That includes the account, sign-in and platform data Epic holds about you. Epic also processes certain data as our service provider when we use Epic Online Services features such as matchmaking, lobbies and player data storage.

Epic's own practices are described in the Epic Games Privacy Policy. Questions about the data Epic holds about your Epic Games account should be directed to Epic.

6.4 Unreal Engine

Battlespace is developed with Unreal Engine under a licence from Epic Games, Inc. Unreal Engine may transmit limited technical and crash data to Epic Games as described in Epic's documentation and privacy policy. Impact Forge LLC is an Unreal Engine licensee and is not affiliated with, endorsed by, or sponsored by Epic Games, Inc.

7. Who we share your data with

We do not sell your personal data. We share it only in the circumstances below.

7.1 Other players

Some information is shared with other players as an inherent part of a multiplayer game: your display name, your scoreboard statistics, your presence in a match, and anything you say in text or voice chat. Do not disclose personal information about yourself in chat that you would not want other players to have.

7.2 Our contracts with processors

Every processor we engage is bound by a written contract requiring them to process personal data only on our documented instructions, to keep it confidential, to apply appropriate security measures, and to delete or return it at the end of the engagement.

8. Marketing and your choices

We will only send you marketing email where you have subscribed, or where the law permits us to contact an existing player about our own similar products. Every marketing message we send contains an unsubscribe link that works immediately.

You can also opt out at any time by emailing [email protected]. Opting out of marketing does not stop service messages — account security notices, changes to our terms, and messages about your support tickets — because we need to send those to run the Services.

9. Cookies and similar technologies

Our website uses a small number of cookies and equivalent technologies such as local storage.

We do not use advertising or cross-site tracking cookies. You can block or delete cookies through your browser settings; strictly necessary cookies cannot be refused without affecting how the site works.

The game client itself does not use browser cookies, but it does store local identifiers and settings on your device in order to function.

9.1 Do Not Track and Global Privacy Control

There is no common industry standard for responding to browser "Do Not Track" signals, and we do not currently respond to them. We do honour the Global Privacy Control (GPC) signal where applicable law requires it, treating it as a valid opt-out of any sale or sharing of personal data — though, as stated, we do not sell or share personal data in the first place.

10. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires.

Where we no longer need data but cannot immediately delete it — for example because it exists in a backup — we isolate it from further active processing and delete it on the normal backup cycle.

11. International data transfers

Impact Forge LLC is established in the United States, and our service providers may be located in other countries. This means your personal data may be transferred to, stored in, and processed in countries outside your own, including the United States, which may not provide the same level of data protection as your home country.

Where we transfer personal data out of the United Kingdom, the European Economic Area or Switzerland, we rely on one or more of the following safeguards:

• the European Commission's Standard Contractual Clauses (Decision 2021/914), and for UK transfers the UK International Data Transfer Addendum or the UK IDTA, in each case with any supplementary measures the transfer risk assessment identifies as necessary;
• an adequacy decision covering the destination country, where one is in force; or
• another safeguard permitted by Article 46 of the GDPR.

You may request a copy of the safeguards we rely on for a particular transfer by writing to [email protected].

12. How we protect your data

We maintain technical and organisational measures appropriate to the risk, including:

• encryption of data in transit using TLS, and encryption at rest for our databases and backups;
• access control on a least-privilege basis, with multi-factor authentication on administrative accounts;
• segregation of production systems from development and test environments;
• logging and monitoring of access to systems holding personal data;
• vendor due diligence before we engage a processor; and
• an internal process for identifying, containing and reporting personal data breaches.

Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and we will notify affected individuals without undue delay where the law requires it.

No system is perfectly secure. You are responsible for keeping your own account credentials confidential and for using a strong, unique password on any account you use to access our Services.

13. Your privacy rights

Subject to the law that applies to you, you have the following rights over your personal data:

• Access — to be told whether we process your data, and to receive a copy of it.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your data deleted where we no longer have grounds to keep it.
• Restriction — to have our processing limited while a dispute about accuracy or lawfulness is resolved.
• Portability — to receive data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Objection — to object to processing we carry out on the basis of legitimate interests, and an absolute right to object to direct marketing.
• Withdrawal of consent — to withdraw any consent you have given, at any time.
• Non-discrimination — not to be treated less favourably for exercising a privacy right.

13.1 How to make a request

Email [email protected] with the subject line "Privacy Request". Tell us which right you are exercising and give us enough information to find your records — typically your in-game player name and the email address or account identifier you use.

We will verify your identity before acting, in proportion to the sensitivity of the request. We may ask you to confirm the request from the email address on the account, or to answer a question only the account holder would know. We do not require you to create an account in order to make a request.

We respond within 30 days for GDPR requests and within 45 days for requests under US state privacy laws. Where a request is complex or we receive several from you, we may extend by a further period permitted by law and will tell you if we do. Requests are free, unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline — and we will explain why.

13.2 Authorised agents

You may use an authorised agent to make a request on your behalf where the law allows. We will ask for written proof of the agent's authority and may still verify your identity directly.

14. Additional disclosures for United States residents

This section applies if you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or another US state with a comprehensive consumer privacy law.

14.1 Categories collected, disclosed, sold or shared

In the preceding twelve months we have collected the categories of personal information listed in Section 4, and disclosed them for business purposes to the categories of recipients listed in Section 7.

We have not sold personal information, and we have not shared personal information for cross-context behavioural advertising. We have not sold or shared the personal information of consumers we know to be under 16.

14.2 Sensitive personal information

We do not collect sensitive personal information for the purpose of inferring characteristics about you, and we do not use or disclose it beyond the purposes permitted without a right to limit under the CCPA/CPRA.

14.3 Your rights

Depending on your state, you have the right to know, access, correct and delete your personal information; the right to obtain a portable copy; the right to opt out of sale, sharing, targeted advertising and certain profiling; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising these rights. Exercise them as described in Section 13.1.

14.4 Right to appeal

If we decline your request, you may appeal by replying to our decision or emailing [email protected] with the subject line "Privacy Appeal". We will respond to an appeal within 45 days with a written explanation of our decision. If we deny the appeal, we will tell you how to contact your state Attorney General to submit a complaint.

14.5 Shine the Light

California Civil Code section 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

15. Additional disclosures for other regions

15.1 European Economic Area, United Kingdom and Switzerland

Our lawful bases are set out in Section 5, our transfer safeguards in Section 11, and your rights in Section 13. You have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office at ico.org.uk. We have not appointed an EU or UK representative under Article 27; if we become required to, we will name them here.

15.2 Canada

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation, including Quebec's Law 25. You may complain to the Office of the Privacy Commissioner of Canada.

15.3 Australia

We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may complain to the Office of the Australian Information Commissioner.

15.4 Brazil

Where the Lei Geral de Proteção de Dados (LGPD) applies, you have rights of confirmation, access, correction, anonymisation, portability, deletion and information about sharing, and you may complain to the ANPD.

15.5 Japan and South Korea

Where the Act on the Protection of Personal Information (Japan) or the Personal Information Protection Act (South Korea) applies, we process personal data in accordance with those laws, including their requirements for consent to overseas transfer.

16. Third-party services and links

Our Services link to and interoperate with services we do not control. Their handling of your data is governed by their own policies, not ours:

• Epic Games Privacy Policy
• The privacy policy of whichever digital storefront you obtained the game from
• The privacy policy of any social or community platform you use to reach us

We are not responsible for the content or privacy practices of third-party sites. Please read their policies before providing them with personal data.

17. Changes to this policy

We may update this Privacy Policy to reflect changes to our Services, our processors, or the law. When we do, we will update the "Last Updated" date at the top of this page.

Where a change is material — for example, a new purpose for processing, or a new category of recipient — we will give you prominent advance notice through the game, by email, or on this website, and where the law requires it we will obtain your consent before the change takes effect. Previous versions are available on request from [email protected].

18. How to complain

If you are unhappy with how we have handled your personal data, please tell us first at [email protected]. We would rather resolve it directly, and we take complaints seriously.

You always retain the right to complain to a data protection authority in the country where you live, where you work, or where you believe an infringement occurred, without contacting us first.

---

Impact Forge LLC — Developer and Publisher of Battlespace. Impact Forge LLC is a Limited Liability Company registered in the State of Minnesota, United States. This Privacy Policy was last updated on 24 August 2026.