Privacy Policy

This Privacy Policy explains what information GorilloBuild ("we", "us", "our") collects about you, how we use it, and the choices you have. It applies to gorillobuild.com and the services available through it. GorilloBuild is a service operated by Gorillo Ltd, a company registered in England and Wales. For the purposes of the UK GDPR and EU GDPR, Gorillo Ltd is the "data controller" of the personal data described here. Gorillo Ltd is registered in England and Wales under company number 17373133, with its registered office at Sapphire House, Knightsdale Road, Ipswich, Suffolk, England, IP1 4JJ. Gorillo Ltd is registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZC250270.

1. Information We Collect

We collect the following, depending on how you use the site:

• Account information - your email address, a display name, and (optionally) a profile photo you upload. Your password is hashed and stored by our authentication provider (Supabase); we do not have access to it in plain text.
• Sign-in and linked accounts - if you sign in with, or connect, a third-party account (Google, Discord or Patreon), we receive basic profile details from that provider (such as your name, email or avatar) and an account identifier so we can link it. Connecting Patreon lets us read your membership tier; connecting Discord lets us assign your community roles.
• Subscription and payment information - your membership tier and status, and billing details, are processed by Paddle, our payment provider and merchant of record (Paddle is the reseller of our subscriptions). We store your Paddle customer reference and subscription status, but we do not store your card number or full payment details - Paddle handles those directly.
• Preferences and consent - whether you have accepted our terms, whether you have opted in to marketing emails, and minor settings such as your preferred currency.
• Age and parent-managed accounts - when you register we record whether you have confirmed you are over 13. For members under 13 we operate a parent-managed account flow, in which a parent or guardian sets up the account and provides consent, and we collect the limited information needed to run that account (such as the parent's name and the child's chosen username). We do not collect a child's date of birth or specific age.
• Usage and activity data - to run and improve the site we record activity such as builds and guides you view, downloads you request, likes and completed builds, saved builds, searches and filters you use, and interactions with the village maps. If you cancel a subscription we may record the reason you give.
• Community showcase uploads - if you choose to upload a photo of your own version of a build to that build's community gallery, we store the image, the caption you write with it (parent-managed accounts for under-13s cannot write captions), the build it relates to, your account reference and its moderation status. The photo and its caption are reviewed before they appear; approved posts are shown publicly on that build's page and in the community gallery alongside your display name, and you can edit or delete yours at any time. If we ask you to change a caption we also store the note explaining why. We also record the likes you give to other people's showcase photos.
• Shared village layouts - if you choose to share a village you have made in the Village Planner, we store the layout, the name you give it, a picture of it, your account reference and its moderation status. A layout shared from a parent-managed account is shown publicly under a neutral name instead of the one you gave it. It is reviewed before it appears; approved layouts are shown publicly in the planner's community gallery alongside your display name, where others can open a copy to build on, and you can delete yours at any time. We also record the likes you give to other people's layouts.
• Waitlist and pre-launch signups - if you join our waitlist (for example on the coming-soon page), we store the email address you give us and the date and source of your signup, so we can email you about our launch and updates. This is based on your consent, and you can unsubscribe at any time using the link in every email, which removes you from the list.
• Feedback, bug reports and reviews - if you send us feedback or report a problem, we store your message, the page you were on, your browser and device type, your membership tier and, if you give it, your email address. If you write a review of GorilloBuild, we store the review, the name you choose to show with it, your rating and whether you agreed to it being featured. We do not ask parent-managed (under-13) accounts for reviews.
• Things you save - village plans you save in the Village Planner, your progress through build guides, and the notifications we send to your account.
• Security and error data - to protect the site from abuse we briefly use your IP address to limit how many requests can be made (for example to sign-up and checkout), and we use your approximate country, worked out from your IP address, to show prices in your local currency. Neither is stored with your account. If part of the site breaks, an error report is sent to our error-monitoring provider (Sentry) with technical details such as the page, browser and error message; it is set up to remove personal details such as email addresses and IP addresses before reports are stored.
• Technical and analytics data - your approximate (city-level) location, which Google Analytics derives from your IP address (GA4 does not log or store the IP address itself), your device and browser type, and how you arrived at and move through the site, collected via Google Analytics (see Section 3).

2. How We Use Your Information

We use your information to:

• create and manage your account and keep you signed in;
• provide the service, including gating premium downloads and 3D guides to the correct membership tier;
• process subscriptions, payments and refunds through Paddle, and keep your access in sync with Patreon and Discord where you have connected them;
• send you service (transactional) emails such as sign-up confirmation, password resets and account notices;
• send optional marketing and re-engagement emails (for example a welcome, an abandoned-checkout reminder or a win-back offer) only if you have opted in, and you can unsubscribe at any time using the link in every such email;
• add you to our pre-launch waitlist and email you about our launch and updates if you sign up for it, until you unsubscribe;
• review, approve and display community showcase photos you choose to upload, and remove them on request;
• understand how the site is used so we can improve it; and
• maintain security and prevent abuse.

Our legal bases for processing (UK/EU GDPR), mapped to what we do with your data, are:

• Contract - creating and running your account, and providing your subscription and downloads.
• Consent - sending you marketing or launch emails, adding you to the waitlist, and setting non-essential (analytics) cookies. You can withdraw consent at any time (unsubscribe, or change your cookie choices).
• Legitimate interests - keeping the service secure, preventing fraud and abuse, and understanding and improving how the site is used.
• Legal obligation - keeping financial and transaction records we are required by law to retain.

3. Cookies and Tracking

We use cookies and similar browser storage for two purposes:

• Essential - to keep you signed in, remember your currency preference, and remember choices such as dismissing a banner. The site does not work properly without these.
• Analytics - we use Google Analytics 4 (provided by Google LLC) to understand how visitors find and use the site. It uses cookies and identifiers to collect the technical and usage data described in Section 1. We use it to understand overall trends and improve the site, rather than to identify or build a profile of you as an individual. We do not enable Google's advertising or demographic ("Google Signals") features, so we do not receive age, gender or interest profiling from Google, and we do not use analytics for advertising.
• Heatmaps and session recordings - if you accept analytics cookies, we also use Microsoft Clarity (provided by Microsoft Corporation) to see where people click and scroll, and to watch anonymised recordings of how pages are used, so we can find confusing parts of the site. Recordings hide the text on the page and anything you type, and Clarity is not used on the 3D guides, maps, Village Planner, or account, admin and password pages. We do not use Clarity for advertising.

You can decline non-essential cookies via our cookie controls, and install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout. See also our Cookie Policy.

4. Data Sharing and Third Parties

We do not sell your personal data. We share it only with the service providers that help us run GorilloBuild, each acting as our processor or an independent controller as applicable:

• Supabase - authentication, database and file storage (hosts your account and content data).
• Paddle (Paddle.com Market Limited) - merchant of record for subscriptions: checkout, payment processing, sales tax and invoices. Paddle is responsible for the payment information it collects under its own privacy policy.
• Vercel - website and application hosting.
• Google Analytics - website analytics.
• Microsoft Clarity (Microsoft Corporation) - heatmaps and session recordings, only if you accept analytics cookies.
• Resend - delivery of our emails. Links in our emails pass through Resend first, so we can count how many times each email's links are clicked and learn which emails are useful. We do not track whether an email is opened.
• Sentry (Functional Software, Inc., with data stored in the EU) - error monitoring, so we can find and fix problems with the site.
• Zoho (Zoho Corporation B.V., with data stored in the EU) - our help desk: when you contact us through the site or by email, your message and the details you give with it are stored there so we can answer you and keep track of the conversation.
• GitHub (GitHub, Inc., a Microsoft company) - builds the downloadable world file when you export a village from the Village Planner. The plan being exported and its reference are sent for that job; it runs on demand and the files are removed afterwards.
• Google, Discord and Patreon - only where you choose to sign in with or connect these accounts, for the purposes described in Section 1.

Some of these providers are based outside the UK/EEA; where personal data is transferred internationally, it is protected by appropriate safeguards such as the providers' Standard Contractual Clauses. We may also disclose information if required by law or to protect our rights and users.

5. Data Retention

We keep personal data only as long as we need it for the purposes above:

• Account data (email, display name, preferences, connected accounts) - while your account is active, and deleted or anonymised within 30 days of you deleting your account.
• Showcase images and content you post - until you delete them, or until your account is deleted.
• Copies in our backups - the database is backed up daily and kept for seven days, and the pictures members upload are copied nightly and kept for ninety days. Something you delete goes from the site straight away, and falls out of those copies as they expire.
• Waitlist email addresses - until you unsubscribe, or up to 6 months after launch, whichever comes first.
• Payment and transaction records - retained by Paddle for the period required by UK law (financial records are generally kept for 6 years).
• Feedback, bug reports and reviews - until the matter is dealt with or you ask us to delete them, and in any case when your account is deleted.
• Error reports - kept by Sentry for a limited period (up to 90 days) and then deleted.
• Security and rate-limit records - kept only briefly (minutes to hours) and then removed automatically.
• Analytics data - kept for the retention period configured in Google Analytics (currently up to 14 months), after which it is deleted; aggregated figures that no longer identify anyone may be kept longer.
• Heatmaps and session recordings - kept by Microsoft Clarity for its standard periods (recordings for about 30 days unless we mark one to keep for a specific fix, heatmap data for up to 13 months), then deleted.

6. Your Rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to object to or restrict certain processing, to withdraw consent (for example to marketing) at any time, and to receive a copy of your data in a portable format. You can update your details and email preferences in your account settings, or contact us using the details in Section 10 to exercise any of these rights. If you are in the UK or EU and are unhappy with how we handle your data, you have the right to complain to your data protection authority (in the UK, the Information Commissioner's Office at ico.org.uk).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

7. Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit, access controls, and relying on established providers (such as Supabase and Paddle) for authentication and payments, and we keep these measures under review. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. In the unlikely event of a personal data breach that is likely to affect your rights, we will notify you and the relevant supervisory authority where we are required to do so by law.

8. Children's Privacy

GorilloBuild is suitable for a general audience, including younger players, but children under 13 may only use it through a parent-managed account set up and consented to by a parent or guardian. We do not knowingly collect personal data directly from a child under 13 outside of that flow. If you believe a child has provided us personal data without appropriate consent, please contact us and we will remove it. We do not use Google's demographic/advertising features to profile children.

For parent-managed accounts we also: switch Google Analytics and Microsoft Clarity off entirely, even if the cookie banner is accepted on that device; never send marketing or re-engagement emails; do not ask for reviews; and do not offer Discord account linking, because Discord is only for people aged 13 and over. Any purchase from a parent-managed account first asks the parent or guardian to confirm.

9. Changes to This Policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you by email or a notice on the site. We encourage you to review this policy periodically.

10. Contact Us

For any privacy question or to exercise your rights, contact us at contact@gorillobuild.com.