Privacy Policy | The Big Studio

Privacy Policy and Personal Data Notice

Last updated: October 15, 2026

1. Controller and scope

The controller is The Big Studio (“The Big Studio”), an independent game and software studio based in Türkiye. Address: Türkiye. Contact: support@thebigstudio.net.

This notice covers https://thebigstudio.net, DEADGATE closed alpha applications and the products described below. Personal data is processed under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the EU General Data Protection Regulation (“GDPR”).

2. How we collect data

We collect data electronically through website forms, cookie preferences, email correspondence, relevant product features and account functions used through Steam. Our application and security systems automatically generate the technical records described below. The website uses Microsoft Azure App Service and Azure SQL, hosted in the Italy region within the European Union.

3. Contact form

We process the full name, email address and message you submit to assess and respond to your request. Your submission is delivered to the studio by email. We currently use Google/Gmail SMTP for email delivery and may use another transactional email provider in the future. Any provider change will be reflected in the relevant processing and transfer information.

4. DEADGATE closed alpha applications

Application details: Email address, nickname, country, graphics card, processor, RAM and weekday/weekend availability.
Steam account details: Since October 15, 2026 the application form no longer asks you to sign in with Steam. If you applied by signing in with Steam before that date, your Steam ID (SteamID64), profile name, profile visibility and, if your profile is public, the date your account was created are kept with your application. We never see your Steam password.
Optional information: Extraction games previously played, Discord username and your reason for participating. These fields are optional.
Declarations and preferences: Your declaration that you are at least 18, the version and acceptance time of the participation terms, your acknowledgement that you have read this notice, and any separate newsletter consent.
Technical records: A one-way hash of your IP address, a hash of a random device identifier stored in your browser, browser information, timestamps, application status and duplicate-application flags. Raw IP addresses are not stored in application records. Hashing does not, by itself, make the data anonymous.
Alpha participation record: If you are selected, the game records the number of sessions, raids and play time linked to your Steam ID. This record is used to evaluate the test and improve the game.

We use this information to assess applications; prevent the same person from applying more than once; select participants based on hardware, region and availability; verify email addresses; send Steam keys to selected participants; deliver test communications; and prevent abuse. Without the information necessary to process an application, we may be unable to assess it.

Alpha application data is not transferred to Valve or Steam. While Steam sign-in was available, Steam only told us your account ID; to retrieve your profile name and account creation date, only that ID was sent to Steam’s public web API. Selected participants activate their keys in their own Steam accounts. Activation and subsequent platform activity are subject to Steam’s own privacy policy.

In-game feedback and bug reports: When you choose to send a report in DEADGATE with “FEEDBACK” or “REPORT A BUG”, we process: your Steam ID (to match the report to your account and show you our reply in the game); the category and severity you select and the title and description you write; the game version, operating system, processor, graphics card, memory, screen resolution and graphics settings; if you are in a raid, your position on the game map, view direction and in-game time; and, if you leave them switched on in the form, a screenshot of the game screen taken when you opened the form and the last part of the game log (about 200 KB at most; your user folder name on your computer is hidden before sending). If you send a report on the launch after the game closed unexpectedly, the previous session’s log is attached. We process this data on the basis of our legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)) to find and fix bugs and performance problems and to tell you the status of your report. Sending a report is optional; you can switch off the screenshot and the log in the form. Reports and their attachments are stored in our database on Microsoft Azure and are seen only by the development team.

In-game voice chat: Voice chat in DEADGATE uses Steam’s voice system. Your voice is compressed by Steam only while you hold the push-to-talk key, or while you speak if you selected open mic in the settings, and is relayed through the raid server only to players who can hear you at that moment (team radio: your team; proximity: players within 40 metres of you in the game). Voice is not recorded, stored or listened to by us; the server only relays it in real time. This processing provides the game’s multiplayer communication feature (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)). You can switch voice chat off completely in the settings and mute players or everyone; players you blocked on Steam are muted automatically.

5. Emails and marketing consent

Alpha communications include email verification, application receipt confirmation, a Steam key if selected, and announcements necessary for running the test. These communications relate to your application and participation.

Newsletter and marketing emails are sent only if you give consent through a separate opt-in. Consent is not a condition of applying or being selected. Acknowledging this privacy notice or accepting the participation terms does not constitute marketing consent.

You may withdraw consent at any time through the unsubscribe option in the email or by contacting support@thebigstudio.net. Consent and opt-out requests are managed in accordance with Türkiye’s commercial electronic messaging rules and applicable Message Management System obligations. Official information about İYS.

6. Our other products

Voice2Action: We process your Steam ID for authentication and account functions, and your credit balance to manage service usage. Audio is sent to the OpenAI Whisper API only while AI mode is enabled. Text submitted for correction is sent to the OpenAI API. These audio and text contents are not stored on The Big Studio’s servers. This does not represent a promise that OpenAI retains no data in its own systems. AI mode requires explicit consent; you may withdraw consent and stop using that mode.
Voice2Action payments: Payments use Steam’s microtransaction system. We do not see or store payment card details. Payment records are retained for 10 years.
DEADGATE (closed alpha): Steam IDs are processed for the game account, inventory and progress, multiplayer matchmaking and to evaluate test participation. Details are also shown in the game before this processing starts.
Hold The Line and Eat or DIE!: Steam IDs are processed for progress, achievements and leaderboards.
ManasPDF: Runs entirely offline and does not collect personal data.

7. Legal bases

Entering into or performing a contract: Processing necessary for alpha applications and participation, account functions and product services; KVKK Article 5(2)(c) and, where applicable, GDPR Article 6(1)(b).
Legitimate interests: Responding to enquiries, security and abuse prevention, subject to protection of your fundamental rights and freedoms; KVKK Article 5(2)(f) and, where applicable, GDPR Article 6(1)(f).
Explicit consent: Analytics cookies, newsletter and marketing emails, and Voice2Action AI mode; KVKK Article 5(1) and, where applicable, GDPR Article 6(1)(a).
Legal obligations: Records required by law, such as payment records; KVKK Article 5(2)(a) and (ç). GDPR Article 6(1)(c) applies only to the extent that a qualifying legal obligation exists under the GDPR.

Withdrawal of consent does not affect the lawfulness of earlier processing based on that consent. Relevant provisions: KVKK Article 5 and GDPR Articles 6 and 7.

8. Security, cookies and Turnstile

Forms use a hidden honeypot field, submission timing checks and rate limiting. If Cloudflare Turnstile is enabled, Cloudflare processes browser and IP data for verification and abuse prevention. Our decision not to store raw IP addresses in application records does not mean Cloudflare does not process them.

Google Analytics runs only with your analytics consent. Our Cookie Policy explains the cookies, their durations and the Steam store component. You can change your choices through the “Cookie preferences” link at the bottom of the page.

9. Recipients and international transfers

Recipient	Purpose and scope	Location
Microsoft	Website and database hosting through Azure App Service and Azure SQL.	Italy, European Union.
Google	Email delivery through Gmail SMTP; usage analytics through Google Analytics only with consent.	Global infrastructure, including the United States.
OpenAI	Speech-to-text and text correction only within Voice2Action AI mode.	United States.
Valve / Steam	Account and game functions and payments in Steam products through the user’s own account. Alpha application data is not transferred. Website Steam component processing is explained in the Cookie Policy.	Processing locations described in Steam’s own privacy policy.
Edgegap	Hosting DEADGATE multiplayer raid servers: your IP address for the connection, game state and real-time relay of voice chat audio (voice is not recorded).	The Edgegap location nearest to the player; global infrastructure including the European Union.
Cloudflare	Security verification only if Turnstile is enabled.	International processing locations used by Cloudflare for the service.

Hosting and services outside Türkiye may involve international transfers. Under KVKK Article 9, transfers must rely on an applicable adequacy decision or appropriate safeguards meeting the legal requirements, such as standard contracts. Where neither is available, exceptional transfer provisions may be used only when their statutory conditions are met and the transfer is occasional; they are not a general exception for ongoing cloud services. Official KVKK guidance on international transfers.

Transfers subject to the GDPR also require applicable transfer conditions and appropriate safeguards. This notice does not assert that a standard contract has been signed with a particular provider or that a particular adequacy decision applies. You may request information about the transfer mechanism and relevant safeguards at support@thebigstudio.net.

10. Retention periods

Data or record	Retention
Contact form submissions and related correspondence	No more than 1 year after the request is answered.
Alpha applications with an unverified email address	Deleted 30 days after submission.
Verified applications from people not selected	Deleted 90 days after the alpha actually ends.
Alpha participants’ application and participation records	Deleted 12 months after the alpha actually ends.
Newsletter subscription data	Until consent is withdrawn.
Sent email delivery logs	30 days from sending.
Voice2Action audio and text correction contents	Not stored on The Big Studio’s servers.
DEADGATE in-game feedback reports and attachments (screenshot, game log, system information)	Deleted 12 months after the closed alpha actually ends.
DEADGATE in-game voice chat audio	Not recorded; relayed in real time only.
Payment records	10 years.
Cookies	The periods specified in the Cookie Policy.

Account, credit balance and game records without a separately specified period are retained only as long as necessary for the relevant service purpose. Newsletter consent does not authorise retention of your entire alpha application for newsletter purposes. Consent, opt-out and other records required by law are retained only to the extent and for the period necessary for the relevant obligation; they are not used to continue marketing.

11. Your rights and requests

Under KVKK Article 11, you may ask whether your data is processed, request information about processing, and learn its purpose, whether it is used accordingly, and its domestic or international recipients. You may request correction and, where the conditions are met, deletion or destruction, together with notification of these actions to recipients. You may object to adverse results arising solely from automated analysis and seek compensation for damage caused by unlawful processing.

Where the GDPR applies, you also have rights of access, rectification, erasure, restriction, objection and portability, subject to their conditions. You may withdraw consent at any time. GDPR rights.

Send requests to support@thebigstudio.net or Türkiye. We may request necessary and proportionate identity verification to handle your request securely. Requests are answered as soon as possible and within 30 days, subject to any shorter applicable legal deadline.

Under the KVKK, you may complain to the Turkish Personal Data Protection Board after first applying to the controller and meeting the applicable procedural conditions. Where the GDPR applies, you may also complain to the relevant EU supervisory authority. KVKK request and complaint procedure.

12. Children and updates

We do not knowingly collect personal data from anyone under 18. The DEADGATE closed alpha is open only to people aged 18 or over. Please contact us if you believe someone under that age has submitted personal data.

We may update this policy when our services or processing practices change. The current version and update date are published on this page. Updating the policy alone does not authorise processing that requires new explicit consent.