← Back to game

Privacy Policy

Product: GovCon Video Game (Published by KapitalGPT)

Data Controller: WealthTech Holdings Inc.

Effective Date: October 2026

1. Interpretation & Definitions

  • Company / We: WealthTech Holdings Inc., operating KapitalGPT and the GovCon Video Game.

  • Personal Data: Information relating to an identified or identifiable individual.

  • Service: The GovCon Video Game web application and associated architecture.

  • Service Provider: A third party we contract with to process data (e.g., hosting, payments, AI).

2. Information We Collect

  • A. Identity & Account: Email address, hashed password (managed securely; we never see plaintext), and optional basic profile data if you sign in via OAuth (e.g., Facebook/Google).

  • B. Gameplay & Company Data: In-game company name, entity type, simulated NAICS codes, simulated UEI/CAGE codes, contract bidding history, and in-game bank balances.

  • C. Payment Identifiers: We do not store credit card numbers or bank account details. All payment data is processed by our third-party checkout provider (e.g., PayPal). We retain only the webhook events and customer identifier needed to unlock your game access.

  • D. Usage & Device: IP address, user agent, page interactions for analytics, rate-limiting, and security telemetry.

3. How We Use Your Information

  • Service Delivery: To render the Command Center dashboard, execute game logic, and save your progress.

  • Authentication: To issue and validate secure sessions.

  • AI-Driven Gameplay: To power AI simulated contracting officers and bid feedback.

  • Security: To enforce database Row-Level Security (RLS) so players cannot see other players' game states.

4. Sub-Processors & Data Recipients We do not sell your Personal Data. We share data only with named sub-processors under strict confidentiality:

  • Supabase (AWS): Authentication, PostgreSQL database, and edge functions.

  • Payment Processor (e.g., PayPal): Exclusively handles checkout.

  • Google Gemini: Server-side AI inference for game mechanics.

5. AI-Specific Disclosures

  • Server-Side Inference: All AI calls execute securely inside our edge functions.

  • No Training Data: Per provider terms, your inputs and prompts are not used to train base AI models.

  • Input Sanitization: User prompts are sanitized to prevent injection attacks or exploits.

6. Data Retention, Deletion & Security

  • Retention: Data is retained while your account is active.

  • Deletion: On request to our support channels, your account and associated game data will be securely erased.

  • Security: Game data is protected by PostgreSQL Row-Level Security scoped strictly to your user ID. We enforce TLS encryption in transit and AES-256 at rest. Authentication is heavily rate-limited to prevent brute-force attacks.

7. Cookies & Tracking

  • Functional Cookies: We use session cookies strictly for authentication and keeping you logged into the game.

  • No Advertising Sale: We do not place third-party advertising cookies or share tracking data with affiliates for marketing purposes.

8. Children's Privacy The game is not directed to children under 18. We do not knowingly collect Personal Data from minors.

9. Privacy Rights (CCPA & GDPR)

  • CCPA (California): We collect Identifiers and Internet Activity. We do not sell your data. You have the right to know, delete, and receive non-discriminatory treatment.

  • GDPR (EU/UK): Our lawful bases for processing include Contract (delivering the game) and Legitimate Interest (security). You have rights to access, rectification, erasure, and portability of your data.

10. Contact Us For general inquiries or privacy requests (including account deletion), please contact us at: Contact@SmartConsultingGroup.org