PRIVACY POLICY
TOM AND JERRY BLAST
Last updated: 28th September 2026
Introduction – What is this policy for?
This privacy policy (this “policy”) is about how we process your “personal data” when you’re playing Tom and Jerry Blast (the “game”).
Who are we?
We are Electronic Game Development Company, trading as Steer Studios (“we” or “us” in the rest of this policy). We are located at Steer Studios, KAFD Tower 1.09 – Kingdom of Saudi Arabia and you can find our contact details at the end of this notice. We make decisions about how and why we use your personal data when you use the game. This means we’re what’s called a “data controller” of your personal data.
What is personal data?
Personal data is any information which directly or indirectly identifies you. This can include your name or nickname, your contact information, and also unique identifiers like your IP address or IDs associated with your mobile device.
By reading this policy, you will understand how we collect, use, and share your personal data, and how you can exercise your rights in relation to your personal data - including a right to object to some of the processing we carry out. More information about your rights, and how to exercise them, is set out in the “What are your rights in respect of your personal data” section.
How do we collect your personal data?
Sometimes you give us your personal data directly - for example, when you are creating your profile, or contacting our customer support teams.
Sometimes we collect personal data about you automatically when you use the game, for example information about your activity in the game, and information from your device like your IP address.
When you play the game, we also use tracking technologies – in particular, software development kits or “SDKs” - to store and access personal data from your mobile device. For more information about how we use tracking technologies, the type of information they collect, and how you may be able to consent or refuse to certain kinds of tracking technologies being used, see the Tom & Jerry Blast Tracking Policy.
What personal data do we use?
When you play the game, we collect the following categories of personal data relating to you:
| Category | Details |
|---|---|
| Profile setup information | Nickname, avatar, age check result (we only retain the outcome of the age check, we do not store your age itself) |
| Contact information | Email address |
| Customer support information | Any information voluntarily provided to customer support, such as your first and last name and the content of your query |
| Gameplay information | Information about your activity in the game, for example profile state, mission time, item acquisitions, inventory amounts, ability, leaderboard position |
| Online identifiers | Device ID (such as IDFA, GAID, App Set ID), vendor ID (such as IDFV), page URL/referrer IDs, and other identifiers that may be derived from a combination of these online identifiers and/or device information |
| Device information | Device information such as device brand name, model name, model marketing name, OS hardware, OS version, time zone, language, user agent, country code and country name, RAM, memory used and free, disk |
| Online activity | Whether and when you have downloaded, installed or played the game in response to one of our ad campaigns |
| Personal characteristics | Your interests, preferences and characteristics. You may have declared these as part of your profile, or these may be things we infer about you based on for example your online activity and gameplay information |
| Moderation information | Records of whether you have breached our terms of service, for example as a result of using a prohibited nickname; comments our moderation team have made in relation to your profile; records of action taken in relation to your profile |
| The content of reports you make about the behaviour of other users in the game | |
| Privacy preferences | Records of your privacy preferences and any consents you have given us |
| Data subject request information | The content of any data subject request you make to us, and any identification information we may request from you in order to verify you as the person who has made the request |
We also receive personal data relating to you from third parties, including:
| Category | Details | Who we receive this from |
|---|---|---|
| Platform age information | iOS - Declared Age Range / Android - Play Age Signals | From the app store you downloaded the game from |
| Online activity | Information about your interactions with third‑party websites, applications, and ads - including which type of ad was served to you, where and when it was served to you, whether you viewed or clicked on the ad, and your time spent viewing the ad | From our service providers, such as ad attribution and measurement providers |
| Payment details | Payment amount, item purchased, currency paid, transaction ID, timestamp, purchase validation token | From the app store where you have made a purchase of an in-game item |
| Moderation information | The content of any reports we receive from other players in relation to your behaviour in the game | Other players of the game |
We may also receive aggregated insights from our service providers and app stores, for example regarding the demographics of individuals who have downloaded or responded to an ad about a game, and how our ads have performed. We will not be able to identify you from these reports.
What do we use your personal data for?
We use your personal data for the following purposes. We have also set out our “legal basis” for each purpose, which is relevant if you are in certain jurisdictions, for example the UK or EEA.
| Purpose of processing | Personal data we use for this purpose | Legal basis |
|---|---|---|
| Profile setup - To create your profile in order to provide access to the game | Profile setup information / Online identifiers | Necessary to perform a contract with you (our terms of use for the game) / This includes Google Sign-In and Facebook Login, where the player requests the service by tapping the button |
| Age assurance and children's protections – To identify users below the applicable age threshold and apply a restricted configuration | Profile setup information / Online identifiers / Platform age information | Legal obligation (COPPA, GDPR Art. 8, AADC) |
| Consent management – To collect, store and honour consent, and to demonstrate it was given | Online identifiers / Privacy preferences | Legal obligation, Art. 7(1) accountability |
| Enabling gameplay – To / store your gameplay data (including level and progress) with your profile, and to populate leaderboards in line with your performance in the game / To ensure you are being provided with a game experience that is appropriate to your age | Profile setup information / Online identifiers / Gameplay information | Necessary to perform a contract with you (our terms of use for the game) / Necessary to comply with a legal obligation (for example, our obligation under data protection laws to provide children with age-appropriate experiences) |
| Customer support - To help provide support to you in relation to the issue you’ve contacted us about | Contact information / Online identifiers / Customer support information | We have a legitimate interest in managing our business and facilitating player enquiries about our game |
| Player communications – To deliver service notifications | Profile setup information / Online identifier | Contract for service messages |
| Facilitating in-game payments - To facilitate your payments for in-game items and maintain a record of your transaction history, and to detect and prevent fraud | Online identifiers / Transaction details | Necessary to perform a contract with you (our terms of use for game) / We have a legitimate interest in protecting our company and players from fraud / In the UK, where it is necessary to process personal data to prevent, detect, or investigate a crime, we rely on our recognised legitimate interests |
| Profile moderation – We apply automated keyword filters to block you from using any nicknames which breach our terms of use / Breaches of those terms of use may also result in enforcement action being taken on your account | Profile setup information / Moderation information | We have a legitimate interest in providing you with customer support and security by ensuring the nicknames of other players in the game don’t breach our terms of use |
| Security and diagnostics - To help provide security and network protection mechanisms, to identify and address bugs and assess game function for optimization, to solve game crashes, and to optimise compatibility of hardware with the game | Online identifiers / Device information / Gameplay information | Consent to use tracking technologies for diagnostic purposes, where required by law / Where consent is not required, we rely on our legitimate interest in ensuring the security of our game / In the UK, where it is necessary to process personal data to prevent, detect, or investigate a crime, we rely on our recognised legitimate interests |
| Game improvement – To analyse your activity in the game to help keep the game updated and relevant for you and our other players, and to build improvements to the game we think our players will like | Online identifiers / Device information / Gameplay information | Consent to use tracking technologies for analytics purposes, where required by law / Where consent is not required, we rely on our legitimate interest in improving your and others’ experiences with the game |
| Personalisation of difficulty and content – To adapt difficulty and which offers, levels and events a player sees, to improve their experience | Online Identifiers / Device information / Gameplay information | Consent to use tracking technologies for analytics purposes, where required by law / We have a legitimate interest in improving our players’ experience and tailoring the game to their needs |
| Advertising campaign management – To customize our ad campaigns (for example, to let third party platforms know you have played the game so they can retarget you or others with similar interests to you on their platform), to understand which campaigns have led to a player downloading, accessing or playing the game, and to understand the demographics of the audiences who have interacted with our campaigns | Online Identifiers / Device information | Consent to use tracking technologies for advertising purposes, where required by law / Where consent is not required, we rely on our legitimate interest in being able to spend money on and deliver advertising campaigns more efficiently, and in understanding our audience better so we can better tailor the game and its ad campaigns in the future |
| Compliance with law - To comply with our financial reporting and disclosure obligations | Transaction information / Other data categories as required by law | Necessary for compliance with a legal obligation (for example, under tax and accounting legislation) |
| Responding to data subject requests - When you submit a data subject request, to confirm your identity, your rights and to process the request | Online identifiers / Data subject request information | Necessary for compliance with a legal obligation (our obligations under data protection laws) |
| Disclosure to law enforcement - To disclose information to law enforcement bodies on request | All categories | Necessary for compliance with a legal obligation / Where not necessary for such compliance, we rely on our legitimate interest in maintaining the security and integrity of our organization / In the UK, this is a recognised legitimate interest when we do this to prevent, detect, or investigate a crime |
What is a “legitimate interest”?
There are instances where we have a “legitimate interest” to use your personal data, and this is the legal basis we rely on. Our legitimate interest will vary depending on what we are using your data for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out. Where we process personal data on the basis of a legitimate interest, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place. In the UK, we do not need to conduct a balancing test if we process personal data for a “recognised legitimate interest.” You can obtain more information about this balancing test by using the contact details set out below.
Who do we share your personal data with?
We share your information with the following third parties:
| Category of Recipient | Why? |
|---|---|
| App stores | Apple App Store / Google Play Store |
| Service providers and third-party platforms | We rely on third party providers to perform services on our behalf - for example, payment processors, cloud hosting providers, companies which process support ticket IDs and support communication, ad attribution and measurement providers, third party platforms on which we run our ad campaigns, and companies that perform analytics in relation to our gameplay data and advertising campaign statistics. / In some limited cases we are a joint controller with third party platforms. For example, we are a joint controller with Meta Platforms Ireland Limited (“Meta”) in relation to the collection and transmission of personal data via its software development kit (“SDK”) which we incorporate into the game for ad campaign management purposes. We have entered into a contract with Meta to determine our respective responsibilities under GDPR with regard to this processing. Meta is responsible for enabling your data subject rights with regard to the personal data stored by Meta after this processing. For information about Meta’s contact details and data protection officer, how Meta processes your personal data, the legal basis Meta relies on, and how to exercise data subject rights against Meta, see the Meta Privacy Policy and Business Tools Terms. |
| Prospective buyers of our company or business and their advisors | In the event that our company or business is sold or integrated with another business, your details may be disclosed to our prospective purchasers and their advisors, and will be passed to the new owners of the business. These entities act as controllers. |
| Law enforcement, fraud prevention and other government agencies | For example, the police or the government might legally require use to give them personal data to help them with an investigation, or we might be required to give these companies personal data to enforce our terms, address security and fraud, and to protect you. These entities act as controllers. / In the UK, this is a recognised legitimate interest when we share this information to prevent, detect, or investigate a crime. |
| Our professional advisors, such as auditors, law firms, or accounting firms | To operate, improve, and develop our game and to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law. These entities act as controllers. / In the UK, this is a recognised legitimate interest when we do this to prevent, detect, or investigate a crime. |
Is your personal data transferred to other countries?
We transfer your personal data to other countries as part of using your personal data in the ways we listed above.
Your personal data may be transferred to and stored at a destination outside the EEA, Switzerland, Saudi Arabia or the UK. This includes app stores and service providers in the US and the Kingdom of Saudi Arabia.
Where we transfer personal data to these recipients in locations which do not provide an adequate level of data protection, we ensure appropriate safeguards are in place to protect the transfer of your personal data to these countries. We transfer personal data to recipients in the US who participate in the US Data Privacy Framework, for example cloud providers; recipients who rely on approved EU standard contractual clauses (module 1 or 2 depending on nature of relationship), and the UK Addendum to those standard contractual clauses or UK international data transfer agreement (IDTA); and recipients who rely on processor BCRs.
You can ask to review a copy of the transfer mechanism on request using our contact details set out below.
How long do we keep your personal data for?
We only keep your personal data for as long as is necessary. This will generally be for as long as the game is in operation plus one year; for up to 30 days following a deletion request, or for up to 7 years after a transaction you have made; and for one year in respect of your consent preferences.
We might need to keep your personal data for longer if a law requires us to. For example, this might be up to seven years in some jurisdictions in line with applicable contractual limitation periods. We may also keep your personal data for longer in pseudonymized form for statistical purposes, for up to 25 months. We will ensure that any retained personal data remains secure.
What are your rights in respect of your personal data?
You have the following rights:
| Right | Summary |
|---|---|
| The right of access | Enables you to receive a copy of your personal data |
| The right to rectification | Enables you to correct any inaccurate or incomplete personal data we hold about you |
| The right to erasure | Enables you to ask us to delete your personal data in certain circumstances |
| The right to restrict processing | Enables you to ask us to halt the processing of your personal data in certain circumstances |
| The right to object | Enables you to object to us processing your personal data on the basis of our legitimate interests (or those of a third party), including processing for direct marketing purposes or profiling for purposes of direct marketing, or where we are performing a task in the public interest - your objection will be upheld, and we will cease processing your personal data, unless the processing is based on compelling legitimate grounds or is needed for the exercise or defence of legal claims that may be brought by or against us |
| The right to data portability | Enables you to request us to transmit personal data that you have provided to us, to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible |
| If you are based in France | A right to instruct us on the processing (retention, deletion, and disclosure) of your personal data after your death. |
| If you are based in Italy | A right to set guidelines to restrict those who have their own interest, or act on your behalf, in their capacity as representative or for family reasons deserving protection, to exercise after your death the above mentioned rights on your personal data. |
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep.
If you wish to exercise any of these rights, please contact us at the contact details set out below.
Wherever we rely on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out before consent was withdrawn. Once you withdraw consent, we will cease the relevant consent-based collection and processing without undue delay. We may continue to process personal data where another legal basis applies, as described in this policy.
Is provision of my personal data mandatory or optional?
For the processing outlined above which is necessary for the performance of our terms of use with you or for us to comply with a statutory obligation, the provision of information is mandatory: if relevant data is not provided, then we will not be able to provide the game in accordance with our contract with you or comply with our legal obligations. The provision of other information is optional, however if you do not provide it then you may receive less personalised advertising in-game and on third party sites and apps; specific errors you experience in-game may not be diagnosed; and we may not be able to improve the game taking into account your gameplay information, for example.
Children
The game is compliant with the US Children's Online Privacy Protection Act (COPPA). If you are below the age under which personal data is not permitted to be processed without parental/guardian consent in your jurisdiction (the “age of digital consent”), you are not permitted to access any version of the service that involves personal data processing until such parental/guardian consent has been obtained. Please see our terms of service for additional information.
We do not knowingly collect personal information from children under the age of digital consent for any purpose. If you believe that we have personal information of a child under these ages without parental/guardian consent, or if you are the parent or guardian of the user and wish to withdraw consent, please contact us using the details set out below.
Updates to this policy
We may make updates to this policy from time to time (for example because the game’s functionality has changed or because of changes in laws), and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information. The date this policy was last updated can be found at the top of this policy.
How can you ask questions or make a complaint about how we handle your personal data?
Our data protection officer (“DPO”)’s contact details are: dpo@steerstudios.com. If you have any questions about what we have said in this policy or how your personal data is used, you can contact the DPO, or customersupport@steerstudios.com.
If you are in the UK, you may make a complaint directly to us. If you are in the UK or the EEA, you can also contact the data protection authority in the country you live in, the country where you work, or the country where the alleged infringement took place to lodge a complaint about how we use your personal data. You can find a list of EEA data protection regulators here. In the UK, the regulator is the Information Commissioner’s Office which you can contact here.
If you are in the Kingdom of Saudi Arabia:
This section supplements the rest of this policy. It applies to you if you are in the Kingdom of Saudi Arabia and sets out additional information required under the Personal Data Protection Law (PDPL) and its Implementing Regulations.
Legal bases for processing. Where we refer above to processing being "necessary to perform a contract", "necessary to comply with a legal obligation", or relying on "legitimate interests", those concepts correspond to the permitted grounds for processing under Article 6 of the PDPL. Where we rely on your consent, we do so under Article 5 of the PDPL.
Limitation on use. We will only use your personal data for the purposes described in the "What do we use your personal data for?" section above. We will not use your personal data in a way that is incompatible with those purposes, except where required or permitted by applicable law.
Mandatory and optional data. As described in the "Is provision of my personal data mandatory or optional?" section above: personal data used for profile setup, enabling gameplay, facilitating in-game payments, identity verification, complying with legal obligations, and responding to data subject requests is mandatory - if it is not provided, we will be unable to provide the game to you or meet our legal obligations. Personal data used for advertising personalisation and attribution, game improvement, and security diagnostics is optional - you may withhold it by adjusting your tracking preferences, though you may then receive less personalised advertising, certain errors may go undiagnosed, and game improvements based on your gameplay data may not be made.
Your rights under the PDPL. In addition to the rights described in the "What are your rights in respect of your personal data?" section above, if you are in the Kingdom of Saudi Arabia you also have:
-
The right to be informed - the right to be told the legal basis and purpose for which your personal data is collected. This information is set out in the "What do we use your personal data for?" section above.
-
The right to access - the right to access your personal data held by us, subject to applicable rules, procedures, and limitations under the PDPL (including Article 9 of the PDPL).
-
The right to obtain a copy - the right to request a copy of your personal data in a readable, clear electronic format, in accordance with the applicable rules and procedures under the PDPL.
-
The right to correction - the right to request that we correct, complete, or update any personal data we hold about you that is inaccurate, incomplete, or out of date.
-
The right to destruction - the right to request that we destroy your personal data when it is no longer needed by you, subject to our retention obligations under applicable law (including Article 18 of the PDPL).
To exercise any of these rights, please contact our Data Protection Officer using the details below.
Withdrawing consent. Where we rely on your consent, you can withdraw it at any time by accessing your tracking preferences in the game. Withdrawal does not affect the lawfulness of any processing carried out before consent was withdrawn. Once you withdraw consent, we will cease the relevant consent-based collection and processing without undue delay. We may continue to process personal data where another legal basis applies, as described in this policy.
How we protect your personal data. We implement appropriate technical, administrative, and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encryption of personal data in transit and at rest, access controls limiting access to authorised personnel, regular security monitoring of our systems, and contractual requirements on our service providers to maintain equivalent standards.
International transfers. We transfer your personal data outside the Kingdom of Saudi Arabia to service providers and app stores located in the countries described in the "Is your personal data transferred to other countries?" section above. Any such transfer is carried out in accordance with applicable law, and we ensure that an adequate level of protection at least equivalent to that guaranteed by the GDPR is in place. You can request further information about the safeguards applicable to any such transfer by contacting us using the details below.
Dedicated data protection contact. For queries or requests specifically relating to your personal data or your rights under the PDPL, please contact our DPO at dpo@steerstudios.com.
Complaints. If you have a concern about how we use your personal data, you have the right to lodge a complaint with the National Data Management Office (NDMO), which is part of the Saudi Data & Artificial Intelligence Authority, and the competent supervisory authority under the PDPL. Further information about the NDMO can be found here: https://ndmo.gov.sa or through such other complaint route as the NDMO may publish from time to time.
Thank you for reading. We hope you have a great time playing Tom & Jerry Blast!