Welcome to SuperAwesome. SuperAwesome is committed to protecting your privacy and the privacy of children online. Our mission is to make the internet safer, which we do by building technology that enables companies to responsibly interact with their audiences.

This Privacy Policy applies to parents or guardians using Kids Web Services. If you are an adult verifying your age using our age verification service, please click here. If you are an employee, contractor or authorised user of one of our Partner companies, please click here.

This Privacy Policy explains how SuperAwesome collects, stores and processes your personal information when you interact with our parent verification and consent management platform known as Kids Web Services.

We also explain how you can exercise your rights relating to your personal information, including the right to object to certain types of processing we carry out. When we say ‘personal information’, we not only mean information that can identify you, such as your name, email or address, but also any information that could reasonably be linked back to you.

We’ve provided summaries to help you identify key information at a glance. Click on the ‘Learn more’ links for more information.

The legal entity responsible for the information that SuperAwesome collects through Kids Web Services is SuperAwesome Trading Limited. SuperAwesome belongs to the Epic Games family of companies. If you have any questions about this Privacy Policy, please see the Contact Us section at the bottom.

What is Kids Web Services?

Kids Web Services is a parent verification and consent management platform.

It’s used by:

Parents and guardians (you) to manage what personal information your child can share online.

Operators of apps, games and other digital services (Apps), who we call our Partners. The end-users of our Partners’ Apps are typically children or minors – that’s why we refer to them as children in this Privacy Policy. Kids Web Services enables our Partners to obtain your consent before they process certain personal information of your child, and to verify that you are in fact an adult. This is required by privacy laws in certain countries.

We provide different types of Kids Web Services to you and our Partners. We’ve explained this below.

Parent Verification

The Parent Verification service enables our Partners to verify that the parents or guardians of their child end-users are adults (Parent Verification).

Where the General Data Protection Regulation (GDPR) applies, we are a joint controller with our Partner of personal information processed as part of the Parent Verification service we provide to that Partner. This means we and our Partner are jointly responsible for how your personal information is used for the Parent Verification service. You can see how we’ve allocated responsibility between us and our Partner for complying with data protection law in our Joint Processing Arrangement.

The AgeGraph

Once you have successfully verified that you are an adult through our Parent Verification service, we remember your verified status. Then, you can use your email address to manage your child’s permissions for the same and other Partner Apps which use our Parent Verification service. This is so that you won’t need to provide your Verification information again.

In addition to Parent Verification for services with young audiences, we also provide age verification services to operators of apps, games and other digital services directed to older audiences to enable them to verify that their end-users are adults (Age Verification).

If you have successfully verified that you are an adult through our Parent Verification service, you won’t need to provide your Verification information again when accessing an app, game, or service using our Age Verification service.

We call this network of verified individuals the AgeGraph. We are solely responsible for how personal information is used for the AgeGraph.

How to opt-out of the AgeGraph

The AgeGraph eliminates the need to collect Verification information more than once, minimising personal information collection and providing a safer service to you and our Partners.

You can, however, always choose to be removed from the AgeGraph by emailing [email protected].

Learn more

The AgeGraph is designed with privacy at the forefront, storing as little personal information as possible. Here’s how it works:

Once you have been successfully verified, we remember this by storing:

the method of verification used, e.g. ‘individual verified by payment card using Stripe’, but we never store the verification details (e.g. your card details) themselves;
the date and time you verified your age for the first time and subsequent times using the AgeGraph, as well as the Partner and Partner App for which those verifications were made;
the country in which your device is located at the time of initially interacting with us; and
a SuperAwesome generated transaction ID for each verification and any transaction IDs provided to us by our verification partners such as Stripe.

We call this the verified status.

We then store this verified status against your hashed email address in the AgeGraph. In non-technical terms, this means we scramble your email address using an algorithm so that it’s no longer directly identifiable as an email address.
SuperAwesome can’t attribute the information in the AgeGraph to you until you choose to provide your email address to verify your age again for a game or service powered by SuperAwesome’s technology, which is then hashed using the same algorithm and matched against the hashed email address we have stored.

View summary [collapses the above drop down section]

Parent Consent Management

The Parent Consent Management service enables our Partners to obtain your permission for the Partner’s processing of your child’s personal information in their Apps. It also enables you to manage the personal information your child can share online for each Partner App via your designated Parent Portal.

We are responsible for how your personal information is used for Parent Consent Management services.

Age Gate and Kid Account Management services

The Age Gate service enables our Partners to identify the country in which an end-user’s device is located and whether they are over/under the applicable age of digital consent in their country or other age specified by the Partner. On occasions, we also provide account management services for our Partner’s end-users who are children, which we call Kid Account Management services. Where our Partners’ child end-users live in the UK or EEA and GDPR applies, our Partners act as a controller for personal information processed as part of the Age Gate services and Kid Account Management services. This means our Partner is responsible under data protection laws for how your personal information is used and you should read the Partner’s privacy policy to understand how the Partner uses your personal information for these services. We are not responsible for the privacy practices of the Partner.

Personal information we collect

We collect information from you directly and through your interactions with Kids Web Services. We also receive information about you from our Partners when you or your child interact with their Apps. The information we collect and receive can include:

Account information. Your email address, which you give to us directly or which you or your child gives to a Partner who then shares it with us. When you interact with Parent Consent Management services, we also assign you a unique ID number that we use to recognise you when communicating with that Partner.

Verification information. Information you provide when you respond to a request from, or by us on behalf of, a Partner to verify your age, as well as your email address. The information you will be asked to provide depends on the country in which you are located and will include some, but never all, of the following information: your name, date of birth, mailing address, credit or debit card information, a personal identity number (such as a CPF number in Brazil, a CURP number in Mexico and certain digits of a US social security number in the US), an identity document or face scan.

Device and usage information. When you interact with Kids Webs Services, we automatically collect information about your devices (computers, phones, tablets etc.) and your use of and interactions with Kids Web Services, including in order to identify your country and language. We do this using cookies, server logs, web beacons, or similar technologies. Device information includes data about the operating systems and hardware and software versions, device identifiers, internet protocol (IP) address, login data, browser type and version, time zone setting, country and language, browser plug-in types and versions. Usage information includes browsing patterns, the Kids Web Services features you use, the actions you take, the time, frequency and duration of your activities, data about the performance of Kids Web Services and any problems you experience, including error reports.

Customer support information. Information you give us when you contact SuperAwesome for help, such as your name, the content of your chats and other communications with SuperAwesome. When you contact us for customer support, chat sessions with our representatives may be monitored and recorded.

The information we collect relating to your child includes the following:

Age information. The child’s age or date of birth.

Unique ID. A unique user ID for the child generated by Kids Web Services, which we link to you.

Permissions. The permissions you granted for the child’s access to features of our Partners’ Apps.

Country and Language. The child’s country (and in the US, State) and language.

How do we safeguard children’s privacy?

Kids Web Services’ consolidated Parent Consent Management and Parent Verification solution has been certified by two FTC-approved COPPA Safe Harbor Programs: the Entertainment Software Rating Board’s (ESRB’s) Privacy Certified Program and KidSAFE. Kids Web Services is subject to audits and other enforcement and accountability mechanisms as part of this certification.

Why we collect your personal information and our legal basis for processing

We use the information we collect only when we have a valid reason and legal basis to do so. We determine the legal bases based on the purposes for which we collect your information.

The legal bases we rely on may include the following:

to provide a service you’ve asked for under a contract we have entered into, or which we are about to enter;
where it is necessary for our legitimate interests provided that your interests and fundamental rights and freedoms do not override those interests;
where we need to comply with a legal or regulatory obligation or to protect your vital interests;
where we ask for your consent to process your information for specific purposes and you have the right to withdraw your consent at any time.

Learn more [Drop down below text]

Most commonly, we use your personal information for the following purposes:

Purpose: To provide our services to you

DESCRIPTION	CATEGORIES OF DATA	LEGAL BASES
We use your information to provide our services to you and our Partners. Here are some examples: We use your Verification information to verify that you are an adult so that you can consent to your child accessing features of our Partners’ Apps. We also use your verified status for the purposes of the AgeGraph. We store your child’s Age information to notify our Partner when they have reached an age where they no longer require your consent to the processing of their personal information.	Parent/guardian data: Account information Verification information Device and usage information Customer support information Child data: Age information Unique ID Permissions Country and Language	Performance of our contract with you for the use of our services, or if we have not entered into a contract with you or you are a child under the age of contractual capacity, our legitimate interest to operate and provide you with services you access or request. For the AgeGraph our legitimate interest in: Eliminating the need to collect and process Verification information more than once, minimising personal information collection and providing a safer service to you and our Partners. Pursuing our mission to make the internet safer by making it easier for you to provide, and children and our Partners to obtain, verifiable parental/guardian consent. The easier it is for you to provide – and children and our Partners to obtain – verifiable parental consent, the more likely that children will be honest about their age.

Purpose: To maintain our services

DESCRIPTION	CATEGORIES OF DATA	LEGAL BASES
We use your information to ensure our services are operating properly, to troubleshoot and provide customer support.	Parent/guardian data: Account information Verification information Device and usage information Customer support information Child data: Age information Unique ID Permissions Country and Language	Performance of our contract with you for the use of our services or if we have not entered into a contract with you or you are a child under the age of contractual capacity, our legitimate interest to operate, maintain and provide you with services you access or request.

Purpose: To improve and develop new products and services

DESCRIPTION	CATEGORIES OF DATA	LEGAL BASES
We may sometimes use your information to help us improve and develop products and services, including to develop updates and add new functionality, product and features based on your comments and feedback and an understanding of how you and others use them.	Parent/guardian data: Verification information Device and usage information Customer support information	Our legitimate interest in improving and developing new products and services, while applying appropriate safeguards that protect your privacy.

Purpose: To promote safety and security

DESCRIPTION	CATEGORIES OF DATA	LEGAL BASES
We use your information to help protect and improve the safety and security of our services, parents, guardians, our Partners and their end-users. For example, we use information to detect and protect against error, fraud, breach of our terms or policies, or criminal or malicious activity.	Parent/guardian data: Account information Verification information Device and usage information Customer support information Child data: Unique ID Country and Language	Depending on the circumstances, we rely on the following legal bases:to comply with legal obligations;to protect vital interests; orour legitimate interest in providing a secure and safe service and preventing fraud and unauthorised use of our products and services, violations of our terms and policies or other harmful or illegal activity, and in protecting our and others’ rights, property and interests, while applying appropriate safeguards that protect your privacy.

Purpose: To communicate with you

DESCRIPTION	CATEGORIES OF DATA	LEGAL BASES
We use information we collect, like your email address, to interact with you directly. Here are some examples: We may notify you of a new permission request from your child or email you to let you know that you have been successfully verified. We may email you to confirm that the email address belongs to you.We may also respond to inquiries or other communications from you or your child, or inform you of changes to our terms, policies, or products or services.We do not send marketing communications to you or children using our Partners’ Apps.	Parent/guardian data: Account information Device and usage information Customer support information Child data: Customer support information	When using, processing or sharing information for this purpose, we do so on the legal basis of performance of a contract or, if we have not entered into a contract with you or you are a child under the age of contractual capacity, our legitimate interest to operate and provide you with services and/or our legitimate interest in fulfilling and responding to your requests.

View summary [collapse above drop down]

Reasons we share your personal information

SuperAwesome does not share your personal information with others except as described in this Privacy Policy (like to provide, maintain and secure Kids Web Services, or if we’re required to do so by law). We do not sell any of your information to anyone.

We share your information as follows:

Service providers. As with most companies, we use third parties to help us provide Kids Web Services, such as IT and hosting providers or payment card processors. For example, we share Verification information with payment card processors we use to verify your age. Some of these providers may process your personal information on our behalf, for the purposes set out in this Privacy Policy. These providers are subject to contractual obligations governing privacy, data security and confidentiality.

We maintain a current list of the service providers that Kids Web Services uses here.

We also share personal information in some cases with our professional advisers and other service providers who are sometimes independent ‘data controllers’, such as lawyers, accountants and insurers (e.g. when enforcing our contract with you or in the event of claims against us).

Partners. If you or your child uses a Partner App, we share your personal information with our Partners to deliver the services which you have requested from either us or our Partners. For example, if you verify your age through Kids Web Services, we communicate your verified status to the Partner to enable the Partner to proceed with obtaining your permissions (whether using Parent Consent Management or otherwise) for their collection of your child’s personal information.

If your child is an end-user of a Partner, we may communicate their Age information to the Partner in order to notify the Partner that your child has reached an age where they no longer require your consent to the collection of their personal information.

We also provide Partners with updates to the permissions you give your child through the Parent Portal.

Other companies within the SuperAwesome group. We may share your information with our group companies, including companies that we may acquire in the future, but only to the extent necessary to fulfil purposes set out in this Privacy Policy, or otherwise as authorised by you. For example, our group companies assist SuperAwesome in the provision of customer support to our Partners.

We may share your personal information if we believe it is reasonably necessary:
- where required by law;
- to comply with legal process;
- to permit us to pursue available remedies, including commencing or responding to any claims;
- to enforce or apply the SuperAwesome terms;
- to protect the security or integrity of the SuperAwesome services;
- to protect the rights, property, interests or safety of SuperAwesome, our employees, customers or users; or
- for risk management purposes.

The categories of information we disclose and our legal basis for doing so depends on the circumstances, but generally it is to comply with legal obligations, to protect vital interests or act in our legitimate interest to provide a secure and safe service and preventing fraud and unauthorised use of our products and services, violations of our terms and policies or other harmful or illegal activity, and in protecting our and others’ rights, property and interests, and responding to legal requests from governmental and law enforcement agencies.

If SuperAwesome is acquired. If we are involved in a merger, acquisition, or sale of assets, we may share your personal information with the acquiring or receiving entity. The categories of information we disclose and our legal basis for doing so depends on the circumstances, but would include our legitimate interest in operating, selling and expanding our business, including through such transactions. If a change happens to our business, the new owners may process your personal information in the same way as set out in this Privacy Policy.
A note about aggregated data. We may derive aggregated data from your personal information and we may share this information in aggregated form with our Partners as part of our services. For example, we may aggregate Usage information to calculate the percentage of parents/guardians who provide verifiable parental consent to their child accessing a certain feature of one of our Partner’s games. However, because this data has been through a process to de-identify personal information so that it can no longer be associated in the Partner’s hands with a person, the aggregated data cannot directly or indirectly reveal your identity to the Partner.

Keeping your information secure

SuperAwesome values your trust and maintains a comprehensive information security program designed to protect personal information using administrative, physical, and technical safeguards.

The specific security measures used are based on the sensitivity of the personal information collected. While we cannot guarantee that loss, misuse or alteration of data will not occur, we have measures in place designed to protect against inappropriate access, loss, misuse, or alteration of personal information under our control. For example:

The SuperAwesome security team regularly reviews our security and privacy practices and enhances them as necessary to help protect the integrity of our systems and your personal information.
We work to limit access to your personal information to those employees, agents, contractors and other third parties strictly on a “need to know” basis.
We use secure server software to encrypt personal information, and we only partner with security companies that meet and commit to our security standards.

Third party websites, services and apps

Some of the correspondence you receive from us may contain links to third-party websites, online services or mobile applications that are not affiliated to or operated by us, including those of our Partners. We are not responsible and accept no liability for the content, security or privacy practices of those other operators.

Your rights and access to your personal information

We provide you with rights and choices about the personal information we collect and hold about you. The specific choices available to you may vary depending on your location and applicable law.

Right of access: You have a right to request access to your personal information and to be provided with a copy of your personal information, including the categories of your personal information we collect and disclose.
Right of deletion: You have the right, in certain cases, to request that we delete your information, provided there are valid grounds for doing so and subject to applicable law. See How to exercise your rights for information on how to delete your personal information.
Right of correction: You have the right to request that we correct inaccurate information about you, though we may need to verify the accuracy of the new data you provide to us.
Right to object (legitimate interest): Where we process your personal information based on legitimate interests, you can object to this processing where you feel it impacts on your fundamental rights and freedoms. Unless we have compelling legitimate grounds or where it is needed for legal reasons, we will cease processing your information when you object.
Right to object (marketing): We do not send marketing communications to parents/guardians or end-users of our Partners.
Right to transfer: You may have the right to receive certain of your information in a structured, commonly used and machine-readable format and to transmit such information to a third party.
Right to restrict processing: You have the right, in certain cases, to temporarily restrict the processing of your information by us, provided there are valid grounds for doing so.
Right to withdraw consent: Where you have previously provided your consent, you have the right to withdraw consent at any time where we are relying on consent as the legal basis upon which to process your personal information. However, this will not affect the lawfulness of the processing based on consent before its withdrawal.
Right to complain: If you are concerned that we have not complied with your legal rights or applicable privacy laws, you have the right to lodge a complaint with SuperAwesome’s supervisory authority, the UK Information Commissioner (www.ico.gov.uk), which is the regulator responsible for data protection in the United Kingdom, where SuperAwesome Trading Limited is registered (Registration number Z8630714). You can also lodge a complaint with your local supervisory authority for data protection.
Rights relating to your child’s personal information: As a parent/guardian, you may have certain rights over how we handle the personal information of your child. This includes a right for you to review, access, or delete the personal information that has been collected by us (in our capacity as a controller) from that child, and to refuse at any time to permit the collection from that child of such personal information. If you withdraw your consent, your child may lose access to certain apps, games or other digital services. We will advise you if this is the case at the time you withdraw your consent.

How to exercise your rights

If you want to exercise any of your rights and are not able to do so using our privacy control tools, you can email us at [email protected] at any time.

Before we process such requests, we may ask you to verify your identity (like by logging-in to your account or providing us with certain information). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. No payment is usually required to exercise your rights. However, we may request payment where allowed by law (for example, if your request is manifestly unfounded or excessive).

If you are a California resident, refer to the California residents section below for more information on your legal rights.

Privacy controls for parents/guardians of their child’s personal information

The very reason Kids Web Services exists is to give parents/guardians a choice over what personal information their child can share online. Please refer to our FAQs to see the tools that are available to parents/guardians to do just that.

Our retention of personal information

You can delete some personal information whenever you like by contacting us at [email protected].

Otherwise, SuperAwesome retains personal information for as long as necessary to fulfil the purposes we collected it for, or for other legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements or protecting our rights.

Retention periods vary significantly depending on the different data types, the purposes for which they were collected and the context of our interactions with you. To determine the appropriate retention period, we consider:

the amount, nature and sensitivity of the data;
the potential risk of harm from unauthorised use or disclosure of the data;
the purposes for which we process the data and whether we can achieve those purposes through other means;
applicable legal, regulatory, tax or accounting requirements.

We require any third party service providers we use to delete personal information once it is no longer necessary for them to provide the services or to satisfy any legal, regulatory, tax, accounting or reporting requirements.

Where our Partners act as controllers when processing you or your child’s personal information (i.e. Age Gate services and Kid Account Management services), please refer to their privacy policies or contact the Partner directly for information on how long they retain your personal information.

International transfer of personal information

We transfer your personal information in the following ways:

As we explain above, we share your personal information within the SuperAwesome group of companies. Our group companies are located in the United States and other countries outside the UK, Switzerland and EEA.
As we explain above, we use third party service providers to help us provide Kids Web Services, such as hosting providers or payment card processors. Some of these providers, including their servers, are based outside the UK, Switzerland and EEA.
As we explain above, we also provide your information to Partners. Some of these Partners are based outside the UK, Switzerland and EEA.

Countries where we and our service providers and Partners operate may not offer the same level of data protection as your home country. For example, there is currently no adequacy decision in respect of the United States. We use specific contracting frameworks approved by the UK Government and European Commission which are designed to give personal information protection essentially equivalent to that in the UK and EEA. We may also need to transfer your information to provide Kids Web Services to you in accordance with our existing agreements with you, such as the Terms of Use.

Cookies

A cookie is a small piece of text sent to your browser by a website you visit. We and other organisations use necessary cookies to make the Kids Web Services work. We may also set analytics cookies that help us make improvements by measuring how you use the Kids Web Services. You can set your browser to block or alert you about these cookies, but some parts of the Kids Web Services may not then work. This table explains the cookies we use and why.

Do Not Track

Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. There is no industry consensus as to what site and app operators should do with regard to these signals. Accordingly, unless and until the law is interpreted to require us to do so, we do not monitor or take action with respect to “Do Not Track” signals. For more information on “Do Not Track,” click here.

Location-specific rules

Depending on where you are resident, specific rules apply.

United States

If you are a resident of the United States and believe that we have not responded to your inquiry or it has not been satisfactorily addressed, please contact ESRB Privacy Certified at [email protected] or by using their online contact form here.

California residents

This additional section applies to California residents because of the specific privacy laws in that state. It explains the additional rights and details required by the California Consumer Privacy Act of 2018, as amended, and its implementing regulations (CCPA). For the purposes of this section, Personal Information, Sell, Share and Business have the meanings given to them under the CCPA.

Learn more

[Drop down below text]

Categories of personal information we collect

SuperAwesome acts as a Business when we interact with parents or guardians directly, such as when a parent or guardian is included in the AgeGraph.

When acting as a Business, SuperAwesome has collected the following categories of Personal Information (using the categories described in the CCPA). This list includes all categories that we collect, but the categories that apply to you will vary depending on how you interact with Kids Web Services:

Identifiers – including Account information and Device and usage information.
Other personal information defined under California law – including Verification information you provide.
Commercial information – including Usage information.
Internet activity – including Usage information.
Geolocation – we only collect the country, and if in the US, the state in which you are located.

We use and disclose this Personal Information as explained in this Privacy Policy here and here.

We do not Sell or Share Personal Information.

Right to know and delete

You have the right to delete or correct the Personal Information we have collected from you, and the right to know certain information about our data practices. In particular, you have the right to request from us:

the categories of Personal Information we have collected about you;
the specific pieces of Personal Information we have collected about you;
the categories of sources from which the Personal Information was collected;
the categories of Personal Information we have disclosed for a business purpose or Sold/Shared;
the categories of third parties to whom the Personal Information was Sold/Shared, disclosed for a business purpose, or otherwise disclosed; and
the business or commercial purpose for collecting or Selling/Sharing the Personal Information.

To submit a request, please email us at [email protected]. We will confirm your request and may request additional information from you to verify your identity and process your request. If we are unable to verify your identity, we may deny your request.

Authorized agent

You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.

Right to be free from discrimination

We will not discriminate against you because you have chosen to exercise any of your rights under the CCPA, including, for example, by denying you access to our online services or charging you different rates or prices for the same online services, unless that difference is reasonably related to the value provided by your data.

California residents “Shine the Light” law

We do not share your Personal Information with any unaffiliated third parties for their own marketing purposes.

Nevada residents

Nevada residents have the right to direct a business not to sell certain kinds of personal information that the business has collected about them. SuperAwesome does not sell personal information. If you are a Nevada resident and wish to submit a request relating to this right, please email us at [email protected].

Contact us

SuperAwesome works hard to ensure that the processing of your personal information is carried out fairly and lawfully. If you have any questions regarding SuperAwesome’s privacy practices, need information or require assistance, please contact us at:

Attn: Chief Privacy Officer

SuperAwesome Trading Limited, Octagon Point, 5 Cheapside, London EC2V 6AA, United Kingdom

Email: [email protected]

If you are located inside the European Economic Area (EEA), you can alternatively contact our representative in the EEA at:

Attn: SuperAwesome GDPR Representative

Mason Hayes and Curran Professional Services Limited, South Bank House, Barrow Street, Dublin 4, Ireland

Email: [email protected]

Changes to this Privacy Policy

We may modify this Privacy Policy at any time. When we do, we will update the ‘Last updated’ date on this Privacy Policy. In some cases we may also notify you of the relevant changes by email or within the SuperAwesome services.

If you object to any changes, you may delete your personal information as described in How to exercise your rights.