Privacy Policy

1. Information Collection

MALINA FZ LLE gathers information in three ways, and only in three ways. First, we collect information you give us directly: when you register an account, complete an optional profile, choose a membership tier, write to our support team, or use the on-site chat. Second, we collect certain technical information automatically whenever you visit the platform, such as device characteristics, log records, and play statistics generated by the games themselves. Third, a small number of carefully selected service providers acting on our behalf — for example our hosting and email delivery partners — may generate operational records that relate to your account, and those records are treated as personal information under this policy.

Our collection practices are guided by the principles of the Personal Information Protection and Electronic Documents Act (PIPEDA): we identify the purpose before or at the moment of collection, we limit collection to what is genuinely necessary for that purpose, and we obtain your meaningful consent. Where a purpose is new or materially different from the one you originally agreed to, we will explain it and ask for your consent again before using your information in that new way. You may withdraw consent at any time, subject to reasonable notice and to any legal or contractual restrictions, and we will explain the consequences of withdrawal — for instance, that closing certain data categories makes it impossible to keep your account open.

Because MALINA FZ LLE is a social casino operating entirely with Boreal Berries — fictional entertainment credits with no real-world monetary value — we never collect banking details for wagering, never process real-money bets, and never build the kind of financial gambling profile a real-money operator would. The information we hold is limited to running a free entertainment service well.

2. Personal Data

To create an account you provide a username, an email address, and a password. The username is the only identifier other players ever see; you are free to choose one that does not reveal your real name, and we encourage you to do so. Your password is never stored in readable form — it is hashed and salted using a modern one-way algorithm before it touches our database, which means even our own staff cannot read it.

Beyond those three required fields, everything else in your profile is optional. You may add a display name, pick an avatar from our gallery, set a preferred interface language (English or French), record your province or territory so that community events show in your time zone, and confirm your year of birth, which we use solely to verify that you are at least eighteen years old. Leaving optional fields empty never limits your access to the games; it only changes how personalized the experience feels.

If you choose a paid membership tier, the payment itself is handled by an independent, PCI-DSS-certified payment processor. MALINA FZ LLE never receives or stores your full card number, expiry date, or security code. We receive only a confirmation token, the tier you selected, and the renewal date, which we need in order to activate the correct membership perks on your account. Membership purchases unlock cosmetic features and Boreal Berries allowances only; they are never stakes, and nothing you buy can ever be converted back into money.

Finally, when you contact support we keep the content of your message, your email address, and any attachments you send, so we can resolve your request and refer back to earlier conversations if a similar issue appears later.

3. Usage Data

When you use the platform, our servers automatically record technical information about the visit. This includes the type of device you are using, its operating system and version, the browser and browser version, your screen resolution, your language settings, and your IP address. From the IP address we derive an approximate region — country and, at most, province level — which helps us confirm the service is being presented in the correct language and that Canadian players see Canadian responsible-play resources. We do not use IP data to pinpoint your street address or track your physical movements.

Our application logs record timestamps of requests, pages viewed, errors encountered, and crash reports. These records are indispensable for diagnosing problems: when a player tells us a game froze mid-spin, the log trail is usually the only way to find out why and fix it for everyone. Logs are retained for a limited period, as described in the Data Retention section below, and access to them is restricted to the engineers who need them.

The games generate play statistics: which titles you launch, how long a session lasts, how many rounds you play, your Boreal Berries balance and its history, and which features you use most. We rely on these statistics to balance game mathematics, plan new content, and power the optional session reminders offered on our responsible-play page. Because Boreal Berries are fictional credits with no real-world monetary value, these statistics are entertainment telemetry, not financial records — but we still treat them with the same care and confidentiality as every other category of personal information described in this policy, and we never share them in identifiable form.

4. Cookies

Like almost every modern website, malinafz.com uses cookies and similar technologies such as localStorage entries. A cookie is a small text file placed on your device that allows the site to remember information between pages and between visits. Without certain cookies the platform simply cannot function: they keep you signed in as you move from the lobby to a game, remember that you have confirmed you are over eighteen, and record your consent choices so we do not ask you the same questions on every visit.

We group our cookies into three categories. Strictly necessary cookies support security, session management, and the age gate; they are always active because the service cannot operate without them. Preference cookies remember choices such as your interface language and sound settings; they make the experience smoother but the site works without them. Analytics cookies help us understand, in aggregate, how the platform is used — which pages are popular, where players encounter errors, and how new features perform. Preference and analytics cookies are set only after you make a choice in the consent banner shown on your first visit.

You can change your mind at any time. The consent banner can be reopened from the footer of every page, and every mainstream browser also lets you view, block, and delete cookies through its own settings. Blocking strictly necessary cookies will prevent you from signing in, so we recommend leaving that category untouched and adjusting only the optional ones.

A complete list of every cookie we set — its name, purpose, duration, and category — is maintained on our dedicated Cookie Policy page, which forms part of this Privacy Policy.

5. Analytics

We use a deliberately small analytics toolkit to understand how the platform performs and where it can improve. Analytics data tells us which games players enjoy, which pages load slowly, where visitors abandon the registration form, and whether a new release has introduced errors. Without this information we would be designing the service blind; with it, we can direct our development effort where it actually helps players.

Wherever possible, analytics data is pseudonymized before analysis. IP addresses are truncated so that the final segment is discarded before storage, identifiers are rotated, and reports are produced only at an aggregate level — we look at how thousands of sessions behave, not at what one named individual did on a Tuesday evening. No analytics profile we hold is ever used to make automated decisions that produce legal or similarly significant effects about you.

We want to be equally clear about what we do not do. We do not operate third-party advertising networks on the platform, we do not sell analytics data to data brokers, and we do not permit our analytics providers to reuse your information for their own marketing purposes. Our providers act as processors under written contracts that limit them to processing on our documented instructions.

You control analytics collection. Declining analytics cookies in the consent banner stops analytics measurement for your device, and you can withdraw a previously given consent at any time from the footer link. Refusing analytics has no effect whatsoever on your Boreal Berries balance, your membership tier, or any other aspect of your account — the games play exactly the same either way.

6. Communications

We divide the messages we send you into two strictly separate streams: transactional communications and optional marketing communications. Understanding the difference matters, because your choices apply to one stream and not the other.

Transactional communications are messages required to operate your account. They include the email that confirms your registration, password reset links, security alerts when we detect a sign-in from an unfamiliar device, notices that our Terms of Use or this Privacy Policy have materially changed, membership renewal receipts, and replies from our support team. Because these messages are part of delivering the service you asked for, you cannot opt out of them while your account remains open. We keep them short, we send them only when genuinely needed, and we never dress marketing up as a security alert.

Marketing communications — our newsletter announcing new game releases, community events, and complimentary Boreal Berries offers — are sent only with your express consent, in line with Canada's Anti-Spam Legislation (CASL). Consent is gathered through an unchecked box at registration or in your account settings; we never pre-tick it for you. Every marketing email identifies MALINA FZ LLE as the sender, includes our contact details, and carries a one-click unsubscribe link that works without signing in. Unsubscribe requests take effect promptly and in any event within ten business days, though in practice removal is usually immediate.

You can also manage all communication preferences from the notifications panel in your account settings, or by writing to support@malinafz.com with the subject line "Communications". Opting out of marketing never affects your access to the games, your Boreal Berries balance, or your account standing in any way.

7. Data Security

Protecting the information you entrust to us is an engineering discipline at MALINA FZ LLE, not a paragraph in a policy. We apply layered technical and organizational safeguards proportionate to the sensitivity of the data we hold.

In transit, every connection to malinafz.com is encrypted with TLS 1.2 or higher; the platform is simply unreachable over unencrypted HTTP. At rest, databases and backups are encrypted using AES-256, and encryption keys are stored separately from the data they protect. Passwords are hashed and salted with a modern adaptive algorithm, meaning that even in the unlikely event of a database compromise your actual password would not be exposed.

Organizationally, we follow the principle of least privilege. Staff access to personal information is role-based, granted only where a specific duty requires it, protected by multi-factor authentication, and logged. Access rights are reviewed on a recurring schedule and revoked immediately when someone changes role or leaves the company. Every employee and contractor signs confidentiality obligations before touching production systems, and vendors are assessed for their own security posture before we share anything with them.

We maintain a documented incident response plan. If a breach of security safeguards ever creates a real risk of significant harm to you, we will notify you without unreasonable delay, report the incident to the Office of the Privacy Commissioner of Canada as PIPEDA requires, and keep the records of the breach that the law prescribes. No system on the internet can promise perfect security, so we also encourage you to do your part: choose a strong, unique password, sign out on shared devices, and never share your credentials with anyone, including people claiming to work for us.

8. User Rights

You have meaningful, enforceable rights over your personal information, and we have built our processes so that exercising them is straightforward rather than a bureaucratic obstacle course.

Under PIPEDA you have the right to know whether we hold personal information about you, to access that information, to be told how it has been used and to whom it has been disclosed, and to challenge its accuracy and completeness. When a correction is justified we will amend the record and, where relevant, pass the correction to any third-party processor that received the inaccurate data. We answer access requests within thirty days; if we ever need to extend that period in the narrow circumstances the law allows, we will tell you why and when to expect our response. Access is provided free of charge except where the law permits a minimal cost, which we will always quote before doing any work.

In addition, we voluntarily honour a set of rights modelled on the European GDPR for all players, wherever they live: the right to erasure of your account and associated data, the right to receive the data you provided to us in a portable, machine-readable format, the right to restrict or object to specific processing such as marketing, and the right to withdraw any consent you have previously given, as easily as you gave it.

To exercise any right, write to support@malinafz.com or use the request form on our contact page. We will verify your identity before releasing or deleting anything — a protection for you, not a hurdle. If you are dissatisfied with our response, you may complain to our Privacy Officer and, ultimately, to the Office of the Privacy Commissioner of Canada.

9. Data Retention

We keep personal information only for as long as it is needed for the purpose it was collected for, or for as long as the law requires, whichever ends later — and then we delete it or irreversibly anonymize it. Rather than a vague promise, here are the concrete periods we apply to each category of data.

Account and profile data, including your username, email address, optional profile fields, and Boreal Berries history, is kept while your account is active and for twenty-four months after closure, so that we can restore an account closed by mistake, resolve late disputes, and honour our legal obligations. Support correspondence is retained for twenty-four months after the ticket is resolved, allowing us to see the history if a related issue returns. Server and application logs, including IP addresses, are kept for twelve months and then purged on a rolling basis. Analytics data is aggregated within fourteen months of collection and the underlying event records deleted; aggregate reports, which no longer identify anyone, may be kept for up to twenty-six months. Records evidencing your marketing consent are kept for as long as you remain subscribed plus twenty-four months, because CASL requires us to be able to prove consent. Encrypted backups rotate automatically on a thirty-five-day cycle, so deleted data disappears from backups within roughly five weeks.

Two exceptions apply. Where information is subject to a legal hold, an active investigation, or an unresolved dispute, we retain it until the matter concludes. And where you ask us to delete your account early, we honour the request except for the minimal records the law obliges us to keep, which remain locked down and are destroyed when their statutory period expires.

10. International Transfers

MALINA FZ LLE is established in Fujairah, United Arab Emirates, and our platform is hosted on servers located in the UAE. This means that when you use malinafz.com from Canada, your personal information is transferred to, stored in, and processed in the United Arab Emirates, and may be handled by our staff and service providers there. Some auxiliary processors, such as email delivery services, may process limited data in other jurisdictions as well.

PIPEDA does not prohibit transfers of personal information outside Canada, but it does make us accountable for it: information in the hands of a foreign processor must receive a comparable level of protection to what it would receive in our own hands. We meet that obligation through contract and through engineering. Every processor that touches personal information signs a data processing agreement obliging it to use the data only on our documented instructions, to apply security measures at least as strong as our own, to notify us of any incident without delay, and to delete or return the data when the engagement ends. On the technical side, data moves between jurisdictions only over encrypted channels and is encrypted at rest wherever it lands.

We want to be transparent about the limits of these safeguards: while your information is in another jurisdiction, it is subject to the laws of that jurisdiction, and courts, law enforcement, or national security authorities there may have grounds to demand access under local law. We will resist overbroad requests to the extent the law allows and will disclose only what a valid legal instrument compels. If you have questions about our transfer practices, our Privacy Officer will gladly explain them — contact details appear in section 13.

11. Third Parties

Let us begin with the commitment that matters most: MALINA FZ LLE does not sell, rent, trade, or otherwise commercialize your personal information. Not to advertisers, not to data brokers, not to "marketing partners". Our revenue comes from optional memberships, not from your data, and this policy reflects that business model.

The third parties that do receive personal information are service providers — processors — who handle it strictly on our behalf and on our instructions. They fall into a handful of categories: the hosting and infrastructure provider that runs our servers; the email delivery service that sends transactional and, where you have consented, marketing messages; the analytics provider described in section 5; the security and content delivery services that shield the platform from attacks; and the payment processor that handles membership purchases. Each provider receives only the minimum data necessary for its task, is bound by a written contract containing confidentiality, security, and purpose limitation clauses, and is prohibited from using your information for its own purposes. When we stop working with a provider, it must delete or return every record it holds for us.

Beyond processors, we disclose personal information only in narrow situations: when a law, regulation, court order, or other valid legal process compels us to; when disclosure is necessary to establish, exercise, or defend legal claims, or to protect the safety of a player or the public; or, if MALINA FZ LLE is ever involved in a merger, acquisition, or asset sale, to the successor entity — in which case we would notify you before your information becomes subject to a different privacy policy.

12. Children's Privacy

MALINA FZ LLE is an adult entertainment platform. Even though our games involve no real money — every round is played with Boreal Berries, fictional credits that cannot be bought back, cashed out, or exchanged for anything of value — casino-style content is designed for adults, and our service is strictly limited to persons who are eighteen years of age or older. This age limit applies everywhere, regardless of whether a lower age of majority exists in your province or territory.

We enforce the limit at several points. The registration form requires you to confirm your year of birth and affirm that you are at least eighteen; an age gate appears before any game content is shown; and our Terms of Use make truthful age declaration a condition of holding an account. We do not knowingly collect personal information from anyone under eighteen, we do not direct any advertising or marketing at minors, and we design our public pages so they do not appeal to children.

If we discover that an account belongs to a person under eighteen — through our own monitoring, a support interaction, or a report from a third party — we suspend the account immediately and delete the associated personal information without delay, retaining only the minimal record needed to prevent the same person from re-registering before their eighteenth birthday. If you are a parent or guardian and believe your child has created an account or otherwise provided us with personal information, please contact us at support@malinafz.com with "Minor account" in the subject line. We treat such reports as a priority, verify them quickly, and act on them at once.

13. Contact Details

Questions, concerns, access requests, correction requests, and complaints about this Privacy Policy or about our handling of your personal information should be directed to our Privacy Officer, who is accountable for MALINA FZ LLE's compliance with PIPEDA and with this policy.

You can reach us in three ways. By mail: Privacy Officer, MALINA FZ LLE, Creative Tower, P.O. Box 4422, Fujairah, United Arab Emirates. By email: support@malinafz.com — please put "Privacy" in the subject line so your message is routed to the right team without delay. By telephone: +971-9-222-0149, where our support staff can open a privacy file on your behalf and arrange a call-back from the Privacy Officer if your question needs one. You may write to us in English or in French; we answer in the language you choose.

We acknowledge privacy inquiries within two business days and aim to give you a substantive answer within thirty days, the period PIPEDA sets for access requests. If your request is complex and we need more time, we will tell you before the original deadline expires, explain why, and give you a firm new date. There is never a charge for making a complaint, and making one will never affect your account standing or your access to the games.

If, after working with us, you remain unsatisfied with how a privacy matter was handled, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada, which oversees PIPEDA and provides guidance and complaint forms on its website. We will cooperate fully with any inquiry the Commissioner opens.

This policy may be updated from time to time; material changes will be announced on the platform and the revision date at the top of this page will always tell you when the text last changed.