Last updated: June 2026
This Privacy Policy explains how Studio Ashty d.o.o. collects, uses and protects your personal data in accordance with the EU General Data Protection Regulation (GDPR / Regulation (EU) 2016/679) and applicable Bosnian data-protection law.
The controller responsible for processing your personal data is:
Studio Ashty d.o.o.
Obala Kulina bana 15/1
71000 Sarajevo
Bosnia and Herzegovina
Email: amar.civic@studioashty.com
Contact form: studioashty.com/contact
When you sign up for the Nightwater newsletter we collect:
We use your email address solely to send you updates about Nightwater — development news, release dates and beta invitations. The legal basis is your freely given, specific and informed consent pursuant to Art. 6(1)(a) GDPR.
After submitting the form you will receive a confirmation email. Your address is only added to our mailing list once you click the confirmation link. This protects you against third parties signing up with your email without your knowledge.
You can withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in any newsletter email or by contacting us via the contact form. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
We store your email address and consent record for as long as you remain subscribed. After unsubscription we retain a minimal record (hashed email + timestamp) for legal proof-of-consent purposes for up to 3 years, then it is permanently deleted.
When you send us a message via the contact form we collect your name, email address and the content of your message.
We process this data solely to respond to your enquiry. The legal basis is our legitimate interest in communicating with people who contact us (Art. 6(1)(f) GDPR), or, where applicable, the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR).
Messages and associated personal data are retained for up to 2 years after the correspondence is concluded, unless a longer retention period is required by law.
Our website is hosted on standard web infrastructure. When you visit the site, the web server automatically records technical data in server logs, including your IP address, browser type, referring URL, and the date/time of your request. This data is processed on the basis of our legitimate interest in operating a secure and functional website (Art. 6(1)(f) GDPR) and is deleted automatically after 7 days.
We do not use Google Analytics, Meta Pixel, or any other third-party analytics or advertising technology. We do not set non-essential cookies.
Every page on this website loads fonts (Kalam, Nunito, Space Mono) directly from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), operated by Google LLC. When your browser requests the font files, it automatically transmits your IP address, browser type, and the URL of the page you are visiting to Google's servers. Google may process this data in accordance with its own privacy policy. The legal basis for this is our legitimate interest in presenting the website in a visually consistent way (Art. 6(1)(f) GDPR). If you would prefer your IP not to be transmitted to Google in this way, you can disable external fonts in your browser settings or use a browser extension that blocks requests to Google's font servers.
The Nightwater game page embeds a video player for the official game trailer. No YouTube code is loaded on page load. The YouTube player (youtube.com/embed, operated by Google LLC) is injected into the page only when you actively click the "Play" button. At that point your browser establishes a connection to YouTube's servers, which may set cookies and process your IP address and viewing behaviour in accordance with Google's privacy policy. The legal basis is your freely given consent by clicking Play (Art. 6(1)(a) GDPR). You can avoid this data transfer simply by not clicking the play button and watching the trailer directly on YouTube instead.
We use the following third-party service providers, who process personal data on our behalf as processors under a Data Processing Agreement (DPA) and only on our documented instructions:
MailerLite (operated by MailerLite, based in Lithuania, within the EU) is used to manage our newsletter mailing list and to send newsletter and confirmation emails. It processes the email addresses and consent records of newsletter subscribers.
Hostinger (based in the EU) provides the hosting infrastructure for this website and processes the technical server-log data described in section 4.
Both providers are located within the European Economic Area, so no transfer of this data outside the EEA takes place.
Our newsletter and hosting providers (MailerLite and Hostinger) are based within the EEA and no transfer outside the EEA occurs for those services.
When Google Fonts or the YouTube player is loaded (see section 5), data is transmitted to Google LLC, headquartered in the United States. Google relies on the EU–US Data Privacy Framework and Standard Contractual Clauses (Art. 46(2)(c) GDPR) as the legal mechanism for these transfers. Details can be found in Google's Privacy Policy.
Under the GDPR you have the following rights with regard to your personal data:
To exercise any of these rights please use our contact form. We will respond within 30 days.
If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for Studio Ashty d.o.o. is the Personal Data Protection Agency of Bosnia and Herzegovina (Agencija za zaštitu ličnih/osobnih podataka u Bosni i Hercegovini). You may also contact the supervisory authority of your EU member state of residence.
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. We encourage you to review this page periodically. Where changes are material, we will notify subscribers via email.