1. Controller

[TODO: Vor- und Nachname] [TODO: Straße und Hausnummer] [TODO: PLZ und Ort] Germany Email: [TODO: E-Mail-Adresse]

We have not appointed a data protection officer because we are not required to.

2. Overview

You can use Play Money Party without giving your name. We only process what is needed to run it: technical data when you call up the website, a guest account with your game progress and a registered account with an email address if you want one. We do not sell data, show ads or build advertising profiles.

3. Hosting and server log files

Play Money Party runs on Google Cloud Platform (Cloud Run), provided by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. The servers are located in Belgium (region europe-west1); the whole website is delivered from there.

With every request, Google processes technically necessary data: IP address, date and time, the address requested, referrer, browser and operating system (user agent), status code and response time. This is necessary to deliver the website, to run it stably and securely and to find errors. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in secure and functional operation. These logs are kept for 30 days and then deleted automatically.

We have a data processing agreement with Google (Art. 28 GDPR; Cloud Data Processing Addendum). For operation and support, Google and its sub-processors (including Google LLC in the USA) may also access data from third countries. Google LLC is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46 (2) (c) GDPR).

4. Guest account and game data

When you confirm the age check, we automatically create an anonymous guest account so that your balance and games are kept. For this we process:

• a random user ID and login tokens,
• an automatically assigned username (you can change it),
• balance, bookings, stakes and game results including the data needed to verify them (seeds),
• level, bonus times, shop items and titles, the result of checking your e-mail address, crates opened and shards, achievements, vouchers redeemed,
• friendships, invitations (who invited whom) and poker tables,
• for bot accounts, a hash of the API key and the time of last use.

The legal basis is Art. 6 (1) (b) GDPR (performance of the contract of use). We also use game data in aggregated form to monitor payout rates and to detect abuse such as multiple accounts or chip dumping (Art. 6 (1) (f) GDPR; legitimate interest: fair play free of abuse).

The database and login are run for us by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, as a processor (Art. 28 GDPR). The data is stored in a data centre in Frankfurt am Main (AWS region eu-central-1). For operations and support, Supabase and its sub-processors (including Supabase, Inc. in the USA) may also access data from Singapore and the USA. These transfers are safeguarded by the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).

When you log in and when tokens are renewed, your browser connects directly to Supabase. Supabase processes your IP address and browser identifier (user agent) to manage the session and to limit abuse such as mass account creation (Art. 6 (1) (f) GDPR; legitimate interest: secure operation). Session data is deleted when the session ends. [TODO: retention of sign-in logs – recommended: switch off audit logs in Supabase and write here “We do not keep sign-in logs.”]

If you register with an e-mail address, we check that it is valid, not from a throwaway service, and that its domain can receive e-mail according to DNS. For this we only query the domain's public DNS records; we don't pass on the address itself. For registered accounts we repeat this check about every 30 days and store the result, so that we can spot multiple accounts and abuse of invitation rewards (Art. 6 (1) (f) GDPR; legitimate interest: fair play free of abuse). We delete the result with your account.

We keep this data for as long as your account exists. Guest accounts that have not been used for 12 months (no games, bonuses or other bookings) are deleted automatically. You can have your account deleted at any time under “Delete account” in your profile or by email; we do so within one month at the latest. We then delete the account, login data, username, balance, items, friendships, settings and open games, and replace your name in past crash rounds. Bookings and game results, which we store immutably so that the play-money accounts can be traced, remain only under a random ID with no reference to you. As proof that we handled your request, we keep this ID with the dates of request and deletion (Art. 6 (1) (c) in conjunction with Art. 5 (2) GDPR).

5. Registration

If you turn your guest account into a registered account, we also process your email address and your password (stored only as a secure hash). This lets you log in, reset your password and use further features. The legal basis is Art. 6 (1) (b) GDPR.

Emails: we send codes (confirmation, login, new password), a welcome after registration and security notices when something important changes on your account (password, email address, linked sign-in) to your account's address. So that they arrive in your language, we store your language setting with your account. We do not send advertising. They are sent via Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) from servers in Ireland (EU). We have a data processing agreement with Resend (Art. 28 GDPR); Resend is certified under the EU-US Data Privacy Framework, and transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses. The legal basis is Art. 6 (1) (b) GDPR, for the security notices Art. 6 (1) (f) GDPR (our and your interest in noticing misuse of your account quickly).

Sign-in with Google: if you choose "Continue with Google", Play Money Party forwards you to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With your consent, Google shares your email address, name, possibly a link to your profile picture and a Google ID with us; we only use the email address. what data Google itself processes is governed by Google's privacy policy. The legal basis is Art. 6 (1) (b) GDPR; signing in with Google is optional.

6. What other players see

Some information is visible to others because it is part of the game. Public, i.e. available even without an account: for registered accounts, username, name frame, title, level and balance on the leaderboard, plus your biggest wins, stakes and number of games in the last 24 hours; for all accounts, username, title, stake and cash-out in the current crash round, and username, title, stake and chosen spots in the current Lucky Wheel Live round. Players who add you as a friend (your username is enough for that) see your balance, your level and your open poker tables. At poker tables, the other players see your name, your actions and chips. Only registered accounts appear in the friend search. So pick a username that does not reveal your real name. The legal basis is Art. 6 (1) (b) GDPR.

7. Cookies and local storage

We do not use cookies for advertising or tracking. We only store what is strictly necessary for the features you request:

The legal basis for storing and reading this data is Section 25 (2) no. 2 TDDDG, because it is strictly necessary for the service you requested; subsequent processing is based on Art. 6 (1) (b) GDPR. You can delete cookies and local data in your browser at any time; Play Money Party will then ask for your age again and may create a new guest account.

8. Protection against abuse

To prevent overload and abuse, we limit the number of requests. When bots are registered, we use your IP address for this. We delete these counters automatically after about one day. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure operation.

9. Fonts and external links

We serve fonts from our own server; your browser does not connect to Google or other providers for them. Links to other websites (e.g. counselling services) only open a connection to that provider when you click them; the provider is responsible for its own data processing.

10. Contact by email

If you write to us, we process your details to answer your request (Art. 6 (1) (b) or (f) GDPR). We delete the message once it has been dealt with and no retention obligations apply.

11. Recipients and age

The only recipients of your data are the service providers named (Google Cloud, Supabase, the email delivery service and – if you use it – sign-in with Google) and their sub-processors, and other players to the extent described in section 6. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Play Money Party is aimed only at persons aged 18 or over. If we learn that an account belongs to a minor, we delete it.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Just write to us at [TODO: E-Mail-Adresse]. You can also request the deletion of your account directly under “Delete account” in your profile.

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You can also lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence. The authority responsible for us is: [TODO: Aufsichtsbehörde, in Bayern: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de].

Providing your data is neither a legal nor a contractual requirement. Without the technically necessary data (sections 3, 4 and 7), however, you cannot use Play Money Party.

13. Changes

We adapt this privacy policy when Play Money Party or the law changes. The version published here applies.