Privacy policy
Last updated: 6 October 2026
This policy explains what personal data [Company legal name, e.g. Playable Marketing d.o.o.] ("we") processes when you use Playable Marketing, why, on what legal basis, for how long, and what your rights are. We collect only what the service needs to work. If the English and Slovenian versions differ, the Slovenian version prevails.
1. Who is responsible
[Company legal name, e.g. Playable Marketing d.o.o.], [Street and number, postcode city, Slovenia], registration number [Company registration number (matična številka)]. Privacy contact: [privacy contact email, can be the same as email]. We are not required to appoint a data protection officer; the address above handles all privacy questions.
For customer accounts (marketers and their team members) we are the data controller. For players of a published game, the company that published the game is the controller and we process the data on its behalf as a processor, under our data processing agreement (see section 4).
2. Customers: what we process and why
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Email, name, password (stored only as a secure hash) | Your account and login | Contract, Art. 6(1)(b) | Until you delete your account |
| Workspace content: campaign briefs, game texts, brands, logos and images | Providing the service | Contract, Art. 6(1)(b) | Until you delete it or your account |
| Team members and invites: names, emails, roles | Letting teams work together | Contract, Art. 6(1)(b); for invited people our customer's legitimate interest, Art. 6(1)(f) | While a member; open invites 30 days |
| Plan, billing address, VAT ID, invoices (card details are handled only by Stripe) | Billing and accounting | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) | Invoices 10 years (Slovenian tax law), the rest while subscribed |
| Log of AI generations (time only) | Fair-use daily limits | Legitimate interest, Art. 6(1)(f) | 13 months |
| Technical logs with IP address, kept by our hosting providers | Delivering pages, security, preventing abuse | Legitimate interest, Art. 6(1)(f) | For the short period our providers keep them |
Giving us your email and a password is necessary to have an account; everything else is optional. We don't use automated decision-making or profiling, and we don't sell or rent personal data.
3. AI features
When you ask for game concepts, your campaign brief is sent to Anthropic's Claude API to generate suggestions. Anthropic does not use API inputs to train its models. Please don't put personal data into briefs. Player data is never sent to the AI.
4. Players of published games
Games are published by our customers, who decide why and how player data is used and are responsible for informing players — look for the "Privacy" link under the game. We process player data only on their behalf. Players don't create accounts and we don't use cookies on game pages. Depending on the game, we record:
- Game events (viewed, started, completed, shared, clicked the call-to-action) with a time and score.
- A random session ID created when the page opens. It is not stored on the device and only stops one visit from being counted twice.
- Leaderboards (only if the player chooses to join): the nickname they type and their score, shown publicly on that game.
- Contact form (only if the publishing company turns it on and the player fills it in): the email and, if asked, name and phone number the player enters, their score, the consent text they ticked and the time. The publishing company receives these contacts and may send them to its own systems, such as its CRM.
- Prize wheels and score rewards: a random device ID kept in the browser's local storage, the prize won or the score, and any coupon code given, so each device gets one fair spin or one coupon and keeps it after a reload.
Apart from the contact form, we don't store names, email addresses or IP addresses with this data, so players can't be identified from it by us. It is deleted when the customer deletes the campaign, and automatically after 25 months at the latest (prize device IDs are anonymised then). Players who want their leaderboard entry or contact removed, or want to withdraw consent, can ask the publishing company or us.
5. Camera mode
Some games offer an optional camera mode, where players answer by tilting their head. It only starts after the player chooses it and allows camera access in their browser. The camera image is processed entirely on the player's device to detect head movement; it is never uploaded, stored, or seen by us or the publishing company, and it is not used to identify anyone. The face-tracking software is delivered from our own servers. If the player saves a video of their game, it is created on their device and shared only where they choose.
6. Cookies and similar technologies
We only use what is strictly necessary for a service you asked for, so no consent banner is needed. We use no advertising, analytics or tracking cookies.
| Name | Where | Purpose | Duration |
|---|---|---|---|
| sb-…-auth-token (cookie) | Dashboard | Keeps you logged in | Until you log out or the session expires |
| pm-ws (cookie) | Dashboard | Remembers which workspace you're working in | 12 months |
| pm-lang (cookie) | Whole website | Remembers the language you picked | 12 months |
| playable-device (local storage) | Prize wheel games only | One fair spin per device; shows the prize again after a reload | Until the player clears site data |
Stripe's checkout and billing pages, which open on stripe.com, set their own cookies for payment security.
7. Service providers (processors)
We use these providers, each bound by a data processing agreement:
- Supabase Inc. — database, login and file storage, hosted in the EU.
- Vercel Inc. — website hosting; our server code runs in Frankfurt (EU), pages are delivered through a global network.
- Anthropic PBC (USA) — AI concept generation from campaign briefs (customers only).
- Stripe Payments Europe Ltd. (Ireland) — payments and invoices (customers only).
Where a provider or its sub-processors may access data from outside the EU/EEA, the transfer is protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. The current list is kept in our data processing agreement.
8. Security
Data is encrypted in transit and at rest, each workspace is isolated at database level, passwords are stored only as secure hashes, and access to production systems is limited and protected with two-factor authentication. If a breach ever puts your data at risk, we will inform you and the authority as the law requires.
9. Your rights
You have the right to access your data, correct it, delete it, receive it in a portable format, restrict processing, and object to processing based on legitimate interest. You can download all your data and delete your account yourself under Settings → Your data, or write to [privacy contact email, can be the same as email]; we reply within one month. You can also complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si) or your local data protection authority.
Deleted data also disappears from backups when those expire under our providers' backup schedule. Deleting your account doesn't delete invoices: Stripe and we keep billing records for 10 years as tax law requires.
10. Children
The dashboard is for business users only. Customers must not use games to knowingly collect data from children under 16 without the consent required by law.
11. Changes
If we change this policy, we'll update the date above and, for significant changes, tell account holders by email in advance.