Privacy Policy
Processed data, purposes, legal bases, retention periods, recipients, and rights.
Incomplete publication information. The publisher and host details must be completed and verified before the service can be opened to the public.
Translation of the source document into French
Controller
The identity and contact details of the controller and, where applicable, the data protection officer will be completed before publication. The portal must not be declared legally ready before this step.
Data that may be processed
- account and sign-in identity: provider ID, verified email address, nickname, and verification date;
- profile: language, country, preferences, theme, avatar, accessibility settings, and fictional balance;
- devices: platform, device name, notification token, and last activity;
- game: rooms, games, participants, moves, scores, rankings, technical seed, state, and result;
- security and moderation: reports, description, game ID, decisions, audit logs, IP address, and server logs;
- support and rights: messages, voluntarily submitted files, nature of the request, and follow-up;
- local data: session, preferences, offline progress, PWA cache, and items required for Firebase Authentication.
Intended purposes and legal bases
- perform the requested service, create the account, save preferences, and run the games — performance of the contract;
- to secure CardVerse, prevent fraud, diagnose incidents, and moderate — legitimate interest, with documented balancing;
- respond to legal requests and preserve required evidence — legal obligation;
- send optional notifications or enable non-essential trackers — consent where required.
Recipients and processors
Access is limited to authorized persons and necessary service providers, including hosting and Firebase for authentication and configured notifications.
The final list of service providers, their processing locations, and their contracts must be checked before launch.
International transfers
If data leaves the user’s country, CardVerse will put in place the required mechanism in the relevant market, such as an adequacy decision, contractual clauses, or another recognized safeguard. The final mapping remains to be validated.
Retention periods
Retention targets are listed in the table associated with this policy. The corresponding technical tasks must be tested before launch; in the event of a legal obligation, incident, or dispute, some data may be isolated for longer.
Your rights
Depending on your country, you may request access, rectification, erasure, restriction, objection, portability, withdrawal of consent, information about sharing, or a review of certain decisions.
You may use the dedicated form. Proportionate identity verification may be requested. You may also contact the competent supervisory authority in your country.
Automated decisions
Artificial opponents, matchmaking, and rankings are for gameplay. They are not intended to produce legal effects or effects of comparable importance. Any future significant automated decision must be documented and explained.
Security and data breach
CardVerse plans access controls, encrypted communications, logging, backups, and an incident procedure. People and authorities will be informed where applicable law requires it.
Service providers and technical recipients
| Service provider | Purpose | Data | Status |
|---|---|---|---|
| Google Analytics | Statistiques d’utilisation facultatives, distinctes du consentement publicitaire. | Données techniques et chemins publics sans paramètres d’URL ; aucun courriel, pseudo ou contenu de partie. | optional_opt_in |
| Firebase / Google Cloud | Authentication and, if enabled, push notifications. | Account IDs, email, technical IDs, and device token. | configuration_and_contract_review_required |
| Hosting provider to be completed | API, portal, database, and backup hosting. | Service data, technical logs, and backups. | provider_required |
Android previews
Applications are collected through the central HRS Digital form. The Google Play address, the chosen contact language, and optionally the country are used to manage the application in its private admin area. This registration is not an advertising subscription.