1. Controller and contact
The controller responsible for processing personal data through PodBalance is:
[TO COMPLETE: full controller name / business name]
[TO COMPLETE: full postal address]
Email: [TO COMPLETE: privacy contact email]
Data protection officer, if appointed: [TO COMPLETE: contact details or remove if not applicable].
2. What data we process
Depending on how you use the service, this may include account details (username, email address, password hash), login/session information, playgroup memberships and invitations, Commander decks and decklists, and game-night details or attendance responses. Please verify all actual database fields and any additional user tracking before publishing.
3. Accounts and playgroups
We process registration details and related account data to provide login, account security and the features you request. Members of a shared playgroup may see relevant usernames, memberships and deck information. Basis: Article 6(1)(b) GDPR where needed to provide the requested service; Article 6(1)(f) GDPR may apply to proportionate security measures.
4. Hosting and access logs
PodBalance is currently hosted using infrastructure provided by ALL-INKL in Germany, subject to confirmation of the exact hosting entity and data-processing agreement. Server access logs may include IP addresses, time, requested URLs, user agent and technical error details, to operate and secure the service. Basis generally Article 6(1)(f) GDPR, subject to review.
[TO COMPLETE: exact hosting company/legal entity, server location, access-log retention and processing agreement]
6. External services and international transfers
Scryfall: PodBalance uses Scryfall card data and may load card imagery or mana symbols from Scryfall domains in visitors’ browsers. Direct browser loading can transmit connection data such as IP address to the service provider. Scryfall API requests from the server have a different data flow and should be documented separately.
Google Fonts: The current public website loads DM Sans and Space Grotesk through Google Fonts, which may transmit visitor connection data to Google. Consider self-hosting these fonts to reduce third-party requests, and verify lawful use and any transfer mechanism before publishing.
[TO COMPLETE: confirm all external scripts, providers, recipients and non-EU transfer details]
7. Retention and deletion
Personal data is kept only as long as necessary for the stated purposes or applicable retention obligations. Exact periods and account-deletion mechanisms must be verified before publication.
[TO COMPLETE: account deletion rules, retention periods, backup retention and log retention]
8. Your rights
Under applicable GDPR requirements, you may have rights of access, rectification, erasure, restriction, portability and objection, depending on the legal basis and circumstances. Where processing depends on consent, you may withdraw it for the future. To exercise your rights, contact the controller above. You may also lodge a complaint with a competent data-protection supervisory authority.
9. Security and changes
We use reasonable technical and organizational measures to protect account and playgroup information. This notice may be updated when the service, its providers or legal requirements change.