REGISTER OF PROCESSING ACTIVITIES
Last updated: 18 August 2026
Published summary of our record of processing activities under GDPR Article 30, together with our data-retention schedule, the processors we use and how international transfers are protected. We publish it voluntarily so you can see exactly what happens with your data.
Processing activities
| Activity | Data categories | Legal basis | Retention |
|---|---|---|---|
| Website delivery & security | IP address, user agent, request logs | Legitimate interest (art. 6.1 f) | Max 90 days (audit log purge job) |
| User accounts & profiles | E-mail, username, display name, avatar, bio, date of birth | Contract (art. 6.1 b) | Until you delete your account (then max 30 days), or 2 years of inactivity |
| Game data, achievements, statistics | Scores, saves, achievements | Contract (art. 6.1 b) | Same as account |
| Reviews and other user content | Review text, rating, username | Contract / legitimate interest | Until removed by you or moderation |
| Memberships & donations | Name, e-mail, amount, Stripe transaction reference | Contract + legal obligation (accounting) | 7 years (Swedish Bookkeeping Act) |
| Support, contact and bug reports | Name, e-mail, message content | Legitimate interest (art. 6.1 f) | 24 months |
| Transactional e-mail | E-mail address, delivery status | Contract / legitimate interest | 12 months |
| Analytics | Pseudonymous identifiers, page views, device data | Consent (art. 6.1 a) | Not applicable — analytics is not used |
| Advertising (Google AdSense) | Ad identifiers, page context; profiling only with consent | Consent (art. 6.1 a) | Up to 13 months (Google) |
| Admin & access audit logs | Masked/hashed IP, hashed e-mail, action, timestamp | Legal obligation / legitimate interest (security) | 90 days |
Processors and sub-processors
| Processor | Purpose | Data location | Transfer safeguard |
|---|---|---|---|
| Lovable Cloud / Supabase | Hosting, database, authentication, storage, edge functions | EU region | DPA with EU Standard Contractual Clauses for any support access from outside the EEA |
| Cloudflare | CDN, TLS, bot protection | Global edge, EU-first routing | DPA + Standard Contractual Clauses |
| Stripe | Payments for memberships and donations | EU/US | DPA + Standard Contractual Clauses; Stripe is an independent controller for fraud prevention |
| Google (AdSense) | Advertising | EU/US | Google Ads Data Processing Terms + Standard Contractual Clauses; EU-US Data Privacy Framework |
| Resend | Transactional e-mail delivery | EU/US | DPA + Standard Contractual Clauses |
A data processing agreement (DPA) is in place with every processor above. Where a processor may access data from outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses (Decision 2021/914) plus supplementary technical measures such as encryption in transit and at rest, and access logging.
Retention policy
- Server and audit logs: automatically purged after 90 days by a scheduled job.
- Cookies: see the storage times in the Cookie Policy.
- Account and profile data: deleted within 30 days of an account deletion request.
- Inactive accounts: an account with no sign-in for 2 years is deleted automatically, including profile and game data. We e-mail a warning 30 days in advance; signing in resets the clock.
- Payment records: kept 7 years to comply with the Swedish Bookkeeping Act (Bokföringslagen 1999:1078).
- Support and contact messages: 24 months, then deleted.
- Backups: rolling backups are overwritten within 35 days.
Breach notification policy
- Any suspected personal-data breach must be reported internally to the responsible publisher immediately.
- We assess scope, category of data and risk within 24 hours.
- If the breach is likely to result in a risk to your rights and freedoms we notify Integritetsskyddsmyndigheten (IMY) within 72 hours of becoming aware of it.
- If the risk is high we also inform the affected users directly and without undue delay, describing what happened, likely consequences and what we and you can do.
- Every incident is documented in an internal breach register, including incidents we decide not to report and why.
Report a suspected security issue or data breach to contact@trysomegames.com.