Privacy Policy

Last updated: 24 August 2026 · Privacy version: 2026-08-24-v2

This policy explains how personal data is handled in Who Plays My Game, a product operated by Lumino Games sp. z o.o..

1. Data controller

The controller for product-account and service-operation data is Lumino Games sp. z o.o., ul. Kazimierza Morawskiego 5/127, 30-102 Kraków, Małopolskie, Poland. KRS 0000910452, NIP 6762600090, REGON 389433660.

Privacy and support contact: whoplaysmygame@gmail.com.

When a customer transaction is completed through Paddle, Paddle acts as Merchant of Record for that transaction and processes payment, transaction-tax and customer-billing data under its own privacy terms and legal responsibilities. This policy describes the data handled by Who Plays My Game and Lumino Games sp. z o.o. in connection with the product.

2. Data we process

Depending on how you use Who Plays My Game, we may process:

• account data, such as email address, display name and authentication identifiers;
• workspace and monitoring configuration, including game titles, aliases, URLs and exclusion terms;
• billing-choice information, including the selected plan/period and whether checkout was started as an individual or company/business;
• checkout-consent evidence, including accepted Terms/Privacy versions, recurring-billing acknowledgement, immediate-service request where applicable, timestamp and billing-provider/checkout identifiers;
• subscription identifiers and status information returned by the billing provider, including Paddle customer, transaction and subscription references for the current integration;
• where a legacy/direct billing route has been tested or used, associated Stripe billing identifiers and retained accounting/compliance evidence relevant to that route;
• notification settings, including a Discord webhook or email destination if you configure those features;
• technical and security information needed to operate and protect the service, such as timestamps, request metadata, user-agent information and service logs;
• support and legal messages you send to us, including withdrawal, complaint or billing requests;
• publicly available creator and content metadata discovered through supported platforms, such as creator/channel names, video or stream titles, URLs, view counts and live-viewer counts.

We do not receive or store full payment-card details. Payment details for Paddle transactions are handled by Paddle. Password handling is provided through Supabase Auth; Who Plays My Game does not expose your password to workspace users or administrators.

3. Why we use the data and legal bases

• Providing the service and account: to create and operate your account, workspace, monitors, dashboard, subscription state and settings. The legal basis is performance of a contract or steps taken at your request before entering a contract.
• Billing and checkout evidence: to initiate the selected checkout, synchronize subscription access, retain checkout choices and handle cancellation, withdrawal, refund, complaint or dispute requests. The legal bases may include performance of the contract, legal obligations and legitimate interests in maintaining reliable transaction records and defending legal claims.
• Security, abuse prevention and support: to protect accounts, diagnose problems and respond to support requests. The legal basis is our legitimate interest in operating a secure and reliable service.
• Creator-signal monitoring: to identify public mentions of monitored games and present those signals to the relevant workspace. The legal basis is our legitimate interest in providing creator-intelligence monitoring from publicly available sources.
• Legal and accounting duties: where applicable, to comply with tax, accounting, consumer-protection and other legal obligations connected with the service and paid subscriptions.
• Consent: where we specifically ask for consent for a separate purpose.

4. Data required to use the service

Some data is necessary to create an account or perform the service, for example an email address and information required for the selected monitoring configuration. If required account or service information is not provided, we may be unable to create the account or provide the requested feature.

A billing provider may require additional payment, address, business or tax information to complete a transaction. That information is handled according to the provider's checkout and privacy terms. Who Plays My Game stores only the billing/subscription metadata and evidence reasonably needed to provision access and maintain records.

5. Service providers, recipients and external platforms

We use specialist providers to operate Who Plays My Game. These include Supabase for database and authentication infrastructure, Vercel for application hosting, Paddle for the Merchant-of-Record billing integration, and Resend for authentication email delivery and opt-in product email digests. A legacy Stripe sandbox integration remains in the codebase as a rollback/testing route. Discord receives notifications only if you configure a Discord webhook.

Professional advisers and competent public authorities may receive information where necessary for accounting, legal compliance, dispute handling, security or a binding legal requirement, subject to applicable confidentiality and data-protection rules.

YouTube/Google and Twitch are external platforms and data sources used to discover public content. Their own terms and privacy rules also apply when you visit or interact with those services.

6. Paddle transactions

Paddle acts as Merchant of Record for transactions processed through Paddle. Paddle may collect billing identity, address, payment-method and tax information, calculate applicable transaction taxes, process the payment, issue customer billing documents and provide customer self-service through Paddle Customer Portal. We receive the identifiers and transaction/subscription information needed to associate the Paddle purchase with the correct workspace and access level.

Paddle LIVE is the current billing route for new paid subscriptions. The product stores only the Paddle transaction, customer and subscription information needed to synchronize access and maintain appropriate evidence. Paddle Sandbox remains internal test history and public Sandbox checkout is disabled.

7. International processing

Some technology providers may process data outside Poland or the European Economic Area. Where required, transfers are handled using safeguards available under applicable data-protection law, such as adequacy decisions or standard contractual clauses used by the relevant provider.

8. Retention and account deletion

Account, authentication, owned workspace, monitoring configuration and related product data are generally kept while the account or workspace is active. When an account is eligible for permanent deletion, the product-deletion flow removes product data subject to information that must still be retained for legal obligations, transaction/accounting records, disputes, fraud/security prevention or backup lifecycles.

Checkout-consent evidence, subscription references, transaction evidence and legally required accounting or dispute records may remain longer than the active product account. Retained records should be minimized and kept only for the period justified by the relevant legal, accounting, fraud-prevention or claims-defense purpose.

9. Automated processing

Who Plays My Game uses automation to scan supported platforms, calculate signal scores, apply plan limits and synchronize subscription states. These processes support operation of the service, but the product does not currently use solely automated decision-making intended to produce legal effects concerning an individual or similarly significantly affect that individual within the meaning of Article 22 GDPR.

10. Your rights

Subject to the GDPR and applicable law, you may have rights to access your data, correct it, request deletion or restriction, receive certain data in a portable format, and object to processing based on legitimate interests. Where processing is based on consent, you can withdraw that consent without affecting processing that took place before withdrawal.

You can also lodge a complaint with the competent supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

11. Cookies and local storage

Who Plays My Game uses technical storage needed for authentication, session continuity, onboarding state and product operation. The public beta does not intentionally deploy advertising cookies. If analytics or optional marketing technologies are introduced later, this policy and any required consent mechanism will be updated first.

12. Public beta changes

Who Plays My Game is in public beta. Features, providers and retention rules may evolve. Material changes to this policy will be reflected by updating this page and its revision date before they apply where required.