Privacy Policy

Controller and contact

The controller of the personal data described in this policy is [Operator: legal name, registered address, company ID]. You can reach us at [contact e-mail]. We have not appointed a data protection officer because the law does not require one for our processing.

Our two roles

For your account, billing, support and our own website we decide why and how data is processed, so we are the controller.

When players visit a store you run with Sprytto, you decide why their data is processed. For that data (storefront consent records, consent-based visit statistics and form submissions) you are the controller and we are your processor under Article 28 GDPR; the data processing terms in our Terms of Service apply.

Data we process

Depending on how you use Sprytto we process:

• Account data: name, e-mail address, password (stored only as a hash), two-factor and passkey data, and sign-in provider identifiers if you use Google, Discord or GitHub.
• Security data: IP address, browser information, session records, bot-protection results (Cloudflare Turnstile) and an audit log of actions in your workspace.
• Billing data: chosen plan, subscription state and invoices. Card details are entered only in Stripe's own payment fields; we store only encrypted references to your Stripe customer and subscriptions.
• Store content: texts, images, designs, settings and your Tebex credentials, which are stored encrypted.
• Support communication you send us.
• Storefront visitor data processed for store owners: consent records, visit statistics collected only with consent, and form submissions, which are stored encrypted. Player purchases are handled by Tebex; we do not store buyers' identities.

Purposes and legal bases

• Providing the service you signed up for, including account, stores and support: performance of a contract (Art. 6(1)(b) GDPR).
• Security, abuse and fraud prevention, rate limiting and the audit log: our legitimate interest in a safe service (Art. 6(1)(f)).
• Billing, invoicing and bookkeeping: contract and legal obligations (Art. 6(1)(b) and (c)).
• Service e-mails such as sign-in verification, security alerts and billing notices: performance of a contract.
• Product news: only with your consent, which you can withdraw at any time (Art. 6(1)(a)).

Recipients and processors

We do not sell personal data. We share it only with providers that help us run Sprytto, under data processing agreements:

• Cloudflare, Inc. (DNS, content delivery, DDoS protection, Turnstile bot protection and image hosting), United States and EU.
• Stripe Payments Europe, Ltd. (subscription payments), Ireland, with transfers to the United States.
• Seznam.cz, a.s. (delivery of service e-mails), Czech Republic.
• [hosting provider and data-centre country] (application servers and databases).
• Tebex Limited, only if you connect your store; Tebex acts as its own controller for player purchases.
• Public authorities where the law requires it.

International transfers

Where data leaves the European Economic Area, for example to Cloudflare or Stripe in the United States, it is protected by the EU–US Data Privacy Framework where the recipient is certified, or by the European Commission's standard contractual clauses.

How long we keep data

• Account data: while your account exists, then deleted or anonymised within 30 days of closing it.
• A store whose subscription stops being paid goes offline and is erased seven days later; a workspace you close is erased on the scheduled date.
• Invoices and accounting records: as long as tax and accounting law requires, currently up to 10 years.
• Audit and security logs: 30 to 365 days depending on the store's plan.
• Form submissions: for the retention period the store owner sets.
• Backups: overwritten within [30] days.

Cookies

We use only cookies that are strictly necessary to sign you in, keep the service secure and remember your language. We do not use advertising cookies. Stores built with Sprytto ask visitors for consent before collecting visit statistics.

Your rights

You have the right to access, correct and erase your data, to restrict or object to processing, to data portability (the dashboard offers a workspace data export) and to withdraw consent at any time. Contact us to exercise them; we answer within one month.

You can also complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz) or to the authority in your country.

Security

Data is encrypted in transit, credentials and provider references are encrypted at rest, access is limited to what each role needs, and every account can use two-factor authentication or passkeys.

Changes

We will announce material changes to this policy by e-mail or in the dashboard before they take effect.