Privacy policy

We are not required to appoint a data protection officer (§ 38 German Federal Data Protection Act). For any privacy question, write to markus@explore-saudi.com. This policy applies to the website and services of playing.company (operated by the controller named above) in all languages.

Our website runs on Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit it, Vercel processes technically necessary data (IP address, time, page requested, browser identifier) in server logs to deliver the page and fend off attacks. The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

We have a data processing agreement with Vercel (Art. 28 GDPR). Compute functions run in the EU region Frankfurt where possible. A transfer to the USA cannot be ruled out; it relies on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where Vercel is certified, and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).

For an account we only need your email address. You sign in with a link sent by email (“magic link”); there is no password. We store account ID, email, plan, credits and sign-in times. The legal basis is the user contract (Art. 6(1)(b) GDPR).

Supabase Inc. provides the database and sign-in; the database is intended to be in an EU region (region Frankfurt, Germany). We have a data processing agreement with Supabase. Where Supabase staff in third countries can access data for support, standard contractual clauses secure the transfer.

So that the AI can design your game, we send your selection (genre, scope, style, extras, game language), the title, your idea and your change requests to Anthropic (Anthropic Ireland, Limited, Dublin, or Anthropic, PBC, San Francisco, USA). For an occasion (e.g. a birthday) the AI only learns the type of occasion. We do not send the recipient’s first name or your greeting to Anthropic: we insert the dedication on our own server only after the AI has produced the game. Your email address, account name and payment data also do not go to Anthropic. The legal basis is the user contract (Art. 6(1)(b) GDPR).

• No training: under its commercial terms, Anthropic does not train models on inputs and outputs of the API.
• Retention at Anthropic: according to Anthropic, API inputs and outputs are, depending on the model and configuration, either not stored or stored for at most 30 days; content flagged as a possible violation of Anthropic’s usage policies can be stored for up to two years.
• Third country: processing may take place in the USA. The basis is Anthropic’s Data Processing Addendum with standard contractual clauses (Art. 46(2)(c) GDPR).
• Reuse: to get games done quickly, identical inputs made shortly after each other (about two minutes) return the same result, and for selections without your own title and idea we keep a stock of games created in advance (“instant games”, each is handed out only once). In that case no new AI call is made for your game. Games with a personal dedication never go into this storage.

Before a build, an automatic filter checks your texts for protected brands and characters. If it finds something, the build is stopped and you can rephrase. This is not a decision with legal effect within the meaning of Art. 22 GDPR; you can contact us at any time.

Personal games (birthday, anniversary, team event) can contain a first name and a short message. Photos are not possible. You may only use another person’s name if they agree (for children under 16: their parents).

Games are private at first. If you share a game by link, anyone with the link can play it. A game appears in the public arcade only if you publish it there; if it contains a person’s name, you first confirm their consent. We count game starts without any link to a person.

The named person can ask at any time for their name to be removed or the game to be taken out of the arcade – via report content or by email to markus@explore-saudi.com.

AI media is not offered yet. If it is offered and you order it for a game, external providers will create it on our behalf (Art. 6(1)(b) GDPR, processing on our behalf under Art. 28 GDPR):

• Music, sound effects and voices: ElevenLabs (ElevenLabs Inc., USA). We send a cleaned game description and game texts. For voice-over, dialogue lines go to ElevenLabs; they may contain the first name of the person receiving the game. We only use standard voices and no voice clones. Your email address and name do not go to ElevenLabs.
• Video trailers: BytePlus Pte. Ltd., Singapore (a company of the ByteDance group), with the Seedance video model. We send a scene description and a preview image from your game. Beforehand we remove names, dedications, contact details and brand names, so no personal data goes to BytePlus. The provider may change (e.g. to another host of the same model); we will then update this policy.

Both providers are located outside the EU. For ElevenLabs we rely on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and on standard contractual clauses. There is no adequacy decision for Singapore; with BytePlus we agree standard contractual clauses (Art. 46(2)(c) GDPR) and assess the transfer risks. We label all media as AI-generated (see AI transparency).

Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe receives name, email, payment and billing data and technical data for fraud prevention. We never see card data. Stripe is partly responsible itself for fraud prevention and legal obligations; see Stripe’s privacy policy.

We store your plan, term (monthly or annual) and all credit transactions. The legal bases are the contract (Art. 6(1)(b) GDPR) and statutory retention duties (Art. 6(1)(c) GDPR): accounting records and invoices 8 years, commercial and business letters 6 years (§ 147 German Fiscal Code, § 257 German Commercial Code).

Gift cards: if you buy a gift card, we create a code. We store the code in plain text until it is redeemed so that you can look it up in your account again; afterwards we delete the plain text and keep only a check value (hash). If you add a sender name and a greeting, we store them with the gift card, and anyone who enters the code sees them. We don’t know who you pass the gift card on to, and we don’t contact the recipient. Whoever redeems a gift card needs their own account.

Counting play time. For Showroom games whose creator has chosen a play time price, we count on our server how long the game is played. For this your browser sends a short message every few seconds with the game ID. We need this to account for free time, the Play Pass and purchased play minutes and to give creators their share (Art. 6(1)(b) GDPR), and to protect against abuse (Art. 6(1)(f) GDPR).

With an account we store the seconds played per game and the pass time per month, linked to your account, so that your balance is correct. Without an account we work without cookies and without storage in the browser: from the IP address, browser identifier (user agent) and a random value that changes daily (salt) we form a short daily identifier (hash). We do not store the IP address or browser identifier themselves. Only the daily identifier and the seconds played that day are stored; they are deleted the next day. The salt is deleted after 48 hours at the latest, after which the identifier can no longer be attributed.

Creators. In the gallery creators appear only under a pseudonym calculated from the account ID, never with an email address or name. Creators see the figures for their own games (starts, minutes played) with no link to individual players.

Play Pass and play minutes. We store the term, renewal and cancellation of the Play Pass and your minutes balance in your account; payment is processed by our payment provider as described in section 8.

If you join the waiting list, we first send a confirmation email. Only when you click the link in it do we add you (double opt-in). We store email, interest, source and the times of sign-up and confirmation as proof of your consent (Art. 6(1)(a), Art. 7(1) GDPR). We delete unconfirmed entries after 30 days.

You can withdraw your consent at any time – via the unsubscribe link in every email or by writing to markus@explore-saudi.com. Emails are sent through our service provider Supabase (see above) as processor.

If you order a personal game, we process name, email, occasion, idea, genre and – if given – the first name of the recipient to create the game, contact you and bill you (Art. 6(1)(b) GDPR). Once done, we delete the data unless a retention duty applies. We don’t inform the recipient ourselves; please tell them.

If you report content, we store the notice, the reason, your explanation and – if you give them – name and email. We need this to review the notice and reply to you (Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA). The person concerned receives a statement of reasons for our decision; we only name you if strictly necessary (Art. 17(3)(b) DSA). If there are indications of criminal offences threatening life or safety, we inform the authorities (Art. 18 DSA). We delete notices six months after the case is closed.

We don’t ask for a date of birth. We only store whether you confirmed that you are at least 16, or that you are under 16 and your parents agree – with the time. This lets us enforce our age limit (Art. 6(1)(b) and (c) GDPR) while collecting no more than necessary (Art. 5(1)(c) GDPR).

We want to understand which pages and steps work well, so we measure use of our website without cookies and without storing anything on your device. A small script reports to our own server (not to third parties):

• the page viewed (without parameters) and events such as “build started” or “pricing page viewed”,
• which website a visit comes from (domain only, not the full address),
• the width of your browser window and load-time metrics (Web Vitals),
• how long a page was visible.

From the shortened IP address (last octet or last blocks removed) and the browser identifier we create, with a secret key that changes daily, a short value (hash) so that we can count visits without recognising you; we don’t store the IP address or the browser identifier themselves for this. We delete the key after 48 hours at the latest; the short value can then no longer be reversed or linked to other days or other websites. We delete raw data after 90 days; after that only totals without personal reference remain. The legal basis is our legitimate interest in improving our service (Art. 6(1)(f) GDPR).

For signed-in users we additionally evaluate server-side events (builds, changes, purchases, cancellations) to understand what keeps people or makes them cancel. For this we use your account ID but no content of your games.

Feature tests (A/B). To improve how prices are shown in the order wizard, we randomly show visitors one of two versions of the interface (for example, whether the credit price appears already during the selection steps or only at checkout). The assignment is made randomly on our server and without cookies and without storing anything on your device: it derives from the anonymous daily identifier (see above) or, if you are signed in, from your account ID. Only totals per variant are evaluated (how many start the wizard, reach checkout, build or buy). If your browser sends “Do Not Track” or “Global Privacy Control”, you always get the default version and nothing is measured. We never test prices on the pricing page, at checkout or in the payment process; the total price is always shown in full before your order. The legal basis is our legitimate interest in a clear presentation of prices (Art. 6(1)(f) GDPR); the opt-out above applies here as well.

Ratings (“thumbs”), stars after a build and the question about the reason when cancelling are voluntary. We store your choice, an optional free text (up to 500 characters) and – if you are signed in – your account ID to improve our service (Art. 6(1)(f) GDPR). Please don’t put personal data in the free text. We delete feedback after 12 months.

An internal area for our team shows metrics (usage, queue, revenue) and, where needed for customer support, abuse prevention and billing, account, game and notice data. Access is protected by a secret password; after signing in we set a session cookie (12 hours, team members only). We limit failed attempts per IP address. The legal basis is our legitimate interest in a secure, well-supported service (Art. 6(1)(f) GDPR); we restrict access to people who need it (Art. 32 GDPR).

Without your consent we only set cookies and storage entries that are technically strictly necessary for the service (§ 25(2) no. 2 TDDDG). There are no advertising cookies. Our own analytics (section 13) stores nothing on your device. Only if you choose “Allow statistics” in the notice do we additionally load Google Analytics (see below).

The site language is part of the address (/de), not stored in a cookie. We store the age confirmation on our server, not in the browser.

Google Analytics (only with consent). If you choose “Allow statistics”, we load Google Tag Manager and Google Analytics 4 from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Google receives, among other things, the pages viewed, device, browser, approximate location (from the truncated IP address) and a random identifier in a cookie. Advertising features are off (Consent Mode: ad storage and personalisation denied). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). A transfer to Google LLC in the USA is possible; Google is certified under the EU-US Data Privacy Framework. You can withdraw consent at any time via “Cookie settings” in the footer; we then stop loading Google and delete the Google cookies as far as the browser allows.

Vercel Web Analytics and Speed Insights. Our host Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) counts page views and measures loading times for us – without cookies and without storing anything on your device. Processed are the page viewed (without parameters), referrer, country, device type, browser and operating system, plus loading-speed metrics; visits are distinguished by a daily rotating hash that cannot be traced back to you. The legal basis is our legitimate interest in a stable, fast website (Art. 6(1)(f) GDPR); a data processing agreement with Vercel is in place, and transfers to the USA rely on the EU-US Data Privacy Framework. If your browser sends “Do Not Track” or “Global Privacy Control”, we don’t load this measurement.

Sign-in with Google. If you use “Continue with Google”, Google confirms your email address to us (and sends name and profile picture, which we don’t store). The legal basis is Art. 6(1)(b) GDPR (contract for your account). Google’s privacy notice applies to signing in with Google.

We load our fonts locally from our own server. No connection to Google or other font providers is made. The fonts (Bungee, Silkscreen, Schibsted Grotesk) are licensed under the SIL Open Font License and are stored as files on our server.

You can get a copy of the standard contractual clauses on request at markus@explore-saudi.com. Beyond this we only pass on data where we are legally required to (e.g. to authorities in case of criminal offences, Art. 18 DSA).

You have the right to

• access to your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent given, with effect for the future (Art. 7(3) GDPR).

Do it yourself: in your account you can download all your data as a file (“Export data”) and delete your account with all games (“Delete account”). We block accounting data that we must keep by law until the retention period ends.

Complaint: you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: Information Commissioner's Office (ICO), United Kingdom.

playing.company is for ages 16 and up. Teenagers between 13 and 15 may use it with their parents’ consent. More information under youth protection.

We transmit all data encrypted (TLS) and protect it with technical and organisational measures under Art. 32 GDPR. If our services change, we update this policy; the current version is always here.