Privacy Policy

1. Who we are

Flaks Tech AS is the data controller for personal data processed in connection with our services, including Flaksorama.

We have assessed whether we need a Data Protection Officer (DPO) and concluded that it is not required for our type of business. Privacy questions can be directed to support@flaksorama.com.

2. Who this applies to

This declaration applies to everyone using Flaks Tech AS services:

• Account holders – those who create an account and purchase access
• Players – those who participate in games without having an account
• Visitors – anyone who visits our websites

Players do not need to provide personal information to participate. The only information we collect is the nickname they choose themselves, their score, and technical logs for security purposes. Organizers only see nicknames and scores – not IP addresses or other technical information.

3. What we collect

It depends on how you use the service:

If you create an account:

• Name and email address
• Password – stored encrypted, we cannot read it
• Purchase history (amount, date, product – not card details)
• IP address, device info and login history

If you play without an account:

• Nickname you choose yourself
• Scores and results
• IP address (for security only – not visible to organizer)

Payment:

Card information is handled exclusively by Stripe Technology Europe Ltd. We never see your card number. We only store the transaction ID, amount and date for accounting purposes.

4. Why and on what legal basis

We process your data for the following purposes and on the following legal bases:

Where we use 'legitimate interest' as our basis, we have assessed that the security purpose outweighs the privacy impact – particularly because the data is deleted after short deadlines and is not used for other purposes. You may object to such processing, cf. GDPR art. 21.

5. How long we retain data

• Account data: as long as the account is active, then deleted within 30 days
• Security logs and IP addresses: max 90 days
• Visit logs: max 30 days
• Player data: anonymized within 30 days after the event is deleted
• Accounting data: 5 years after the end of the financial year (Bookkeeping Act § 13)
• Newsletter consent records: kept while you are subscribed and for up to 3 years after you unsubscribe, as proof of consent

If you delete your account yourself, we initiate the deletion process immediately. Everything that can be deleted is gone within 30 days.

6. Who we share with

We only share data with vendors we depend on to operate the service. We put data processing agreements in place with these processors in line with GDPR art. 28.

Supabase and Vercel are American companies, but we use EU regions so that data is stored in Europe. The transfer to the USA is authorized through the EU's standard contractual clauses (SCCs). Stripe is Irish and keeps all payment data within the EU/EEA.

We never sell data to third parties and never share data for marketing purposes without your consent.

If you choose to sign in with Google, Google Ireland Ltd acts as an independent data controller for the sign-in, under its own privacy terms — not as our data processor. We only receive your name and email to create your account.

7. Cookies

We use two types of cookies:

• Necessary cookies – for login, security, and language preferences. These cannot be turned off.
• Analytics cookies – privacy-friendly usage measurement via Vercel Analytics. These are not loaded until you give consent, and can be turned off at any time using the "Manage cookies" link in the footer.

We do not run analytics or any non-essential tracking before you consent. Error logging (Sentry) is configured to minimise personal data — IP collection and session recording are turned off.

8. Your rights

You have the right to:

• See what we have stored about you (access – art. 15)
• Correct errors in the information (art. 16)
• Ask us to delete what we have about you (art. 17)
• Limit what we can use the data for (art. 18)
• Have your data delivered in a machine-readable format (portability – art. 20)
• Object to processing based on legitimate interest (art. 21)
• Withdraw consent at any time (art. 7(3))

Send inquiries to support@flaksorama.com. We respond within one month – free of charge.

9. Complaints

Do you believe we are processing data incorrectly? Please contact us first at support@flaksorama.com. You can also complain directly to the Norwegian Data Protection Authority:

10. Changes

We update this declaration when our services change, or when required by law. We will notify you of material changes by email at least 30 days before they take effect. The current version is always available at flaksorama.com/privacy.