Privacy Policy

1. Who we are

Flaks Tech AS is the data controller for personal data processed in connection with our services, including Flaksorama.

We have assessed whether we need a Data Protection Officer (DPO) and concluded that it is not required for our type of business. Privacy questions can be directed to support@flaksorama.com.

2. Who this applies to

This declaration applies to everyone using Flaks Tech AS services:

• Account holders – those who create an account and purchase access
• Players – those who participate in games without having an account
• Visitors – anyone who visits our websites

Players do not need to provide personal information to participate. The only information we collect is the nickname they choose themselves, their position on the board, and technical logs for security purposes. Organizers only see nicknames and board positions – not IP addresses or other technical information.

3. What we collect

It depends on how you use the service:

If you create an account:

• Name and email address
• Password – stored encrypted, we cannot read it
• Purchase history (amount, date, product – not card details)
• IP address, device info and login history

If you play without an account:

• Nickname you choose yourself
• Board positions and results
• IP address (for security only – not visible to organizer)

Payment:

Card information is handled exclusively by Stripe Technology Europe Ltd. We never see your card number. We only store the transaction ID, amount and date for accounting purposes.

4. Why and on what legal basis

We process your data for the following purposes and on the following legal bases:

• Account information

  Why

  Provide the service, authentication

  Basis

  Contract – art. 6(1)(b)

• Purchase history

  Why

  Support, invoicing, accounting

  Basis

  Contract and legal obligation – art. 6(1)(b)/(c)

• IP address and security logs

  Why

  Prevent misuse and unauthorized access

  Basis

  Legitimate interest – art. 6(1)(f)

• Nicknames and board positions (players)

  Why

  Run games, display results

  Basis

  Legitimate interest – art. 6(1)(f)

• Analytics cookies

  Why

  Improve the service

  Basis

  Consent – art. 6(1)(a)

• Newsletter / marketing email

  Why

  Send product news and updates you ask for

  Basis

  Consent – art. 6(1)(a)

Where we use 'legitimate interest' as our basis, we have assessed that the security purpose outweighs the privacy impact – particularly because the data is deleted after short deadlines and is not used for other purposes. You may object to such processing, cf. GDPR art. 21.

5. How long we retain data

• Account data: as long as the account is active, then deleted within 30 days
• Security logs and IP addresses: max 90 days
• Visit logs: max 30 days
• Player data: anonymized within 30 days after the event is deleted
• Accounting data: 5 years after the end of the financial year (Bookkeeping Act § 13)
• Newsletter consent records: kept while you are subscribed and for up to 3 years after you unsubscribe, as proof of consent

If you delete your account yourself, we initiate the deletion process immediately. Everything that can be deleted is gone within 30 days.

6. Who we share with

We only share data with vendors we depend on to operate the service. We put data processing agreements in place with these processors in line with GDPR art. 28.

• Stripe Technology Europe Ltd

  What they do

  Payment processing

  Country

  EU/EEA (Ireland)

  Transfer

  Within EU/EEA

• Supabase, Inc.

  What they do

  Database and authentication

  Country

  USA (EU region)

  Transfer

  SCCs in place

• Vercel, Inc.

  What they do

  Frontend hosting and privacy-friendly analytics

  Country

  USA (EU region)

  Transfer

  SCCs in place

• Sendinblue SAS (Brevo)

  What they do

  Newsletter and transactional email

  Country

  EU/EEA (France)

  Transfer

  Within EU/EEA

• Functional Software, Inc. (Sentry)

  What they do

  Error logging and performance monitoring

  Country

  EU/EEA

  Transfer

  Within EU/EEA

• Proton AG (Proton Mail)

  What they do

  Transactional and contact-form email

  Country

  Switzerland

  Transfer

  Adequacy decision

Supabase and Vercel are American companies, but we use EU regions so that data is stored in Europe. The transfer to the USA is authorized through the EU's standard contractual clauses (SCCs). Stripe is Irish and keeps all payment data within the EU/EEA.

We never sell data to third parties and never share data for marketing purposes without your consent.

If you choose to sign in with Google, Google Ireland Ltd acts as an independent data controller for the sign-in, under its own privacy terms — not as our data processor. We only receive your name and email to create your account.

7. Cookies

We use two types of cookies:

• Necessary cookies – for login, security, language preferences, and the currency your prices are shown in. These cannot be turned off.
• Analytics cookies – privacy-friendly usage measurement via Vercel Analytics. These are not loaded until you give consent, and can be turned off at any time using the "Manage cookies" link in the footer.

We do not run analytics or any non-essential tracking before you consent. Error logging (Sentry) is configured to minimise personal data — IP collection and session recording are turned off.

8. Your rights

You have the right to:

• See what we have stored about you (access – art. 15)
• Correct errors in the information (art. 16)
• Ask us to delete what we have about you (art. 17)
• Limit what we can use the data for (art. 18)
• Have your data delivered in a machine-readable format (portability – art. 20)
• Object to processing based on legitimate interest (art. 21)
• Withdraw consent at any time (art. 7(3))

Send inquiries to support@flaksorama.com.

9. Complaints

Do you believe we are processing data incorrectly? Please contact us first at support@flaksorama.com. You can also complain directly to the Norwegian Data Protection Authority:

10. Changes

We update this declaration when our services change, or when required by law. We will notify you of material changes by email at least 30 days before they take effect. The current version is always available at flaksorama.com/privacy.