The personal information that we collect depends on the context of your interactions with us and our Services, the choices you make, and the features that you use. When you register an account, we collect and store the following information that you provide to us:

Email address

Password

This personal information is never exposed or otherwise made visible to other users of our platform.

When completing the Proudheart Questionnaire or editing your profile, you may provide additional personal information that we collect and store. All of this information is completely optional and is not required to use the core features of our Services; however some minor features may be unusable and/or your experience using our Services may not be as engaging if you do not provide us with this information. This optional information includes the following:

Geolocation data

First and/or last name

Pronouns

Country

Time zone

Date of birth

Languages

About section

Unlike with your provided email address and password, all of this optional information can be made visible to other users of our platform, with some notable exceptions and properties.

Geolocation data is used to calculate the distance between yourself and other users, but your sensitive geolocation data (i.e coordinates) is never exposed to other users, only the calculated distance is.

For your provided name and pronouns, you have the ability to specify which category of users are allowed to see this information. These categories of users include everyone, only your friends, and no one. If you provide your name and/or pronouns but do not specify which users they are made visible to, then the visibility of this information is set to “no one” by default.

Additionally, the geolocation data that we collect is not directly provided by you, but is rather collected from your browser. You must, however, give your explicit permission to allow for us to access your geolocation data through your browser. You will be prompted to do so when attempting to access features which utilize geolocation data, if you haven’t already either accepted or denied this request.

When creating a game, there is additional personal information that must be provided by you before the game can be created. Although this information technically pertains only to the game that you are creating and not to you or your profile, it can be assumed that as the game master of the game, the personal information pertaining to the game would pertain to you as well by association. This optional information includes the following:

Geolocation data

Country

Time zone

Languages

With the exception of geolocation data, all of this information is required and is made visible to other users who are able to view your created games’ information. The same exceptions and behavior properties for geolocation data, as specified above for user profiles, applies to games as well.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To provide, maintain, and improve our Services.

To detect, prevent, and address fraud, security issues, or technical issues. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.

To meet our compliance obligations and/or legal obligations. We may process your information to comply with applicable laws and other authorities that we are subject to.

To protect our rights and interests, and those of our users. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

To conduct research and analysis. We may process information about how you use our Services to better understand our users and improve our Services.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

Consent: We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time.

Performance of a Contract: We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.

• Legitimate Interests: We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to:

  Analyze how our Services are used so we can improve them to engage and retain users.

  Diagnose problems and/or prevent fraudulent activities.

  Understand how our users use our products and services so we can improve user experience.

Legal Obligations: Legal Obligations: We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.

Vital Interests: We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

We will only process your personal data when we have a legal basis to do so, and we will always respect your rights and choices regarding your information. If you have any concerns about our legal bases for processing, please contact us using the information provided at the beginning of our Privacy Policy.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way.

For investigations and fraud detection and prevention.

For business transactions provided certain conditions are met.

If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim.

For identifying injured, ill, or deceased persons and communicating with next of kin.

If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse.

If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.

If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records.

If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced.

If the collection is solely for journalistic, artistic, or literary purposes.

If the information is publicly available and is specified by the regulations.

In some regions (like the European Economic Area (EEA), United Kingdom (UK), and Canada), you have certain rights under applicable data protection laws regarding your personal data. These rights may include:

Access: You can request a copy of the personal data we hold about you.

Rectification: You can ask us to correct any inaccurate or incomplete personal data we hold about you.

Erasure: You can request that we delete your personal data in certain circumstances, such as when it’s no longer necessary for the purposes for which it was collected.

Restriction of processing: You can ask us to restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

Data portability: You can request a copy of your personal data in a structured, commonly used, and machine-readable format, and ask that we transfer it to another controller.

Object: You can object to the processing of your personal data for certain purposes, such as direct marketing.

Withdraw consent: If we are processing your personal data based on your consent, you can withdraw that consent at any time.

Not be subject to automated decision-making: Not be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

We may need to share your personal information in the following situations:

Users: Depending on what optional personal information you choose to provide to us and for some information, what visibility preferences you assign to it, other users on our platform may be able to view your personal information. This personal information may include your first and/or last name, pronouns, country, time zone, age, languages, and any information described in your “About” section.

Database Provider: We use services provided by our database hosting provider to store your personal information on servers owned and operated by our database provider. This information is stored securely and cannot be accessed by anyone but us.

Law Enforcement: We may share your information with law enforcement, government authorities, or other third parties when required by law or when necessary to protect our rights or the rights of others.

Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

We do not sell your data to third parties under any circumstances.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. These security measures include:

Database Provider: Our database provider ensures that any information, personal or otherwise, that our database provider either stores or transports is encrypted at rest using AES-256 encryption and during transit using Transport Layer Security (TLS) encryption.

Password Hashing: Before they are stored in our database, we hash your passwords so that even if our security is breached and your passwords are stolen by nefarious third parties, your passwords remain inaccessible.

Sanitized Client: Before any information about you is sent from the server to the client of other users, your personal information is sanitized so that it is never sent to other users unless they have the correct visibility permissions for some of that personal information to be made visible to them.

Access Controls: We have strict and robust server-side authentication and authorization measures to establish access controls for what actions users are and are not able to perform, and what information they are and are not able to store or retrieve.

It is important to keep in mind that despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access our Services within a secure environment.