Privacy Policy & GDPR Statement
Personal data processing, security, and cookie policies of Albion Craft Companion
§ 1. Data Controller
The Data Controller of your personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) is the operator of Albion Craft Companion (hereinafter: 'Controller' or 'Service').
For inquiries concerning data protection, exercising your GDPR rights, or this Privacy Policy, contact us at: spatest221@gmail.com.
The Controller exercises utmost diligence to safeguard user privacy, maintaining industry-standard cryptographic protection (including full TLS/SSL encryption across all network communication).
§ 2. Scope of Collected Data and Purposes of Processing
The Service only processes personal data strictly necessary to provide digital services, secure authentication, and enable calculators and economic tools:
- Email & Password registration: we process your email address and a cryptographic password hash (generated via Supabase Auth using bcrypt/argon2; the Controller cannot access your plaintext password) under Art. 6(1)(b) GDPR to maintain your Account.
- Google OAuth 2.0: when using Sign in with Google, we retrieve only your public Google user identifier (sub ID), verified email address, and public profile name under Art. 6(1)(b) GDPR. The Service does not request or access your Gmail messages, Google Drive files, or contacts.
- Discord OAuth 2.0: when connecting via Discord, we receive your Discord ID, username, and guild role status on our official Discord server to verify PRO access eligibility under Art. 6(1)(b) GDPR.
- Order fulfillment & PRO digital content: voucher activation records and transaction metadata are processed to perform the agreement (Art. 6(1)(b) GDPR) and comply with statutory accounting requirements (Art. 6(1)(c) GDPR).
- Security and telemetry: IP addresses, session timestamps, and Origin headers are inspected to prevent CSRF attacks, abuse, and malicious bots under our legitimate interest (Art. 6(1)(f) GDPR).
§ 3. Data Recipients and International Transfers
Personal data is shared solely with trusted infrastructure service providers essential for platform operations:
1. Supabase Inc. – database and authentication engine, hosted in an AWS data center in Frankfurt am Main (Germany, European Union).
2. Vercel Inc. – cloud hosting and global edge delivery network.
3. Google LLC – handling Google OAuth sign-in authentication (under the EU-U.S. Data Privacy Framework).
4. Discord Inc. – handling Discord OAuth authentication.
The Controller never sells, leases, or provides your personal data to third parties for advertising or marketing purposes.
§ 5. Your Rights Under GDPR
Under the General Data Protection Regulation, every user possesses the following rights:
- Right of access (Art. 15 GDPR) and to obtain a copy of your personal data.
- Right to rectification of inaccurate personal data (Art. 16 GDPR).
- Right to erasure ('right to be forgotten', Art. 17 GDPR) – deleting your account permanently removes your profile and associated data from our database.
- Right to restriction of processing (Art. 18 GDPR).
- Right to data portability in a machine-readable format (Art. 20 GDPR).
- Right to object to processing (Art. 21 GDPR).
- Right to lodge a complaint with a supervisory authority (in Poland: Prezes Urzędu Ochrony Danych Osobowych - PUODO, ul. Stawki 2, 00-193 Warsaw, Poland).
§ 6. Data Retention Period
Personal data associated with your user account is retained for as long as your account remains active.
Upon account deletion, personal data is permanently purged within 30 days, unless statutory obligations (such as tax and accounting regulations) mandate retention of transaction history for 5 years.