Privacy policy
Effective date: 2026-05-10
This Privacy Policy explains what data is processed in BoardConquest and why. The service terms are available at Terms of service.
1. Controller and contact
The controller is Dawid Sugajski, acting as the owner of the BoardConquest SaaS application as an unregistered sole activity. Contact for privacy, account and technical support matters: admin@boardconquest.com.
2. Data we process
- account data: e-mail address, password hash, nickname, privacy and newsletter settings,
- library data: game titles, metadata, covers, PDF rulebooks, language versions, favourites,
- AI data: questions, answers and context needed to search information in a rulebook,
- BoardGameGeek data if you start sync: BGG username, collection, game statuses, expansions, logged plays,
- planner data: meetings, invitations, invited e-mail addresses, votes, locations, scores, photos and play history,
- calendar integration data: identifiers and technical information needed for Google Calendar or ICS feeds,
- payment and subscription data received from Paddle, such as transaction ID, subscription status and plan,
- technical data: security logs, IP address, error information, necessary cookies and localStorage,
- analytics data and optional preferences — only after consent.
3. Purposes and legal bases
Account, library, AI, BGG, planner and subscription data is processed to perform the service contract — GDPR art. 6(1)(b). Data required by tax/accounting law is processed under art. 6(1)(c). Security logs and abuse prevention rely on legitimate interest — art. 6(1)(f). Newsletter, analytics and optional preferences are based on consent — art. 6(1)(a).
4. Recipients
Data may be shared with hosting, database, e-mail, AI, analytics, error monitoring and security providers. As part of AI features, PDF rulebook content and user prompts may be sent to external language-model providers (e.g., OpenAI or Anthropic) solely to generate answers and provide analysis functionality. Payments are handled by Paddle.com Market Ltd as Merchant of Record. BoardGameGeek receives data only when you start sync. Google receives data only when you enable calendar integration.
5. Paddle and payments
Our order process is conducted by Paddle.com. Paddle.com Market Ltd is the Merchant of Record for paid orders, collects payment, calculates taxes and issues purchase documents. BoardConquest receives from Paddle the information needed to activate and manage subscriptions, but does not store full payment card details.
6. Transfers outside the EEA
Some technology providers may process data outside the European Economic Area, in particular in the United States. In such cases, Standard Contractual Clauses or another GDPR-compliant transfer mechanism is used.
7. Retention
Account and content data is kept while the account exists and up to 12 months after deletion in backups and security logs. Billing data is kept for the period required by law. Newsletter data is kept until consent is withdrawn. Analytics data in pseudonymised form is kept for up to 24 months.
8. Cookies and localStorage
We use necessary cookies and localStorage for sign-in, CSRF protection and language preference. Optional cookies, analytics and preferences are used only after consent, which can be changed in the cookie banner or privacy settings.
9. Your rights
You have the right to access, rectify, erase, restrict processing, object, data portability and withdraw consent. You may also lodge a complaint with the Polish supervisory authority. Send requests to admin@boardconquest.com.
10. Automated decisions
BoardConquest does not use data for automated decisions producing legal effects for the user. AI features generate informational answers based on rulebooks and do not replace official game rules.
