WispXP
Draft — have this checked before launch. Parts in [brackets] still need to be filled in or confirmed.

Privacy

Plain language, no small print: what we keep, why, and what you can ask of us.

Version 0.2 (draft) · last updated [date]

  1. Who we are
  2. What we keep and why
  3. What stays on your PC
  4. Who helps us
  5. Outside the EU
  6. How long we keep it
  7. Cookies and fonts
  8. Security
  9. Your rights
  10. Age
  11. Changes

1. Who we are

WispXP (wispxp.com) is run by [business name], [address], the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under [KvK number]. We are the controller for the personal data described here. You can reach us at [contact e-mail].

2. What we keep and why

We only keep what we need to run your account, the app and Pro. We don't sell your data, we don't show ads, and we don't build profiles for marketing.

WhatWhyLegal basis
Account: your e-mail address, your password (stored only as a one-way hash, never readable), your language, when you signed up and last logged in.To give you an account, let you log in, and send you account e-mails (confirming your address, resetting your password, payment problems).Contract
Devices: a device ID (a hash of your Windows machine ID, not the ID itself), your PC's name, login times, and a sign-in token.To keep the app logged in, enforce the limit of 2 PCs per account, and let you see and remove your devices.Contract
Payments: your plan, your subscription status and end date, and the customer and subscription IDs Stripe gives us.To know whether you have Pro. Stripe handles the payment itself: we never see or store your card details.Contract; legal obligation (bookkeeping)
Security records: IP addresses and times of logins and failed attempts, and server logs.To protect accounts against guessing and misuse, and to fix errors.Legitimate interest (security)
Messages you send us: e-mails or support messages.To help you.Contract; legitimate interest

3. What stays on your PC

The addon's settings live on your PC, in the game's own saved files. The addon works everything out inside the game (your leveling plan, routes, Find and Dungeon Path): nothing from the game is sent to us. The app only contacts our server to log you in, to check your plan, and to check for updates; the update check sends nothing about you. [confirm]

4. Who helps us

A few companies process data for us, under a data processing agreement, and only for the purpose we use them for:

  • Stripe: payments, invoices and the subscription portal.
  • SendGrid (Twilio): sending account e-mails.
  • [hosting provider]: the server that runs wispxp.com, in [country].

5. Outside the EU

Stripe and SendGrid are based in the United States, so some data goes there. We rely on the EU–US Data Privacy Framework where the company is certified, and otherwise on the European Commission's standard contractual clauses. [confirm per processor]

6. How long we keep it

  • Account and devices: as long as you have an account. A removed device's token stops working at once.
  • Payment records: 7 years, because Dutch tax law requires it.
  • Security records and server logs: [30 days], longer only while we look into a specific incident.

When you delete your account we remove your data within 30 days, except what the law makes us keep.

7. Cookies and fonts

We use one cookie: a session cookie that keeps you logged in and protects forms against forgery. It's strictly necessary, so it doesn't need consent. No advertising or tracking cookies.

The site's fonts are hosted on our own server: your browser does not contact a font service.

8. Security

Passwords are stored with a strong one-way hash. All traffic uses HTTPS. Admin access needs two-factor authentication, and only the people who run WispXP can reach the data. If a breach puts your data at risk, we will tell you and the Dutch Data Protection Authority as the law requires.

9. Your rights

Under the GDPR you can ask us to:

  • show you what we keep about you, and give you a copy;
  • correct it, or delete it;
  • limit what we do with it, or object to processing based on our legitimate interest;
  • give you your data in a common format to take elsewhere.

Write to [contact e-mail] from the address on your account. We answer within one month. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or the authority in your own EU country.

10. Age

You need to be 16 or older to make an account.

11. Changes

If we change this policy in a way that matters, we'll e-mail you before it takes effect. The date at the top always shows the latest version.