Privacy Policy
Last updated: April 2026 · Version 2026-04
1. Data Controller
Guiltless Arcade is the data controller for your personal information.
Email: chris@guiltlessarcade.com
2. What We Collect, Why, and Our Lawful Basis
Under UK GDPR, we must have a lawful basis for processing your personal data. Here is a detailed breakdown:
| Data | Purpose | Lawful Basis | Retention |
|---|---|---|---|
| Name, email, profile picture | Account creation & identification | Contract (Art. 6(1)(b)) | Until account deletion |
| Government-issued ID | Age verification (18+) | Legal obligation (Art. 6(1)(c)) | Not stored — processed by Stripe Identity |
| Payment card details | Credit purchases | Contract (Art. 6(1)(b)) | Not stored — processed by Stripe |
| Game scores & statistics | Competition operation | Contract (Art. 6(1)(b)) | Until account deletion |
| Prize & financial records | Tax/regulatory compliance | Legal obligation (Art. 6(1)(c)) | 6 years (anonymised on account deletion) |
| Session tokens | Authentication | Legitimate interest (Art. 6(1)(f)) | 7 days (auto-expire) |
| Push notification tokens | Sending notifications | Consent (Art. 6(1)(a)) | Until consent withdrawn |
| IP address | Security & fraud prevention | Legitimate interest (Art. 6(1)(f)) | 90 days |
| Email address | Transactional emails (wins, refunds) | Contract (Art. 6(1)(b)) | Until account deletion |
3. Third-Party Data Processors
We share specific data with the following processors, all of which are GDPR-compliant:
| Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Stripe (Payments) | Payment processing & Connect payouts | Payment card, email, bank details | USA (EU SCCs) |
| Stripe Identity | Age verification only | Government ID (not stored by us) | USA (EU SCCs) |
| Google OAuth | Authentication | Name, email, profile picture | USA (EU SCCs) |
| Resend | Transactional emails | Email address, name | USA (EU SCCs) |
| MongoDB Atlas | Database hosting | All stored data (encrypted) | EU/UK |
We have Data Processing Agreements (DPAs) in place with all processors. All US-based processors use EU Standard Contractual Clauses (SCCs) for international data transfers.
4. Your Rights Under UK GDPR
You have the following rights, all of which are available in your Profile > Your Data & Privacy section:
Right of Access (Art. 15) — Download all your personal data at any time using the "Download My Data" button.
Right to Rectification (Art. 16) — Update your display name and profile information in your Profile settings.
Right to Erasure (Art. 17) — Permanently delete your account using the "Delete My Account" button. Financial records are anonymised and retained for legal compliance.
Right to Restrict Processing (Art. 18) — Contact us to restrict processing of your data while we resolve any dispute.
Right to Data Portability (Art. 20) — Your data export is provided in machine-readable JSON format.
Right to Object (Art. 21) — Contact us to object to processing based on legitimate interests.
Right to Withdraw Consent — Withdraw push notification consent at any time in Profile settings. Disable cookie consent by clearing your browser data.
To exercise any right, use the in-app tools or contact chris@guiltlessarcade.com. We will respond within 30 days.
5. Data Retention Schedule
| Data | Purpose | Lawful Basis | Retention |
|---|---|---|---|
| Account data | Active account + 30 days after deletion | Deleted | |
| Game scores | Active account duration | Anonymised on deletion | |
| Financial records | 6 years from transaction date | Anonymised (legal requirement) | |
| Session tokens | 7 days | Auto-deleted | |
| Push subscriptions | Until consent withdrawn | Deleted | |
| Consent records | 6 years (audit trail) | Retained anonymised | |
| Support communications | 2 years | Deleted |
6. Cookies
We use essential cookies only:
| Data | Purpose | Lawful Basis | Retention |
|---|---|---|---|
| session_token | Authentication | Essential | 7 days |
| ga_cookie_consent | Remember cookie choice | Essential | Persistent |
| ga_push_prompt_dismissed | Remember notification choice | Essential | 7 days |
We do not use analytics, advertising, or third-party tracking cookies. No consent is required for essential cookies under UK PECR, but we inform you as a matter of transparency.
7. Security Measures
We implement appropriate technical and organisational measures to protect your data:
- All data transmitted over HTTPS/TLS
- No passwords stored (Google OAuth only)
- Payment data processed by PCI-DSS Level 1 compliant Stripe
- ID documents processed by Stripe Identity — never stored on our servers
- Database access restricted to authorised services only
- Regular security reviews and dependency updates
8. Children
Guiltless Arcade is for users aged 18 and over only. We do not knowingly collect data from anyone under 18. If we become aware that a user is under 18, their account will be suspended and data deleted.
9. Data Breach Notification
In the event of a personal data breach, we will notify the Information Commissioner's Office (ICO) within 72 hours where required. Affected users will be notified without undue delay if the breach poses a high risk to their rights.
10. Changes to This Policy
Material changes will be communicated via email and in-app notification. The version number and date at the top of this page will be updated. You may be asked to re-consent if changes affect the basis of processing.
11. Complaints
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Or contact us first at chris@guiltlessarcade.com — we want to resolve your concerns directly.