1. Data controller
- Controller: Álvaro Domínguez Gómez
- Tax ID (NIF): 47313162T
- Address: Avenida Juan XXIII, 34, Málaga (Málaga), Spain
- Privacy contact: alvarodominguezgomez@gmail.com
2. What data we process
If you play without an account:
- The messages you type or dictate in the challenge and the character's replies.
- If you use voice, the audio is sent for transcription and we do not keep it: we only store the resulting text.
- A technical game identifier and a cookie that links the game to your browser.
- Your IP address, irreversibly encrypted (hashed), to limit usage and prevent abuse. We never store your IP in clear text.
- Your progress in today's challenge, stored in your own browser.
If you create a free account, also:
- Email, display name, language, time zone and password. The password is stored encrypted by the authentication system and we never see it.
- Your games, streak and statistics, and your daily reminder preferences (time and time zone).
- A record of your acceptance of the terms (version, date and encrypted IP).
If you subscribe, also:
- Subscription data: status, dates and Stripe customer and subscription identifiers. Your card details are handled directly by Stripe; we never see them.
- A record of your request for the subscription to start immediately (version, date and encrypted IP).
If you write to us: your email and whatever you tell us.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the game, the account, history and statistics | Performance of the service you request (Art. 6(1)(b) GDPR) |
| Security, usage limits and abuse detection | Legitimate interest in protecting the service and its costs (Art. 6(1)(f)) |
| Answering your enquiries and requests to exercise your rights | Your request and legal obligation (Arts. 6(1)(b) and 6(1)(c)) |
We do not use your data for advertising and we do not sell it.
4. Artificial intelligence
Your messages are sent to an AI model provider to generate the character's replies, assess the challenge goals and detect nonsense or off-topic messages. If a game played without an account accumulates such messages, it may end automatically. This assessment has no legal effects and does not significantly affect you. Do not enter real personal data or confidential information in the game: the characters and companies are fictional.
5. Recipients and processors
We do not share your data with third parties unless required by law. To provide the service we rely on providers that process data on our behalf:
- Lovable and its cloud infrastructure: website hosting, database, authentication and anonymous visit measurement (see the cookie policy).
- Stripe: payments and subscriptions.
- Resend: email delivery.
- AI model provider (Google, Gemini models, through Lovable's AI gateway): character replies and voice transcription.
Some of these providers may process data outside the European Economic Area (for example, in the USA). In those cases, transfers are covered by European Commission adequacy decisions (such as the EU-US Data Privacy Framework) or by standard contractual clauses.
6. How long we keep it
- Account data: for as long as you keep your account. If you ask us to delete it, we delete your account and all associated data.
- Billing data: for as long as tax and commercial law requires (generally up to 6 years).
- Games played without an account: up to 12 months; they are then deleted automatically.
- IP-based usage records (encrypted): up to 7 days.
- Accounts that never confirm their email: deleted automatically 7 days after the last confirmation email.
7. Minors
You must be at least 14 to play without an account or create a free account, and 18 or older to subscribe. If we detect data from a child under 14, we will delete it.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to alvarodominguezgomez@gmail.com and stating which right you wish to exercise. We will reply within one month. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Security
We apply appropriate technical and organisational measures: encrypted connections, restricted database access, encrypted passwords and IPs stored only in encrypted form.
10. Changes
If we change this policy in a significant way, we will let you know on the website or by email.
11. Waiting list
The controller is Álvaro Domínguez Gómez, whose details appear in section 1. You can contact us by email at alvarodominguezgomez@gmail.com.
If you join the waiting list, we process your email, language, visit source and consent record to notify you of news and the relaunch of Sales Level. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to the contact email.
We keep this data until you ask to unsubscribe or the project closes permanently. The providers involved are those providing website hosting and the website database, processing the data on our behalf.
You can exercise your rights of access, rectification, erasure and objection by writing to the contact email above. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).