PlayfinityOS Privacy Policy & Global Data Protection Compliance (GDPR & CCPA)

PlayfinityOS is operated by Jalal Merzoug, an independent developer based in Spain (European Union), who acts as the Data Controller under the GDPR.

For any data protection inquiries, access requests, or to exercise your statutory privacy rights, you may contact our designated Data Protection team at:

• Data Protection & Privacy Email: [email protected]

• Legal & Compliance: [email protected]

• General Support: [email protected]

• Postal Address: PlayfinityOS Data Protection Officer, Jalal Merzoug, Spain (EU).

We collect only the minimum operational data necessary to operate our service, manage accounts, issue software licenses, and prevent fraud:

• Account Information: Full name, email address, cryptographic password hash (salted and hashed using modern algorithms), account creation timestamp, and email verification status.

• OAuth Authentication Data: When you sign in via Google Sign-In, we receive your Google ID token and verified email address. We do not access your Google contacts, Google Drive files, or any other private Google account resources.

• Licensing & Hardware Telemetry: Cryptographic Hardware Identifier (HWID - a one-way hashed digest of system components), machine nickname, operating system version, active device count, license tier, and activation timestamps required to enforce device seat limits.

• Transaction Records: Stripe customer IDs, checkout session IDs, invoice identifiers, tier purchased, and purchase timestamps. PlayfinityOS never collects, processes, or stores your full credit card number, expiration date, or CVV code; all card data is handled exclusively by Stripe.

• STRICT LOCAL DATA GUARANTEE: PlayfinityOS is a desktop-first application. It NEVER reads, uploads, or transmits your personal files, documents, photos, browser history, game save files, executable game binaries, chat messages, or directory paths outside of the configured game library roots.

PlayfinityOS may collect anonymized or pseudonymous diagnostic metrics to identify crashes and improve game detection across diverse PC hardware configurations.

Diagnostic metrics may include: CPU model, GPU model and driver version, system RAM total, display resolution/scaling, WebView2 runtime version, app start/exit timestamps, crash stack traces, and aggregated game scan counts (e.g. 'detected 42 games from Steam').

We do not transmit game titles, save files, or custom scripts during automated error logging. Raw crash traces are automatically purged on a rolling 30-day lifecycle.

We process your personal data strictly in accordance with Article 6 of the EU General Data Protection Regulation (GDPR):

• Performance of a Contract (Art. 6(1)(b)): To create your account, deliver purchased licenses, authenticate desktop sign-ins, and manage device activations.

• Legitimate Interests (Art. 6(1)(f)): To detect and prevent license piracy, secure our backend APIs against DDoS/brute-force attacks, debug crashes, and optimize desktop app performance.

• Legal Obligations (Art. 6(1)(c)): To comply with statutory accounting, tax reporting, and commercial invoice retention mandates under Spanish and EU law.

• Consent (Art. 6(1)(a)): Where you explicitly opt in to non-essential cookies, newsletter updates, or optional community features.

We share data only with vetted third-party sub-processors necessary to deliver our services:

• Payment Processing: Stripe, Inc. (PCI-DSS Level 1 certified payment infrastructure).

• Cloud Hosting & CDN: Cloudflare, Inc. and VPS hosting providers (for DDoS protection, SSL/TLS termination, and fast asset delivery).

• Transactional Emails: Resend / enterprise SMTP providers (strictly for sending password resets, verification codes, and license receipts).

• Authentication: Google Identity Services (optional OAuth login).

All sub-processors are bound by strict Data Processing Agreements (DPAs) incorporating standard contractual clauses (SCCs) to ensure compliant data handling.

Your data is primarily stored and processed within servers located in the European Union. Where transfers to third-party sub-processors outside the EEA occur (such as the US), they are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission and the EU-U.S. Data Privacy Framework.

We employ industry-leading security controls: TLS 1.3 encryption for all data in transit, AES-256 encryption for sensitive data at rest, salted password hashing, rate-limiting, and strict least-privilege administrative access.

Under Articles 15 through 22 of the GDPR and UK Data Protection Act 2018, you possess the following rights regarding your personal data:

• Right of Access (Art. 15): Request a copy of all personal data we hold about you.

• Right to Rectification (Art. 16): Correct inaccurate, out-of-date, or incomplete data.

• Right to Erasure / 'Right to be Forgotten' (Art. 17): Request permanent deletion of your account and personal data (subject to mandatory tax retention periods).

• Right to Restriction of Processing (Art. 18): Limit how we process your personal data under specific conditions.

• Right to Data Portability (Art. 20): Obtain your data in a structured, commonly used, machine-readable format (JSON/CSV).

• Right to Object (Art. 21): Object to processing based on legitimate interests.

To exercise any of these rights, email [email protected]. We respond to all verified requests within thirty (30) calendar days free of charge.

You also have the right to lodge a complaint with a competent supervisory authority, such as the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD) or your local EU/EEA national regulator.

Under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.):

• We DO NOT sell your personal information to third parties.

• We DO NOT share your personal information for cross-context behavioral advertising.

• California consumers have the Right to Know the categories and specific pieces of personal information collected, the Right to Delete personal information, the Right to Correct inaccurate data, and the Right to Non-Discrimination for exercising CCPA rights.

To exercise your California privacy rights, submit a request to [email protected] with 'CCPA Request' in the subject line.

Account & License Data: Retained for the active lifespan of your account to facilitate license validation, device transfers, and software updates. Upon account deletion, identifiers are expunged within 30 days.

Financial & Transaction Records: Retained for a minimum of 6 to 7 years in compliance with statutory Spanish and EU tax and commercial law obligations.

Diagnostic & Crash Logs: Automatically deleted or anonymized on a rolling 30-day retention schedule.

PlayfinityOS is not directed toward children under 13 years of age (or under 16 in the EU/EEA). We do not knowingly collect personal information from children.

If we become aware that a child has provided us with personal data without parental consent, we will take immediate steps to delete such information and deactivate the account.