Privacy Policy

This Privacy Policy explains how BattleStudio ("BattleStudio", "we", "us") collects, uses, and protects personal data when you use battlestudio.gg and the BattleStudio army builder (the "Service"), in accordance with the EU General Data Protection Regulation (GDPR) and applicable national implementing laws, including the Italian Data Protection Code.

1. Who we are

The data controller responsible for your personal data is BattleStudio. For any privacy question or request, contact us at hello@battlestudio.gg. We have not appointed a Data Protection Officer, as this is not currently required for our scale of processing.

2. What data we collect

2.1 If you never create an account

You can use the army builder fully without an account. Your army lists and folders are stored only in your browser's local storage and are never sent to our servers. We do not collect any personal data from you in this mode.

2.2 If you create an account

• Account identity: your email address and, if you use it, an authentication identifier from Google or Apple Sign-In. Passwords are hashed and managed by our authentication provider (Supabase) — we never see or store your password in plain text.
• Army list content: the lists, folders, faction/unit selections, and point totals you choose to save to your account, so they sync across your devices.
• Marketing preference: if you opt in, a flag recording that you would like to receive occasional product update emails, and the date you gave that consent (see Section 4).

2.3 If you contact us directly

If you send a bug report or a support request by email, we receive whatever information you choose to include (e.g. your email address, a description of the issue, and technical context about the army list you were building). This is sent via your own email client and is not otherwise logged by the Service.

We do not use analytics, advertising, or tracking cookies. See our Cookie Policy for details.

3. Why we process your data, and on what legal basis

• Providing your account and cloud sync (storing and retrieving your army lists across devices) — necessary to perform our contract with you (GDPR Art. 6(1)(b)).
• Sending you occasional product update emails (new features, new factions, important changes) — based on your freely given, specific consent (GDPR Art. 6(1)(a)). We never send these emails unless you have actively opted in.
• Responding to support requests and bug reports you send us — our legitimate interest in operating and improving the Service (GDPR Art. 6(1)(f)), balanced against your rights.
• Keeping the Service secure and preventing abuse — our legitimate interest in the integrity and security of the Service (GDPR Art. 6(1)(f)).

4. Marketing emails

We only send product update emails to accounts that have explicitly opted in via an unticked checkbox, separate from any other agreement. You can withdraw this consent at any time from your account page, or via the unsubscribe link included in every marketing email, with no effect on your ability to use the Service.

5. Who we share data with

We use the following processors to run the Service on our behalf, under data processing agreements that require them to protect your data in line with GDPR:

• Supabase — authentication and database hosting for account data and cloud-synced army lists.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

6. International data transfers

Our infrastructure providers may process data outside the European Economic Area. Where this occurs, we rely on appropriate safeguards recognised under GDPR, such as the European Commission's Standard Contractual Clauses, as provided by our processors' data processing agreements.

7. How long we keep your data

• Account and army list data: for as long as your account is active, plus a reasonable period after deletion to complete removal from backups.
• Locally saved lists (no account): kept only on your device until you clear them or your browser storage is cleared.
• Marketing consent: until you unsubscribe or delete your account.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request erasure of your data ("right to be forgotten");
• Restrict or object to certain processing;
• Receive your army list data in a portable format (available today via the builder's export feature);
• Withdraw consent at any time, without affecting processing carried out before withdrawal;
• Lodge a complaint with your national data protection supervisory authority — for example, the Italian Garante per la protezione dei dati personali (garanteprivacy.it), or the authority in your own EU country of residence.

To exercise any of these rights, email hello@battlestudio.gg. We will respond within one month, as required by GDPR Art. 12.

9. Children

The Service is not directed at children under 16. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify account holders directly.