Privacy Policy

Last updated: 28 March 2026

1. Who We Are

RPLudus is a roleplaying community and marketplace based in Europe. We connect tabletop roleplayers, facilitate community building, and mediate transactions between users — including the buying and selling of game-related products and services.

For GDPR purposes, RPLudus is the data controller. Our contact email for privacy matters is privacy@rpludus.com.

2. Data We Collect

We collect the following categories of personal data:

Account data — email address, username, password (hashed), and profile information you provide
Profile data — biography, avatar, game preferences, tags, and other content you publish
Communications— messages sent through the platform's chat system
Transaction data — records of marketplace transactions mediated through RPLudus
Technical data — IP address, browser type, and device information collected automatically
Usage data — pages visited and features used (only when analytics consent is given)

3. Legal Basis

Under Article 6 of the GDPR, we process your personal data on the following bases:

Contract performance — to provide you with the RPLudus platform, manage your account, and mediate marketplace transactions
Consent — for optional analytics and marketing cookies, which you may withdraw at any time
Legitimate interest — to maintain platform security, prevent abuse, and improve our services
Legal obligation — to comply with applicable EU law, including tax obligations for marketplace transactions

4. How We Use Your Data

To provide and maintain the RPLudus platform
To authenticate your identity and manage sessions (via Supabase)
To enable communication between users
To mediate and record marketplace transactions
To send notifications about platform activity relevant to you
To detect and prevent fraud, abuse, or security threats
To improve the platform based on aggregated, anonymised usage patterns

5. Data Processors

We use the following third-party services to operate RPLudus:

Supabase — authentication, database, and file storage (hosted in the EU)
Vercel — website hosting and deployment

All processors are bound by data processing agreements and comply with GDPR requirements.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will erase your personal data within 30 days, except where retention is required by law (e.g. transaction records for tax compliance, retained for up to 10 years as required by applicable EU member state law).

7. International Data Transfers

We strive to keep your data within the European Economic Area (EEA). Where data is processed outside the EEA (e.g. Vercel edge functions), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

8. Your Rights

Under the GDPR and applicable EU data protection law, you have the right to:

Access your personal data
Rectify inaccurate or incomplete data
Eraseyour data (“right to be forgotten”)
Restrict processing of your data
Port your data to another service in a structured, machine-readable format
Object to processing based on legitimate interest
Withdraw consent at any time for consent-based processing

To exercise any of these rights, contact us at privacy@rpludus.com. We will respond within 30 days.

9. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local EU Data Protection Authority. A list of EU supervisory authorities can be found on the European Data Protection Board website.

10. Cookies

For details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the platform. The “last updated” date at the top of this page indicates when this policy was last revised.