Privacy Policy

Last updated: 26 September 2026

1. Who We Are

RPLudus is a roleplaying community and marketplace based in Europe. We connect tabletop roleplayers, facilitate community building, and mediate transactions between users — including the buying and selling of game-related products and services.

For GDPR purposes, RPLudus is the data controller. Our contact email for privacy matters is privacy@rpludus.com.

2. Data We Collect

We collect the following categories of personal data:

Account data — email address, username, password (hashed), and profile information you provide
Profile data — biography, avatar, game preferences, tags, and other content you publish
Communications — messages sent through the platform's chat system
Transaction data — records of marketplace transactions mediated through RPLudus
Technical data — IP address, browser type, and device information collected automatically
Usage data — pages visited, features used, page speed and replays of individual visits (only when analytics consent is given)
Error and performance data — when something breaks in your browser, an error report (the error, the page address, your browser and device type, and the steps just before it); timing data for about 1 in 10 page loads; and a short record, for each page you view, of whether an error happened. These are sent to Sentry, our error-monitoring provider, without asking for analytics consent, because we need them to keep RPLudus working and secure (legitimate interest). They do not include your cookies, your name or your email address. If you are signed in, almost all of them are tagged with your account ID (the random code that identifies your account). See the Cookie Policy for how to object.

3. Legal Basis

Under Article 6 of the GDPR, we process your personal data on the following bases:

Contract performance — to provide you with the RPLudus platform, manage your account, and mediate marketplace transactions
Consent — for optional analytics and marketing cookies, which you may withdraw at any time
Legitimate interest — to maintain platform security, prevent abuse, find and fix errors (error monitoring), and improve our services
Legal obligation — to comply with applicable EU law, including tax obligations for marketplace transactions

4. How We Use Your Data

To provide and maintain the RPLudus platform
To authenticate your identity and manage sessions (via Supabase)
To enable communication between users
To mediate and record marketplace transactions
To send notifications about platform activity relevant to you
To detect and prevent fraud, abuse, or security threats
To find and fix faults and slow pages, using error and performance data, and, if you consent to analytics, usage statistics and replays of individual visits. Error reports and replays each describe a single visit and do not include your name or email address. If you are signed in they are tagged with your account ID, so they are not anonymous

5. Data Processors

We use the following third-party services to operate RPLudus:

Supabase — authentication, database, and file storage (hosted in the EU)
Vercel — website hosting and deployment
Sentry — error and performance monitoring, and session replays if you consent to analytics (data stored in its EU region, Germany)

All processors are bound by data processing agreements and comply with GDPR requirements.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will erase your personal data within 30 days, except where retention is required by law (e.g. transaction records for tax compliance, retained for up to 10 years as required by applicable EU member state law).

Error reports, performance data and session replays are kept by Sentry for the retention period set for our Sentry account. Page speed measurements are kept in the logs of our hosting provider, Vercel, for its log retention period, and Vercel keeps Web Analytics data for that service’s retention period.

7. International Data Transfers

We strive to keep your data within the European Economic Area (EEA). Where data is processed outside the EEA (e.g. Vercel edge functions), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

8. Your Rights

Under the GDPR and applicable EU data protection law, you have the right to:

Access your personal data
Rectify inaccurate or incomplete data
Erase your data (“right to be forgotten”)
Restrict processing of your data
Port your data to another service in a structured, machine-readable format
Object to processing based on legitimate interest
Withdraw consent at any time for consent-based processing

To exercise any of these rights, contact us at privacy@rpludus.com. We will respond within 30 days.

9. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local EU Data Protection Authority. A list of EU supervisory authorities can be found on the European Data Protection Board website.

10. Cookies

For details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the platform. The “last updated” date at the top of this page indicates when this policy was last revised.