Privacy policy

Controller

The controller of your data is ESEFLAB sp. z o.o., Jurcz 17, 59-330, Poland (KRS 0001261239, NIP 6922551757). For anything about personal data, write to privacy@eseflab.com or open a ticket in the game.

What data we process

Email address and password (stored as a hash by the login provider), month and year of birth, game data (character, look, horses, journals, messages to other players, forum posts and uploaded images), technical data (server logs, IP address at infrastructure providers), payment data (billing address and country — handled by the payment provider; we do not store card data) and the statements and consents you gave.

Purposes and legal bases

Providing the game, including emails about your horses and matters in the game (contract, Art. 6(1)(b) GDPR). Settling payments (legal obligation, (c)). Security, preventing abuse, moderating forum posts, handling tickets and pursuing claims (legitimate interest, (f)). News emails (consent, (a)) — only from people aged at least 16; you can withdraw consent in settings.

Month and year of birth are used only to check whether you can create an account (from 13) and whether you can agree to news emails (from 16). We do not profile players for marketing.

Who we share data with

Providers that process data on our behalf under data processing agreements: hosting and database (servers in the EU), login, file storage, bot protection, email delivery, application error monitoring (without data identifying players), the payment provider, automatic moderation of forum posts, and providers of AI models used by the game's automated processes. If you sign in with Google, Google gives us your email address.

Private messages are not sent to automatic moderation — they reach our support only if someone reports them. We use AI providers through their business services, where the data we send is not used to train models.

Some providers are based outside the European Economic Area (mainly in the USA). Such transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.

How long

Account data — until the account is deleted. Deletion: 14 days after the request we delete identifying data; messages kept by the people you talked to, results and the transaction ledger remain, signed as “Former player”. Proof of payment — 5 years (tax and accounting obligation).

For 90 days after an account is deleted we keep a cryptographic hash of its email address, computed with a secret key, only so that a new account cannot be created straight away for another starter pack (legitimate interest). The address itself is not stored, but the hash is still pseudonymised data; after 90 days it stops working.

Your rights

You have the right to access your data and get a copy (on request through a ticket in the game or privacy@eseflab.com), to rectification, erasure (Settings → Delete account), restriction, portability, to object to processing based on legitimate interest and to withdraw consent at any time. You can also lodge a complaint with the President of the Personal Data Protection Office (UODO) or the authority in your country.

Cookies and browser storage

We use only strictly necessary ones: login session cookies, short-lived registration cookies (chosen look, consents) and browser storage for your settings (e.g. country for prices). We do not use tracking or advertising cookies.

Children

You can create an account if you are at least 13 years old. We do not collect consent to news emails from people under 16. A parent or guardian can write to privacy@eseflab.com to get information about a child's data or to delete the child's account.