Privacy notice
What DealCraft stores, why, where it lives and how long it stays. Two audiences: the business running a game, and the customer who plays one.
What we hold
Every record the product writes about a person, and nothing we do not write.
| Record | Why we hold it | How long |
|---|---|---|
| Business owner account: name, email address, a scrypt hash of your password, whether the address is confirmed, failed sign-in counts. | To let you sign in, to protect the account from guessing, and to reach you about your plan and your games. | While the account is open, then deleted. |
| Player account: email address, name and avatar if you signed in with Google, a scrypt hash of any password you set, the language you chose. | To hold the wallet of rewards a player has won across businesses. | While the account is open, then deleted. |
| Player contact captured by a game: an email address, tied to the business that captured it. | The business collected it through its own promotion and is responsible for it. | Until the business deletes it or closes its account. |
| One row per play: the result, the reason for it, the language, a device cookie identifier, a hash of a browser fingerprint, and a hash of a shortened form of the address the request came from. | To enforce the limits you set, to make a game resistant to one person playing it a thousand times, and to be the record a dispute is settled from. | Kept as the record of what happened. A raw address is never stored at all. |
| The reward code, what it is worth, which game and business issued it, when it was claimed and used, and the order value if the business sent one. | So a code can be checked and honoured, and so a business can see whether the promotion paid for itself. | Kept while a claim about it is possible. |
| The plan you are on, your Dodo customer and subscription identifiers, the current period, and lifecycle events Dodo sends us. | To run your subscription and apply the right limits. Card details never reach us. | Plan state while the account is open; the raw event log is deleted after thirty days. |
| Counter staff device: a hash of the device credential, a hash of the 6-digit PIN, lockout counters, when it was last used. | So a member of staff can mark a reward used without holding an account or seeing anything else. | Until the business revokes the device. |
Who is responsible
DealCraft is operated by Dato Diasamidze, registered in Georgia, reachable at hello@dealcraft.io.
For a business owner's own account data, we are the controller. For the customer data a business gathers through its own game, that business is the controller and we act on its instructions.
We never store a raw network address
Address-based limits are what stop one person playing a game a thousand times, so we need something stable. We do not keep the address itself.
The address is shortened to its network block, then signed with a secret key held only on our server, and only that signature is written. It cannot be turned back into an address, and the same address produces a different value on a different deployment.
Why we are allowed to hold it
Account and billing data: because we need it to give you the service you asked for and to meet our tax obligations.
Play, limit and anti-abuse data: because we have a legitimate interest in a game that cannot be drained by one visitor, and because the business that runs the game needs a record of what happened.
Email we send you about your plan, your limits and your games is part of the service, not marketing. We do not send marketing email and we do not sell anyone's data.
Where it lives
On an Oracle Cloud server in Abu Dhabi, United Arab Emirates, with a database on the same machine and encrypted backups held in Oracle Object Storage in the same region.
If you are in the European Economic Area, this is a transfer outside it. We rely on the standard contractual clauses in our agreement with Oracle. Tell us if you need a copy of that arrangement.
Who else sees it
Dodo Payments, as merchant of record, takes the payment and holds the card details. We never see them.
Oracle Cloud hosts the server, the database and the backups. Google receives an authentication request only when a player chooses to sign in with Google. Our email provider carries the messages we send you. A hosted Redis instance holds short-lived rate-limit counters, which are numbers that expire on their own.
There is no advertising network, no third-party analytics script and no tracking pixel anywhere on DealCraft.
Cookies
A signed session cookie when a business owner signs in, and a separate one for a player. A device cookie on a play surface, which is how a per-player limit can work for a visitor with no account. A device credential cookie on a counter staff screen.
All of them are necessary for the thing you asked the product to do. There are no advertising or analytics cookies, which is why DealCraft shows no cookie banner.
How long we keep things
The table above says it per record. In short: account data while the account is open, raw billing events for thirty days, rate-limit counters for minutes, and plays and rewards for as long as someone could still raise a dispute about a prize.
Backups are kept for five days on the server and copied off it, so a deleted record can survive in a backup for a short while after it is gone from the live database.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask for it in a portable form, or object to a use of it. Write to hello@dealcraft.io and we will answer within thirty days.
If a business ran the game you played, ask that business first; they decide what happens to the contact details you gave them, and we will pass your request on if you come to us instead.
If you are in the European Economic Area or the United Kingdom you can also complain to your data protection authority.
Children
DealCraft is not meant for children. A business can put an age gate on a game, and where one is set the player must meet it. If you believe we hold data about a child, write to us and we will delete it.
Changes
If this notice changes in a way that matters we will tell account holders by email. The date at the top says when the text last changed.
Contact
hello@dealcraft.io. We answer in Georgian or English.