Privacy Policy
Last updated:
This policy explains what personal data GuildInn collects, why, who else handles it, how long it is kept, and what rights you have. It covers the GuildInn website at guildinn.app and its subdomains.
1. Who we are
GuildInn is run by Anastasios Chondrogiannis, a private individual based in Greece ("we", "us"). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR).
Contact for anything about this policy or your data: hello@guildinn.app
We have not appointed a Data Protection Officer, because the GDPR does not require one for a service of this size and kind.
2. What data we collect
Your account
When you register, you give us your email address and a password. We store:
- your email address,
- your password, only in hashed form (we never store the password itself),
- when you verified your email address,
- when your account was created and last changed,
- a "remember me" token, if you tick "Remember me" when you log in.
You need an email address and a password to have an account. Without them we cannot create one.
Technical data
When you use the site, your browser sends us data that every website receives:
- your IP address,
- your browser's user agent (the browser and operating system it reports),
- the pages you request and when.
We use this data in sessions (to keep you logged in), in short-lived security counters (to stop password guessing and abuse), and in server logs.
Newsletter
Once you have verified your email address, you can subscribe to our newsletter. We then send your email address to our newsletter provider, Kit, which emails you a link to confirm. You are only subscribed after you click it. Kit records when you confirmed, and whether newsletter emails are opened and which links in them are clicked, so we can see how the newsletter is doing. The newsletter is optional: not subscribing changes nothing about your account.
Emails you send us
If you email us, we receive your email address, your message, and anything you choose to include.
What we do not collect
We do not ask for your name, date of birth, postal address or payment details. On the website we do not use analytics, advertising, tracking pixels or social media plugins, and the account emails (verification, password reset) contain no tracking. We do not receive any data from Blizzard Entertainment or Battle.net.
3. Why we use it, and our legal basis
| What we do | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, log you in, verify your email, let you reset your password | Account data, technical data | Performing our contract with you (Art. 6(1)(b)) |
| Send you the emails the account needs, such as verification and password reset, and important notices about your account, GuildInn or our terms and policies | Email address | Performing our contract with you (Art. 6(1)(b)) |
| Keep the site and accounts secure: stop password guessing, spam and abuse, find and fix errors | Technical data, email address (in security counters) | Our legitimate interest in a secure, working service (Art. 6(1)(f)) |
| Send you the newsletter and see how it is doing | Email address, when you confirmed, newsletter opens and clicks | Your consent (Art. 6(1)(a)) |
| Keep a record that you unsubscribed, so you are not emailed again | Email address | Our legitimate interest in respecting your choice (Art. 6(1)(f)) |
| Answer your emails and requests about your rights | What you send us | Our legitimate interest in answering you (Art. 6(1)(f)) and our legal obligations under the GDPR (Art. 6(1)(c)) |
Our legitimate interest in security is to protect your account, other users and the service from attacks and misuse. We think a reasonable user expects this. You can object to it (see section 7).
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not build profiles of you. We do not sell your data.
4. Who else handles your data
We use the following service providers. They process your data only on our instructions, under data processing terms that oblige them to protect it.
| Provider | What they do for us | Where |
|---|---|---|
| Laravel Holdings Inc. (Laravel Cloud), USA | Hosts the website, the database and the server logs, on Amazon Web Services | The website and the database run in Frankfurt, Germany |
| Cloudflare, Inc., USA (used by Laravel Cloud) | Delivers the website securely and protects it from attacks and bots | Global network; your request is handled by a server near you |
| DigitalOcean, LLC, USA | Runs the server behind guildinn.app, which currently forwards visitors to app.guildinn.app | Frankfurt, Germany |
| Plus Five Five, Inc. (Resend), USA | Sends the emails from our website, such as the account emails (verification, password reset) and notices to our users | Sending from Ireland; company in the USA |
| Kit Inc., USA | Runs the newsletter: sign-up confirmation, sending, unsubscribing | USA |
| Google (Google Workspace) | Our mailbox, where your emails to us arrive and from which we write to you | Google's data centres |
We may also disclose data if the law requires it, for example to a court or the police (Art. 6(1)(c)), or where needed to establish, exercise or defend legal claims (Art. 6(1)(f)).
5. Transfers outside the European Economic Area
Laravel, Cloudflare, DigitalOcean, Resend and Kit are US companies, and Google is part of a US group, so your data may be accessed from or stored in the USA. These transfers are protected by the EU–US Data Privacy Framework, under which the European Commission has found that certified US companies protect personal data adequately, and, where a provider relies on them, by the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards at hello@guildinn.app.
6. How long we keep it
| Data | How long |
|---|---|
| Account data | Until you ask us to delete your account. Deleted data stays in our database backups for up to 7 more days, until those backups are replaced. When we delete your account, we also delete your address from our newsletter provider. |
| Session | Ends after 2 hours without activity, or when you log out, and is then deleted automatically. |
| "Remember me" | Up to 400 days, or until you log out. |
| Password reset link | Works for 60 minutes. The stored (hashed) token is deleted when you use it, when you ask for a new one, or with your account. |
| Security counters | Expire within minutes. |
| Server logs | Kept by our host for a short time (currently 1 day). The server behind guildinn.app keeps no log of visits, only a record of technical errors, which can include an IP address and is kept for a limited time. |
| Account emails at Resend | Up to 30 days. |
| Newsletter | Until you unsubscribe. After that, Kit keeps your address marked as unsubscribed, so you are not emailed again. You can ask us to delete it completely. |
| Your emails to us | As long as needed to answer you and to show we handled any request about your rights. |
7. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it,
- correct data that is wrong,
- delete your data ("right to be forgotten"),
- restrict how we use it,
- receive the data you gave us in a machine-readable format, or have it sent to another service ("portability"),
- withdraw your consent at any time, for example to the newsletter, using the unsubscribe link in any newsletter email or by emailing us. This does not affect what we did before you withdrew it.
Your right to object: where we use your data based on our legitimate interest (see section 3), you can object at any time, for reasons related to your situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims.
To use any of these rights, including deleting your account, email us at hello@guildinn.app from the email address of your account. If you write from another address, we may need to confirm that the account is yours. This is free of charge. We will answer without undue delay, and at the latest within one month. If a request is complex, we may extend this by up to two more months, and we will tell you why within the first month.
You also have the right to complain to a data protection authority. In Greece this is the Hellenic Data Protection Authority (www.dpa.gr). You can also complain to the authority in the EU country where you live or work, or where you think the problem happened. We would appreciate the chance to sort out any concern with you first.
8. Cookies
We only use cookies that the site needs to work. We do not use them to follow you around the web, or for analytics or advertising, so we do not ask for your consent to them. The remember_web_… cookie is set only if you tick "Remember me" when you log in, and logging out removes it.
| Cookie | Set by | What it does | How long |
|---|---|---|---|
| guildinn-session | GuildInn | Keeps you logged in and remembers your session | 2 hours |
| XSRF-TOKEN | GuildInn | Protects forms against cross-site request forgery | 2 hours |
| remember_web_… | GuildInn | Keeps you logged in if you tick "Remember me" | Up to 400 days |
| __cf_bm | Cloudflare | Tells people apart from bots | 30 minutes |
| _cfuvid | Cloudflare | Applies rate limits fairly to visitors who share an IP address. Set only when such a limit applies. | Until you close the browser |
9. Age
You must be at least 18 to create an account. If we learn that an account belongs to someone under 18, we will delete it.
10. Security
We protect your data with encrypted connections (HTTPS), hashed passwords, encrypted session cookies, limits on login attempts, and servers in the EU. No system is perfectly secure, but if a breach puts your rights at high risk, we will tell you as the GDPR requires.
11. Changes to this policy
We will update this policy when the service or the law changes, and change the date at the top. If a change is significant, we will tell registered users by email or on the site before it takes effect.