Privacy Policy
Effective 3 November 2026 • Applies to playvelvetember.com • Deutsche Fassung
The short version
- At sign-up we store your display name, email address and region — nothing about payments, because there are none.
- Your password never leaves your device.
- A Google advertising tag runs only if you click Accept in the cookie banner.
- We never sell your data. Ask us any time to see, correct or delete it: contact@playvelvetember.com.
1. Who is responsible
The controller for personal data processed on this website is the operator of playvelvetember.com, reachable at contact@playvelvetember.com. Further operator information is published in our Imprint. We have not appointed a data protection officer, as we are not legally required to.
2. What we process, why, and on what basis
| Activity | Data | Purpose & legal basis | Kept for |
|---|---|---|---|
| Visiting the site | IP address, browser and device type, page requested, time | Delivering the site and defending it against attacks — legitimate interests, Art. 6(1)(f) GDPR | Short rotation by our host, then deleted automatically |
| Creating or pre-registering a profile | Display name, email, region of residence, sign-up time, language | Setting up and administering your free profile and enforcing our residency rule — contract, Art. 6(1)(b) GDPR | Until you delete your profile or ask us to |
| News emails (optional) | Email address, opt-in flag with time stamp | Occasional Velvet Ember news — only with your consent, Art. 6(1)(a) GDPR | Until you withdraw consent |
| Profile on your device | Display name, email, region, SHA-256 password hash, 21+ confirmation, login flag, cookie choice | Logging in and remembering choices; stored only in your browser — strictly necessary (§ 25(2) TDDDG) | Until you clear your browser data |
| Google Ads measurement | Online identifiers, cookie IDs, pages viewed, sign-up event | Measuring which ads bring new players — consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG | Google's cookies last up to 90 days; withdraw any time |
| Playing a game | IP address and technical connection data sent to the game studio | Streaming the game you asked to play — contract / legitimate interests, Art. 6(1)(b) and (f) GDPR | Under the studio's own policy |
| Emailing us | Your email address and message | Answering you — Art. 6(1)(b) or (f) GDPR | Until your request is resolved, then deleted within 6 months |
3. Who receives data
Hosting: our website and sign-up records are hosted by Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus, which processes data on our behalf under a data processing agreement (Art. 28 GDPR).
Google: only after you accept cookies, the Google tag (gtag.js) is loaded and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland receives the measurement data listed above. Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU–US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). You can withdraw consent at any time through the “Cookie settings” link in the footer — we then stop loading the tag and delete Google's cookies from our domain.
Game studio: games are streamed in demo mode from the servers of the studio Play'n GO. When you open a game, your browser connects directly to that studio, which may set its own technical cookies under its own responsibility.
We do not sell, rent or trade personal data, and we do not use it for automated decision-making or profiling within the meaning of Art. 22 GDPR.
4. Do you have to give us data?
No. You only need to provide a display name, email address and region if you want a profile; without them we cannot create one. News emails and advertising cookies are entirely optional.
5. Your rights
Under the GDPR you can request access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and portability (Art. 20) of your data, and object to processing based on legitimate interests (Art. 21). Consent can be withdrawn at any time with effect for the future (Art. 7(3)). You may also complain to a data protection supervisory authority, in particular the one where you live. Our GDPR rights page explains each right and helps you send a request.
Your right to object (Art. 21 GDPR): where we rely on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop, unless we can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.
Residents of Australia have rights under the Privacy Act 1988 and the Australian Privacy Principles; our Australian Privacy Policy explains them and how to complain.
Residents of Canada also have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including access to and correction of their personal information, and may complain to the Office of the Privacy Commissioner of Canada.
6. Security
The site is served only over HTTPS. Sign-up records sit in a server folder that is blocked from web access, and passwords are never transmitted to us. Collecting little is our strongest protection.
7. Age
Velvet Ember is for adults aged 21 or over. We do not knowingly process data of anyone younger; if you believe we have, tell us and we will delete it.
8. Changes
If our processing changes, we will update this page and its effective date.