Privacy Policy

1. Introduction

This privacy policy describes how Unboared ("we", "our") collects, uses and protects personal data when you use our platform.

We are committed to protecting the privacy of our users and their customers in accordance with the EU General Data Protection Regulation (GDPR) and, for people in the United Kingdom, the UK GDPR and the Data Protection Act 2018. Section 10 also describes the rights of residents of the United States.

2. Data controllers

Unboared and the subscriber (the partner venue, or the professional host running the game) act as joint data controllers for player data. Unboared provides the technical platform; the subscriber decides whether to enable data collection.

Unboared — 9 rue Dareau, 75014 Paris, France
Email: contact@unboared.com

3. Data collected

For venues (subscribers):

• First name, last name, professional email address
• Venue name
• Billing information: billing address and country, payment method (managed by Stripe, we never see full card numbers)
• Usage data (sessions, games played, statistics)
• Text of requests submitted to the AI playlist generator (Blind Test)

For players:

• Chosen username and avatar
• Scores and game history
• If enabled by the venue: email address, first name, last name, phone number, age
• Technical data: IP address, browser type, device type

4. Purposes of processing

• Providing and improving the Service
• Managing subscriptions and billing
• Usage statistics for venues
• Email communications (only with explicit consent)
• Managing leaderboards and rewards

5. Legal basis

• Contract performance: providing the Service to subscribers
• Legitimate interest: improving the Service, anonymised statistics
• Consent: collecting player emails, marketing communications

6. Retention periods

• Account data: 3 years after last activity
• Billing data: 10 years (legal obligation)
• Player data: 12 months after last gaming session
• Technical logs: 12 months

7. Data sharing and service providers

We never sell personal data. We share it only with the subscriber concerned and with the service providers below, each limited to what it needs to provide its service to us:

• The subscriber (venue or host): player data collected during their games
• Stripe: payment processing and billing
• Google (Firebase, Google Cloud, Google Workspace): hosting, database, authentication, usage analytics (Firebase Analytics) and some service emails
• Railway: hosting of the real-time game server (connects the screen and players' phones)
• Heroku (Salesforce): hosting of our payment backend
• Vercel: hosting of our website unboared.com
• Sentry: error monitoring of the game console
• Resend: sending of service emails (welcome, trial reminder, password reset, contact form)
• Mailchimp (Intuit): email list of account holders and newsletter subscribers
• Hostinger: hosting of our contact@unboared.com mailbox
• Anthropic: AI generation of Blind Test playlists; only the text of the request is sent, never player data
• Deezer: music catalogue and audio extracts for the Blind Test; the device playing the game connects to Deezer, which receives its IP address
• Meta (Facebook): advertising measurement via the Meta Pixel (see section 11)

8. International transfers

Several of the service providers above are based in the United States, so some data is processed outside the European Economic Area and the United Kingdom. These transfers rely on the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses, supplemented by the UK Addendum for data from the United Kingdom.

9. Security

We implement appropriate technical and organisational measures to protect personal data: encrypted communications (HTTPS), secure authentication, restricted data access.

10. Your rights

Under the GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing
• Right to restriction of processing
• Right to withdraw consent at any time

To exercise these rights, contact us at: contact@unboared.com

You also have the right to lodge a complaint with your local data protection authority (in France: the CNIL; in the UK: the ICO — Information Commissioner's Office).

Residents of the United States. Depending on your state of residence (for example California), you may have the right to know which personal information we collect and why, to access it, to have it corrected or deleted, and to opt out of the "sale" or "sharing" of your personal information for targeted advertising. We do not sell personal information. You can exercise these rights by emailing contact@unboared.com; we will not treat you differently for doing so.

11. Cookies

Our platform uses technical cookies necessary for the Service to function (player identification, game session). These cookies are strictly necessary and do not require consent.

We also use Firebase Analytics to measure Service usage. You can disable this collection via your browser settings.

Our website (unboared.com) and the pages of our console intended for account holders and prospects (console.unboared.com: sign-in, sign-up, demo, account, game selection) use the Meta Pixel, which records page visits and sign-ups to measure the performance of our advertising on Meta platforms (Facebook, Instagram). It is not loaded on the pages players open on their phone (joining a game, claiming a reward) nor on the game screen. You can limit this tracking via your browser settings or your Meta ad preferences.

12. Changes to this policy

We may update this privacy policy. Significant changes will be communicated by email at least 30 days before they take effect.

The version dated September 21, 2026 applies immediately to accounts created from that date. For accounts created earlier, it takes effect 30 days after we notify you by email.

13. Contact

For any questions about this policy, contact us at: contact@unboared.com