Privacy Policy

1. Introduction

This privacy policy describes how Unboared ("we", "our") collects, uses and protects personal data when you use our platform.

We are committed to protecting the privacy of our users and their customers in accordance with the EU General Data Protection Regulation (GDPR) and, for people in the United Kingdom, the UK GDPR and the Data Protection Act 2018. Section 10 also describes the rights of residents of the United States.

2. Data controllers

Unboared and the subscriber (the partner venue, or the professional host running the game) act as joint data controllers for player data. Unboared provides the technical platform; the subscriber decides whether to enable data collection.

Unboared — 9 rue Dareau, 75014 Paris, France
Email: contact@unboared.com

3. Data collected

For venues (subscribers):

• First name, last name, professional email address
• Venue name
• Billing information: billing address and country, payment method (managed by Stripe, we never see full card numbers)
• Usage data (sessions, games played, statistics)
• Text of requests submitted to the AI playlist generator (Blind Test)

For players:

• Chosen username and avatar
• Scores and game history
• If enabled by the venue: email address, first name, last name, phone number, age
• Technical data: IP address, browser type, device type

4. Purposes of processing

• Providing and improving the Service
• Managing subscriptions and billing
• Usage statistics for venues
• Email communications (only with explicit consent)
• Managing leaderboards and rewards

5. Legal basis

• Contract performance: providing the Service to subscribers
• Legitimate interest: improving the Service, anonymised statistics
• Consent: collecting player emails, marketing communications

6. Retention periods

• Account data: 3 years after last activity
• Billing data: 10 years (legal obligation)
• Player data: 12 months after last gaming session
• Technical logs: 12 months

7. Data sharing and service providers

We never sell personal data. We share it only with the subscriber concerned and with the service providers below, each limited to what it needs to provide its service to us:

• The subscriber (venue or host): player data collected during their games
• Stripe: payment processing and billing
• Google (Firebase, Google Cloud, Google Workspace): hosting, database, authentication, usage analytics (Firebase Analytics) and some service emails
• Railway: hosting of the real-time game server (connects the screen and players' phones)
• Heroku (Salesforce): hosting of our payment backend
• Vercel: hosting of our website unboared.com
• Sentry: error monitoring of the game console
• Resend: sending of service emails (welcome, trial reminder, password reset, contact form)
• Mailchimp (Intuit): email list of account holders and newsletter subscribers
• Hostinger: hosting of our contact@unboared.com mailbox
• Anthropic: AI generation of Blind Test playlists; only the text of the request is sent, never player data
• Deezer: music catalogue and audio extracts for the Blind Test; the device playing the game connects to Deezer, which receives its IP address
• Meta (Facebook): advertising measurement via the Meta Pixel and the Conversions API, and advertising audiences built from account holders' hashed email addresses (see section 11)

8. International transfers

Several of the service providers above are based in the United States, so some data is processed outside the European Economic Area and the United Kingdom. These transfers rely on the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses, supplemented by the UK Addendum for data from the United Kingdom.

9. Security

We implement appropriate technical and organisational measures to protect personal data: encrypted communications (HTTPS), secure authentication, restricted data access.

10. Your rights

Under the GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing
• Right to restriction of processing
• Right to withdraw consent at any time

To exercise these rights, contact us at: contact@unboared.com

You also have the right to lodge a complaint with your local data protection authority (in France: the CNIL; in the UK: the ICO — Information Commissioner's Office).

Residents of the United States. Depending on your state of residence (for example California), you may have the right to know which personal information we collect and why, to access it, to have it corrected or deleted, and to opt out of the "sale" or "sharing" of your personal information for targeted advertising. We do not sell personal information. You can exercise these rights by emailing contact@unboared.com; we will not treat you differently for doing so.

11. Cookies

Our platform uses technical cookies necessary for the Service to function (player identification, game session). These cookies are strictly necessary and do not require consent.

We also use Firebase Analytics to measure Service usage. You can disable this collection via your browser settings.

Our website (unboared.com) and the pages of our console intended for account holders and prospects (console.unboared.com: sign-in, sign-up, demo, account, game selection) use the Meta Pixel, which records page visits and sign-ups to measure the performance of our advertising on Meta platforms (Facebook, Instagram). It is not loaded on the pages players open on their phone (joining a game, claiming a reward) nor on the game screen. You can limit this tracking via your browser settings or your Meta ad preferences.

Advertising audiences. We may share with Meta the email address of Unboared account holders, in hashed form (SHA-256), solely to (i) stop showing our acquisition ads to existing customers and (ii) show our offers on Facebook and Instagram to people who created an account without subscribing, or who cancelled their subscription. Visits recorded by the Meta Pixel may also be used to build such audiences. Meta matches these hashes against its own users and then deletes them; for this purpose, it does not receive any other information about you from us. Legal basis: our legitimate interest in presenting our services to professionals who have shown interest in them. You can object at any time by emailing contact@unboared.com. People who unsubscribed from our marketing emails are never included in these audiences. Players' data is never shared.

Advertising measurement. When an account starts a free trial or becomes a paying subscriber, we may send Meta the hashed (SHA-256) email address of that account (or, failing that, the one entered on the payment page), together with the type of event (trial started, subscription), its time, a technical identifier of the sign-up used to avoid counting it twice, and the technical Meta Pixel data present in your browser (browser identifier, ad click identifier, and the browser's user agent: browser, operating system and device model), solely to find out which ads led to these sign-ups and to deliver our ads better. No amount, venue name or other data is sent. This applies to accounts created after this paragraph was published. Same legal basis and same right to object (contact@unboared.com).

12. Changes to this policy

We may update this privacy policy. Significant changes will be communicated by email at least 30 days before they take effect.

The version dated October 8, 2026 applies immediately to accounts created from that date. For accounts created earlier, it takes effect 30 days after we notify you by email.

13. Contact

For any questions about this policy, contact us at: contact@unboared.com