Privacy policy

This policy explains how Gamers Universe ("the Platform") processes your personal data under Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. The data controller is the operator identified in the legal notice (Gamers Universe — contact@gamersuniverse.fr).

1. Processing activities

The activities below match the features actually present on the site.

a. Account creation and management

• Data: email address, password (encrypted by our authentication provider), username, avatar and banner, language preference, profile content.
• Purpose: create and manage your account, authenticate you, enable community use.
• Legal basis: performance of the contract (Terms of Use).
• Retention: for the life of the account, then deletion or anonymisation within 30 days of closure.

b. Coaching payments (intermediation)

• Data: amount, currency, session and transaction history, dispute status. Card details are entered and processed directly by Stripe; the Platform has no access to them.
• Purpose: enable booking and payment of a coaching service between a third-party coach and a player via Stripe Connect; handle disputes.
• Legal basis: performance of the contract; legal obligation (accounting records).
• Retention: duration of the relationship, then 10 years for accounting records (Art. L123-22 French Commercial Code).

c. Linked gaming accounts

• Data: third-party platform identifiers (Steam, Xbox, PlayStation/PSN, Epic Games, Discord, Battle.net, itch.io), access and refresh tokens (encrypted at rest with AES-256-GCM), game library, playtime, region, platform avatar.
• Purpose: sync your library and gaming statistics.
• Legal basis: your consent (you choose to link each platform); withdrawable at any time by unlinking.
• Retention: until you unlink the platform or delete your account.

d. Community content

• Data: posts, reviews, discussions, comments, mentions, player subscriptions, uploaded images.
• Purpose: run the social and editorial features.
• Legal basis: performance of the contract.
• Retention: until you delete it; when the account is closed, content is kept in anonymised form ("Deleted user").

e. Audience measurement

• Data: page views, performance metrics (Vercel Analytics, Vercel Speed Insights).
• Purpose: measure traffic and improve the site.
• Legal basis: your consent (see the cookie policy); enabled only after acceptance.
• Retention: per provider settings (typically ≤ 25 months).

f. Technical logs and security

• Data: IP address, timestamp, technical connection information (via the host).
• Purpose: security, fraud and abuse prevention, proper operation.
• Legal basis: legitimate interest.
• Retention: short, typically ≤ 12 months.

2. Recipients and processors

Your data is accessible to the operator and to the following processors, acting on instruction:

• Vercel Inc. — application hosting (USA).
• Supabase Pte. Ltd. — database, authentication, file storage (region: London, United Kingdom).
• Stripe — payment processing and payouts to coaches (Stripe Connect).
• The third-party gaming platforms you voluntarily link.
• Vercel AI Gateway — automatic content translation (where applicable).

3. Transfers outside the EU

The database is hosted in the United Kingdom (London), which benefits from a European Commission adequacy decision (renewed on 19 December 2025): no additional safeguard is required for this transfer.

Some providers (Vercel, Stripe, and Supabase for its support operations) may process data in the USA or Singapore. Such transfers rely on the European Commission's Standard Contractual Clauses and, for certified US providers, the EU–US Data Privacy Framework.

4. Your rights

You have the rights of access, rectification, erasure, objection, restriction and portability, as well as the right to set post-mortem instructions.

Deleting your account (right to erasure)

• From Settings → "Delete my account", after confirming your identity (password or recent sign-in) and typing a confirmation word. An email confirms the request.
• Your account is deactivated immediately and hidden from public pages. For 30 days you can cancel by signing in again: everything is restored.
• After those 30 days, the account and your personal data are permanently deleted (profile, library, sessions, wishlist, notifications, linked platforms and their tokens, follows, friends, GU Coins wallet, avatar and banner). An email confirms the deletion.
• Content: your contributions (reviews, comments, posts, group and community posts, coaching reviews, private messages) are kept but anonymised: they are shown as "Deleted user" and no longer linked to your identity. Groups and communities you own are handed to their oldest member (moderators first), or deleted when they have no other member.
• Retained data: coaching sessions that involved a payment are kept with no link to your profile (amounts, dates, status) for 10 years as accounting records. Deletion is refused while a coaching payment awaits payout or a dispute is open.

To exercise them: contact@gamersuniverse.fr. We will reply within one month.

You may also lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

5. Minors

The Platform may be used by minors. Creating an account requires being at least 15 years old; below that age, consent from a holder of parental authority is required (Art. 45 French Data Protection Act).

6. Security

Passwords are handled securely by our authentication provider; gaming platform tokens are encrypted at rest (AES-256-GCM). Data access is restricted and protected by row-level security (RLS).