Privacy policy

Data controller

Data controller identity

Théo NOLOT EI

Privacy contact

contact@boltactic.com

Data protection officer, if applicable

Aucun DPO désigné

Data and purposes

Accounts use an email address, a username, a password handled by the authentication service and a date of birth. These fields are required for the current registration process; training remains available without an account.

Robots, combat rules, configurations, appearance, missions, results, rankings and rewards are used to run the game and restore progress across devices.

Connection data and technical logs may be processed for authentication, security and diagnostics. Their contents, recipients and retention must be confirmed for the selected hosting.

Legal basis for each purpose, including the interest pursued where applicable

Accounts, authentication, saves and gameplay: performance of the terms of use. Security and abuse prevention: legitimate interest in protecting players and the service, with proportionate safeguards. Support: contract performance or legitimate interest in responding to requests. Handling data rights and applicable accounting duties: legal obligation. No blanket marketing consent is requested; any future optional processing based on consent will have a separate choice.

Visibility and recipients

Usernames, pilot profiles, appearance and ranking results are visible to other players. Robot copies can be faced while their owner is offline. Email addresses, dates of birth and combat rules are not shown on public profiles.

The providers used, their roles and location information are detailed below. Visibility between players is separate from the access needed to operate the service.

Recipients and processors

The publisher and authorised providers access only data necessary for their tasks. Vercel hosts the site; Supabase provides authentication and the database. Resend sends authentication emails for Supabase, processing recipient addresses, message content and technical delivery data for this purpose. OVHcloud provides the domain name and the contact@boltactic.com mailbox, which receives support requests, data rights requests and reports. Public usernames, profiles and results are visible to other players. Paddle is being considered for future sales; payments are not currently enabled.

Processing countries and regions

Supabase (comptes et base de données) : West EU (Paris), France — eu-west-3

Transfers outside the EEA and applicable safeguards, or confirmed absence of transfers

The primary Supabase database is in Paris. Resend sends emails from Ireland (eu-west-1), but states that account data, including email metadata, logs and API records, is stored in the United States regardless of the sending region. Vercel, Supabase and their subprocessors may also involve processing outside the European Economic Area. Transfers must be covered by an applicable adequacy decision or appropriate safeguards, including standard contractual clauses where needed. The actual contracts, subprocessors and safeguards still require verification before publication; choosing Paris or Ireland does not mean all processing stays within the EEA.

Retention and deletion

Account deletion is available in My account. It removes active account data and anonymises the relevant robot copies and replays while preserving other players’ battles. Retention periods and backup-related limitations are detailed below.

Retention period or criteria for accounts, profiles and game data

Accounts, robots and progress are kept while the service is used. A free account with no purchase entitlement to preserve may be deleted after 12 months without voluntary activity, following two notices, normally 30 and 7 days before deletion. An inactivity purge is not allowed without recorded notices and a final activity check. Data necessary to access purchased content is excluded. Details of completed battles are limited to 90 days, except state needed for an ongoing game, justified evidence or a legal duty. Requested deletion removes active data and anonymises identifying copies; backups and mandatory archives follow their own retention periods.

Technical log retention

Application diagnostic logs are limited to 30 days and dedicated security records to six months, unless a legal duty or incident justifies separate restricted retention. Passwords and session tokens must not be logged. Hosting providers’ own logs follow their settings and contractual duties, to be checked before publication; a retention window unavailable on the subscribed plan is not described as active.

Retention of requests and reports

Routine support requests and reports are retained until closure and for up to 12 months afterwards. Minimal sanction status may be needed for its duration. Records necessary for a legal duty or dispute are kept separately, restricted to authorised people and retained for the justified period; they do not justify keeping the entire account indefinitely.

Backup retention and residual deletion period

The current Supabase plan is Free; no publisher-controlled automatic backup window is claimed as established. The planned Pro upgrade provides access to the last seven days of daily database backups. Exports and Storage files require separate handling. Publisher-managed copies must be encrypted, limited to 30 days and restored through a process that reapplies deletions. This setup still needs verification and activation before publication.

Manage or delete my account

Minors and service access

The current form requires a minimum age of 16. This technical threshold alone does not establish lawful access for minors in every country. The age policy and any parental authorisations still require review.

Age policy and parental authorisation

Accounts are for people aged at least 16 who may legally use the service in their country. Minors must have their legal representative’s authorisation where required for this agreement. Real-money purchases are restricted to people aged at least 18 with the legal capacity and age of majority required in their country; no parental purchase flow for a minor’s account is planned at launch. Identity documents are not routinely requested. A declared age and a payment method are not conclusive proof of adulthood.

Your rights

Subject to the applicable conditions, you may request access, rectification, erasure, restriction, objection and portability of your data. Consent may be withdrawn for processing based on it, without affecting earlier lawful processing.

Send requests to the privacy contact below. A response is generally due within one month; any extension permitted by law must be explained. You may also complain to the CNIL or the competent supervisory authority.

Privacy contact

contact@boltactic.com

Contact the CNIL