Data Processing Addendum (DPA)
Last updated: 12 October 2026 / 12 de octubre de 2026
This addendum describes how personal data of 700 MB WAR players is processed under the EU General Data Protection Regulation (GDPR). It forms part of the Privacy Policy and Terms.
1. Roles
Controller: Inithex (Poland), contact enrique@inithex.com. Processors: the service providers listed below, bound by data processing agreements with GDPR art. 28 terms.
2. Processing details
| Item | Description |
|---|---|
| Data subjects | Players who create an account or play online |
| Categories of data | Email, display name, profile picture (if provided by Google/Apple), game progress and settings, online match moves, technical logs (IP, user agent) |
| Special categories | None |
| Purpose | Authentication, saving and syncing progress, online multiplayer, security |
| Duration | While the account is active; erased within 30 days after deletion. Logs: per provider retention, max 90 days |
3. Sub-processors
| Provider | Service | Location / transfer safeguard |
|---|---|---|
| Supabase, Inc. | Authentication, database, realtime | EU (Frankfurt, eu-central-1); SCCs for any support access |
| Vercel, Inc. | Website hosting / CDN | Global edge; EU–US Data Privacy Framework and SCCs |
| Google LLC | Optional "Sign in with Google" (identity provider) | EU–US Data Privacy Framework |
| Apple Inc. | Optional "Sign in with Apple" (identity provider) | SCCs |
We will update this list before adding a new sub-processor.
4. Security measures
- Encryption in transit (HTTPS/TLS) and at rest (provider-managed).
- Row-level security in the database: each player can only read and write their own data.
- No passwords stored by us (passwordless email codes or Google/Apple sign-in).
- Administrative keys kept out of the game client and source repository; access limited to the controller.
- Data minimisation: no advertising, tracking or analytics data is collected.
5. Data subject rights and breaches
Requests (access, rectification, erasure, portability, objection) are handled within 30 days via enrique@inithex.com. Personal data breaches will be notified to the supervisory authority (UODO) within 72 hours where required, and to affected players without undue delay when there is a high risk.
6. Deletion and return
On account deletion or end of service, personal data is erased from active systems within 30 days and from backups on their normal rotation.
Acuerdo de tratamiento de datos
Última actualización: 12 de octubre de 2026
Responsable: Inithex (Polonia). Encargados: Supabase (autenticación y base de datos, Frankfurt, UE), Vercel (alojamiento web) y, si los usas, Google y Apple como proveedores de inicio de sesión.
Datos: correo, nombre visible, foto (si la entrega Google/Apple), progreso y opciones, jugadas online, registros técnicos. Sin categorías especiales. Fines: cuenta, guardar progreso, multijugador, seguridad. Plazo: mientras exista la cuenta; borrado en 30 días.
Seguridad: HTTPS, cifrado en reposo, seguridad por filas (cada jugador solo ve sus datos), sin contraseñas guardadas, claves de administración fuera del juego. Brechas: aviso a la UODO en 72 h cuando corresponda. Derechos: escribe a enrique@inithex.com.
Inithex · 700 MB WAR · enrique@inithex.com · 700mbwar.com