Privacy policy

Last updated: July 28, 2023 (“Effective Date”)

Welcome to Alchemy RPG!

At Alchemy RPG ("we", "us", "our"), we collect, use, and disclose your ("you", "your") personal data as part of the service we offer. This Privacy Policy (“Policy”) explains how we handle your personal data, protects your privacy rights, and complies with the law.

Your personal data plays a vital role in our operation. It not only enables functionality but also fuels the ongoing enhancement of our platform. By using our service, you give consent to the collection and use of your personal data, as described in this Policy.

We maintain high integrity standards during this process, with transparency in our data practices as a fundamental aspect of our operations.

DEFINITIONS

The terms used in this Policy are as defined below. The definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Personal Data refers to any information you provide that identifies or can be used to identify you, directly or indirectly. This includes identifiers such as your name, your game account username, contact information, or data specific to your use of our services, such as gameplay details, marketplace transactions, and preferences.

Processing refers to any action or set of actions performed on your Personal Data. This includes, but is not limited to, collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, and erasure or destruction of data within our service.

Services refers to our Virtual Tabletop (“VTT”) client, including features like Games, Marketplace, Streaming, Desktop App, Website, Community Engagement (e.g., via Discord), Creator Partner Program, and any related applications or functions we offer to enhance your Game experience.

Consent means your clear agreement to the processing of your Personal Data. This is given through a freely made, specific, informed, and unambiguous action such as checking a box, clicking a button, or any other affirmative gesture indicating your agreement to a particular process involving your data.

Controller refers to us, the entity that determines the purposes and means of processing your Personal Data within the context of our service.

Processor means any entity that processes your Personal Data on our behalf, following our instructions and in accordance with this Policy and other relevant confidentiality and security measures.

Third-Party refers to any application, website, company, or service that we do not own or control but may interact with while providing or enhancing our Services. This includes payment processors like Stripe or community platforms like Discord.

DATA COLLECTION

OVERVIEW

PURPOSE OF COLLECTION

We collect and process personal data for specific and legitimate purposes, including but not limited to:

Providing and maintaining the service;
Processing your account registration and managing your account;
Administering contests, promotions, surveys, or other interactive features;
Facilitating customer support and responding to inquiries or requests;
Sending administrative data, updates, and important notifications related to the service;
Delivering personalized content and recommendations based on your preferences and usage patterns;
Analyzing and improving the service's functionality, user experience, and performance;
Conducting research and data analysis to enhance our products and services;
Detecting and preventing fraud, unauthorized access, or potential security breaches;
Complying with applicable legal requirements, industry standards, and our internal policies.

DATA CATEGORIES

Alchemy RPG, a global online virtual tabletop platform, collects and processes various categories of personal data from our users worldwide. The range and type of data collected largely depends on the nature of interaction users have with our service.

We collect the following categories of personal data on our users to maintain and manage our service, and for the purposes described further in this Policy:

Contact Data. Your name, email address, postal address, and phone number when you sign up for our service.
Account Data. Your username, password, and other account registration details when you create an account.
Usage Data and Tracking Technologies. Data about your device, browser, and interactions with the service, gathered through tracking technologies such as cookies and web beacons when you use our Website or Desktop App.
Payment Data. Necessary payment details when you make purchases through the service, collected to process your transactions securely.
Predictive Data. Inferences from other personal data about a user's preferences or future behavior patterns when you use our service or interact with our Website.
Employment-Related Data. Employment-related data from individuals who apply for job positions with us, including details about their professional lives or employment history. This data is used solely for the hiring process.
Non-public Education Data. Non-public education data provided by job applicants during the application process.

Please note that some types of personal data, such as publicly available government records, de-identified or aggregated consumer data, and data covered by specific privacy laws, are not included within the categories stated above.

DATA SOURCES

We obtain your personal data from the following sources:

Directly from You. For example, from the forms you complete on our service, preferences you express or provide through our service, or from your purchases on our service.
Indirectly from You. For example, from observing your activity on our service.
Automatically from You. For example, through cookies we or our Service Providers set on your Device as you navigate through our service.
From Service Providers. For example, third-party vendors to monitor and analyze the use of our service, third-party vendors to provide advertising on our service, third-party vendors for payment processing, or other third-party vendors that we use to provide the service to you.

DATA COLLECTED DIRECTLY / INDIRECTLY

When you use our service, apply for a job, or partner with us, we may ask you to provide certain personal data that can be used to contact or identify you.

This data collection occurs at several points in the user journey and is categorized as follows:

Website. Our Website (https://alchemyrpg.com/ or https://app.alchemyrpg.com) is the first touch point for users and is likely where you will sign up for an account before joining a Game, accessing the Marketplace, or downloading our Desktop App.
Desktop App. When you download our desktop App (the “App”) for Windows or Apple desktops, we require your permission to communicate on either a private or public network. You can sign into our App and access the same features available through our Website.
Sign Up / Sign In. When you sign up or sign into our Website or App, you provide your email, username, and password. We require all new users to agree to our Terms of Service, however, we understand not everyone enjoys newsletters, so our email communications are on an opt-in basis.
Create Game / In Game. When you create a Game or participate in a Game session (the “Game”), you provide the title, system, filter modules, and any information that fits into our various custom fields. Your Game's privacy settings are also managed here, allowing you to designate your Game as private or public. Private Games remain an exclusive experience, while public Games can be viewed by any user with access to our service. During gameplay, you and your party members have the option authorize access to your microphone and camera to summon your corporeal forms into your Game. We do not save these forms, all memory of them is annihilated once the Game is closed and subsequent authorization must be granted anew. Additionally, we support custom Game Content, allowing you to incorporate your own unique content into your gaming experience.
Streaming. You may decide to broadcast your Game by activating the streaming feature in our interface. All participants will receive a notification that the session is being streamed. New players attempting to join an ongoing broadcast must acknowledge and consent to the live recording before they can participate. We don't store the recordings of these streamed sessions; they are shared in real-time with the selected audience on integrated platforms. However, it's worth noting that they might be uploaded and retained by the platforms where they're streamed. In such cases, the collection, usage, and storage of streamed data are subject to the policies of those respective platforms.
Marketplace. When you make purchases from our Marketplace, the required data to process the transaction, including your card details (Card Number, Expiration Date, CVC, Country, and Zip code) is provided to our third-party payment processor, Stripe. Please note, your card data is securely stored by Stripe, not us, to facilitate financial transactions. For content offered free of charge in our Marketplace, your card data is not required.

As we continue to expand and enhance our Marketplace, we might explore the use of predictive data to improve your browsing experience. This would involve using information about your interactions, usage patterns, and existing library to understand your preferences better. Any future use of predictive data will be for the sole purpose of refining our recommendations, rather than divining the future, so that we can highlight content in the Marketplace that would be of most interest to you.

Contact Us. If you contact us directly through our Website or App, we collect the data you provide in the contact form.
Discord Community. If you join our Discord community (https://discord.com/invite/alchemyrpg), the data you provide to access this community is controlled by Discord. Upon joining, you may be assigned roles based on your preferences and activities within the Discord community (e.g., following for updates, streaming, game design). You can unassign yourself from these roles. Before joining the community, we require you to read and agree to the Server Rules / Code of Conduct. When you join our community, we gain access to your Discord display name, any public data available on your User Profile, and any messages you post on our server.
Events or Webinars. When you attend events or webinars hosted by us, we may collect event data, such as your name, email, billing data, and any additional data required for event registration or ticket purchases.
Job Application. When you submit a job application to us, we may collect data you provide, to include name, address, email address, phone number, employment history, educational background, professional certifications or licenses, references, resume or CV, cover letter, salary expectations or history, availability for work, citizenship status, and other data you provide during the hiring process. We may also collect more data about you once you become an employee. The practices of which are governed internally, shrouded in secrecy, and only given to the newly anointed employees upon onboarding.
Creator Partnership. When you join our Creator Partner Program, we collect personal data including name, email address, content title, website, Kickstarter campaign link, Twitter handle, and content description. You'll also provide a Generative AI Acknowledgement confirming whether AI was used in your Content. This information helps us to facilitate your Content's visibility in our Marketplace and provide you with anonymized, aggregated reports detailing the usage and interaction of your uploaded Content.
Business Partnership. When you partner with us in a shared business, promotion, or charity, we may collect personal data such as name, email address, phone number, job title or business role, company or organization name, business address, and data about the nature of our partnership or collaboration.

DATA COLLECTED AUTOMATICALLY

SERVICE TELEMERY

Upon downloading and using our Desktop App on your Windows or Apple desktops, certain data is automatically collected to help improve our services and to enhance your user experience. This automatic data collection is contingent upon the necessary permissions being granted.

Activity Data. We record your activity within the App, including your sign-in time, duration of sessions, pages or features accessed, interaction with in-App elements, and frequency of use. This helps us understand usage patterns and user preferences, thereby allowing us to tailor our service to better suit your needs.
Gameplay Data. During gameplay, we collect data related to the Games you participate in or create. This includes Game titles, chosen system, selected filter modules, and use of custom fields. We also record data on in-Game actions, such as commands issued, interactions with other players, and use of Game Content. We do not save or store any visuals or audio from your microphone or camera, and any access to these is forgotten after each session. All data collected during gameplay is used to enhance game features, improve game design, and provide a more engaging user experience.
Telemetry Data. Our App collects telemetry data to monitor performance and troubleshoot potential issues. This includes data on App load times, response times, crashes or errors, operating system details, and details about your device's hardware.
Device Data. When you use our App, we automatically collect specific device data, such as your device type, operating system version, unique device identifiers, and network information. This information is used for troubleshooting, delivering software updates, and understanding user hardware preferences.

COOKIES & TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies to track the activity on our service and store certain data. Tracking technologies used are beacons, tags, and scripts to collect and track data and to improve and analyze our service.

The technologies we use may include:

Cookies or Browser Cookies. A cookie is a small file placed on your Device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use certain parts of our service. Unless you have adjusted your browser setting so that it will refuse cookies, our service may use cookies.
Web Beacons. Certain sections of our service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permits us, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of a certain section and verifying system and server integrity).

Cookies can be “persistent” or “session” cookies. Persistent cookies remain on your personal computer or mobile device when you go offline, while session cookies are deleted as soon as You close Your web browser. You can learn all about cookies here: https://www.termsfeed.com/blog/cookies/

We use both session and persistent cookies for the purposes set out below:

Necessary/Essential Cookies. These are session cookies that are indispensable for providing you with the services available through the Website and enabling you to utilize certain features. They help authenticate users and prevent fraudulent use of user accounts. Without these cookies, we cannot provide the requested services, and we only use them for that specific purpose.
Cookies Policy/Notice Acceptance Cookies. These are persistent cookies administered by us that identify whether users have accepted the use of cookies on the Website.
Functionality Cookies. These are persistent cookies administered by us that enable us to remember your choices when using the Website, such as login details or language preferences. The purpose of these cookies is to provide you with a more personalized experience and eliminate the need to re-enter your preferences each time you use the Website.
Tracking and Performance Cookies. These are persistent cookies administered by third parties that are used to track data about Website traffic and user behavior. The data collected through these cookies may directly or indirectly identify you as an individual visitor. Typically, this data is linked to a pseudonymous identifier associated with the device you use to access the Website. Additionally, we may use these cookies to test new pages, features, or functionalities of the Website and assess user response.
Targeting and Advertising Cookies. These are persistent cookies administered by third parties that track your browsing habits to enable us to display advertising that is more likely to be relevant and of interest to you. They use data about your browsing history to group you with other users who share similar interests. With our permission, third-party advertisers can place cookies to display advertisements that align with your interests while you browse third-party Websites.

If you have any further questions or concerns about our use of tracking technologies and cookies, please contact us at privacy@alchemyrpg.com.

DATA COLLECTED BY THIRD PARTIES

BUSINESS PARTNERS

During collaboration with our business partners on joint ventures, we may be privy to certain data about you, shared by them. This data can include, but is not limited to, campaign data and contact data.

To respect your privacy, we strive to ensure that all users are provided with the opportunity to actively consent (“opt-in”) to receive marketing communications. We strongly encourage our business partners to adhere to similar privacy-conscious practices. Where consent is gathered in connection with a campaign, the opt-in will apply to communications from us and our business partners.

You may also have the option of sharing additional data with us through your third-party platform's account. If you choose to provide such data and personal data, during registration or otherwise, you are giving the us permission to use, share, and store it in a manner consistent with this Policy.

Please note that the use of your data by third-party platforms will be governed by their own privacy policies and terms of service. We encourage you to review these policies before providing them with any personal data.

DATA DISCLOSURES

DATA SHARED

We may share your personal data in the following circumstances:

With Service Providers. We engage trusted Service Providers to assist us in delivering and enhancing our service, including but not limited to monitoring and analyzing usage, providing advertisements, processing payments, and facilitating communication with you. These Service Providers have access to your personal data only to the extent necessary to perform their tasks on our behalf and are obligated to handle it securely and in accordance with applicable privacy laws.
Facilitating Business Transfers. In the event of a merger, acquisition, financing, or sale of our business or assets, your personal data may be shared or transferred to the involved parties as part of the transaction. We will take appropriate measures to ensure the protection of your personal data during such transfers.
With Affiliates and Partners. We may share your data with our affiliates, parent company, subsidiaries, joint venture partners, or other trusted business partners, as necessary, to provide you with products, services, or promotions that may be of interest to you. We will require these entities to respect and abide by this Policy.
With Creator Partners. We may share your anonymized and aggregated data with participants in our Creator Partner Program. This data will be used to generate reports for the Creator to gauge the health of their Marketplace Content. Aggregated reports include metrics such as total number of views / downloads, number of active games using the asset, and number of times the asset was equipped.
Public Interaction. Certain features of our service may allow you to interact with other users or post content in public areas. Please be aware that any data you disclose or share in these public areas becomes publicly available, and caution should be exercised when sharing personal or sensitive data.
With Your Consent. We may disclose your personal data for purposes other than those described above when we have obtained your explicit consent to do so.

Regardless of where you are located, we handle and share your personal data in compliance with applicable data protection laws, including the GDPR and CCPA. Your privacy and the security of your personal data are important to us, and we take appropriate measures to protect your data from unauthorized access, disclosure, alteration, or destruction.

DATA SOLD

In certain jurisdictions, the act of sharing, transferring, disclosing, or otherwise making available a user's personal data to a third party can be considered as a "sale", particularly when such activities are undertaken for some form of valuable consideration. Please note that "valuable consideration" does not necessarily mean a monetary exchange; it can include various other forms of benefit.

As per our existing practices and as of the effective date of this Policy, we want to assure you that we do not engage in such activities. Specifically, we do not share, and have not shared, personal data for valuable consideration.

Any data we share is outlined and strictly bound by the terms of this Policy. These circumstances involve our commitment to improving the services, complying with legal obligations, or facilitating essential operational aspects of Alchemy RPG. In all these instances, the privacy, security, and integrity of your personal data remain our top priority.

SERVICE PROVIDERS

Service Providers are third-parties or processors that may interact with your personal data during the provision of our services. Their roles and the data they handle can be distinguished as follows:

Analytics Processors. Analytics processors are used to monitor and analyze the usage of our service. They collect and process data related to user behavior, website traffic, and service use. They help us understand how our service is being used, which features are most popular, and where we can make improvements. An example is Google Analytics.
Email Marketing Processors. Email marketing processors manage and execute our email marketing campaigns. They handle the sending of emails and measure the performance of these campaigns, such as open rates and click-through rates. They also manage user email preferences and opt-out requests. An example of an email marketing processor we use is Mailchimp.
Payment Processors. Payment processors are tasked with securely handling all payment transactions made through our service. They collect and store payment card details and process payments for purchases made on our service. They adhere to strict industry standards for payment processing, such as PCI-DSS, to ensure secure handling of your payment data. An example is Stripe.
Usage, Performance, and Miscellaneous Processors. We may work with other third-party service providers to enhance the performance and functionality of our service. These can include services that improve user experience, such as captcha services like Login No Captcha reCAPTCHA, or services that ensure the smooth running of our service.

It's important to note that these data processors have their own privacy policies, which we encourage you to review. While we select these processors carefully and aim to work only with those that respect user privacy, we do not have direct control over their data handling practices.

DATA TRANSFERS

Your personal data may be processed at our offices in the United States and on our servers in Ireland. This means that your data may be transferred to, and stored on, computers located outside of your state, province, country, or other governmental jurisdictions where the data protection laws may differ from those in your jurisdiction.

For instance, if you're accessing our service from Ireland, your data is likely to load from our servers in Ireland, thereby ensuring a smoother and faster user experience.

By using our service, you acknowledge and understand these data transfers. Rest assured, we take all reasonable steps necessary to ensure your data is treated securely and in accordance with this Policy.

Please note, we will not transfer your personal data to an organization or a country unless we can guarantee appropriate measures are in place to secure your data and uphold your privacy rights.

DATA RETENTION & SECURITY

DATA RETENTION

We retain your personal data only for as long as is necessary for the purposes set out in this Policy, to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. The specific retention periods for different categories of personal data are as follows:

Account Information. We retain your account data for as long as your account is active and for a reasonable period thereafter to comply with legal requirements.
Usage Data. Usage Data is retained for internal analysis purposes. It is generally retained for a shorter period, except when this data is used to strengthen the security or to improve the functionality of our service or when we are legally obligated to retain it for longer time periods.
Job Application Data. If you apply for a job with us, we will retain your job application data for a reasonable period after the hiring process is complete or as required by applicable law.

Please note that even if we delete your personal data, it may persist in backup or archival copies for a reasonable period.

DATA SECURITY

We take the security of your personal data seriously and implement appropriate technical, physical, and administrative measures to protect it from unauthorized access, use, or disclosure. These measures include, but are not limited to:

Encryption. We use encryption technologies to safeguard your sensitive data during transmission and storage.
Access Control. Access to your personal data is restricted to authorized personnel and service providers who require it to perform their duties.
Regular Audits. We conduct regular audits and assessments of our data security practices to identify and address potential vulnerabilities.
Employee Training. Our employees and service providers undergo privacy and security training to ensure the protection of your data.

However, no method of transmission or storage is 100% secure, and we cannot guarantee the absolute security of your personal data. If you believe your account or personal data has been compromised, please contact us immediately at privacy@alchemyrpg.com.

DATA BREACH NOTIFICATION

In the event of a data breach that affects your personal data and where legally required, we will promptly notify you and the appropriate authorities. Our notification will include the nature of the breach, the types of data affected, and any recommended steps you should take to protect your data.

YOUR RIGHTS & CONTROLS

YOUR RIGHTS

Regardless of your location, we are committed to respecting and processing your rights request related to your personal data. Depending on the local regulations, you may have various rights, including:

The Right to Notice. You have the right to be informed about the categories of personal data being collected and the purposes for which it is used.
The Right to Access. You can request access to your personal data, update or delete the data we have on you, and receive a copy of the personal data we hold.
The Right to Correction. You have the right to request the correction of any incomplete or inaccurate data we hold about you.
The Right to Object. You can object to the processing of your personal data based on your situation, including processing for public interest purposes or direct marketing.
The Right to Erasure. You can request the deletion or removal of your personal data when there is no valid reason for us to continue processing it.
The Right to Restrict Processing. You can request the restriction of processing your personal data in certain circumstances, such as when the accuracy of the data is contested, or the processing is unlawful.
The Right to Data Portability. You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another entity if the processing is based on consent or contract.
The Right to Withdraw Consent. If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time, which may affect your access to certain functionalities of the service.
The Right not to be Subject to Automated Decision-Making. You have the right not to be subject to decisions based solely on automated processing, including profiling, that significantly affect you, unless there are specific exceptions.

EXERCISING YOUR RIGHTS

To exercise your data protection rights, please contact us using the data provided below. We may require you to verify your identity before responding to your request. We will make every effort to respond to your request in a timely manner and in accordance with applicable data protection laws.

If you have any questions about this Policy or wish to exercise your rights, you can contact us by emailing:

Alchemy RPG

Attn: Data Protection Team

2355 State St., Ste. 101

Salem, OR 97301

United States

privacy@alchemyrpg.com

Please note that certain rights and their applicability may vary depending on the jurisdiction and specific legal requirements. We will handle your requests in accordance with the data protection laws applicable to your jurisdiction.

If you have concerns about our collection and use of your personal data, you have the right to lodge a complaint with your local data protection authority.

YOUR CONTROLS

ACCOUNT

If you sign up for our services and create an account, we provide you with options to customize your privacy preferences within your account settings. By adjusting these settings, you can actively manage the level of access and visibility of your personal data, ensuring that your privacy aligns with your individual preferences.

EMAIL

If you receive an unwanted email from us, you can use the unsubscribe link found at the bottom of the email to opt-out of receiving future emails. Note that you will continue to receive transaction-related emails regarding products or services you have requested.

We may also send you non-promotional communications regarding us and our services or updates to our Terms or this Policy.

DO NOT TRACK

We understand that some users may prefer not to be tracked while browsing the internet. However, our service does not currently respond to “Do Not Track” (“DNT”) signals sent by web browsers. The reasons for this decision are:

DNT is not a universally standardized feature among web browsers, and its implementation and interpretation vary widely.
The industry is still evolving with respect to responding to DNT signals, and there is no consensus on how to interpret and act upon such signals.
As a result, our service does not currently alter its data collection and tracking practices based on DNT signals.

While our service does not respond to DNT signals, you can set your browser preferences to inform websites that you do not want to be tracked. You can enable or disable the DNT option in your browser settings.

ADVERTISING

If you prefer not to receive marketing messages or sponsored content, please contact us at help@alchemyrpg.com and we will ensure your preferences are updated accordingly.

Some third-party services we use may offer opt-out options to their data collection practices. You can find information about how to opt-out of these services by visiting the following links:

COOKIES

You may stop or restrict the placement of technologies on your device or remove them by adjusting your preferences as your browser or device permits. However, if you adjust your preferences, our services may not work properly.

You can also opt-out of targeted advertising from data and advertising partners participating in self-regulatory programs through the websites provided by the online advertising industry. For more information on targeted advertising, consumer choice, and privacy, please visit the following websites:

Please note that you must opt-out separately for each browser and device used.

GENERAL PROVISIONS

LINKS TO OTHER WEBSITES

Our service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's website. We strongly advise you to review the privacy policy of every website you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party websites or services.

CHANGES TO THIS PRIVACY POLICY

We may update this Policy from time to time. We will notify you of any significant changes by sending a direct notification to your email address or through a prominent notice on our service prior to the change becoming effective. We encourage you to review this Policy periodically for any changes. Changes to this Policy are effective when they are posted on this page.

We will let you know via email and/or a prominent notice on our service, prior to the change becoming effective and update the “Last updated” date at the top of this Policy.

CONTACT INFORMATION

CONTACT A DATA PROTECTION AUTHORITY

If you have concerns about our collection and use of your personal data, we encourage you to contact us first so that we can try to resolve your concerns. However, as a California or European Union (EU) resident, you have the right to file a complaint with the California Attorney General's office or any other relevant Data Protection Authority (“DPA”) if you believe your data privacy rights have been violated. We encourage you to contact us first so that we can try to resolve your concerns. However, you may also contact your local DPA directly. To contact your local DPA, please refer to the links below:

To contact your local DPA, refer to the links below:

California - Attorney General of California
Europe - DPA Directory

Where appropriate, your local DPA may also forward the matter to the Department of Commerce or FTC for consideration.

CONTACT US

If you have any questions, concerns, or requests regarding this Policy or the processing of your personal data, you can contact us using the following details: