Controller

Laware GmbH, Seitenstettengasse 5/37, 1010 Vienna, Austria
Email: office@laware.gmbh

How we process data

Website delivery and security

Vercel hosts Minimal Sudoku and necessarily processes request information such as IP address, requested URL, timestamps, user agent, response status and security events to deliver and protect the service. The legal basis is performance of the requested service and our legitimate interest in reliable, secure operation (Article 6(1)(b) and (f) GDPR).

Accounts and authentication

If you create or link an account, we process the information required for authentication and account management, such as email address, username/display name, password verifier, session data, passkey public-key information, and Google or Discord account identifiers when you choose those sign-in methods. The legal basis is performance of the account service you request (Article 6(1)(b) GDPR). Security logging is also based on our legitimate interests (Article 6(1)(f) GDPR).

Games and community features

Depending on the features you use, we process game results, times, difficulty, achievements, challenges, rankings, ratings and synchronization data. Anonymous play can remain on your device; signed-in features store the necessary records in our database. Processing is necessary to provide the requested features (Article 6(1)(b) GDPR).

Purchases and subscriptions

Purchases may be processed by Stripe, Apple App Store, Google Play or Microsoft Store. We receive and store the provider and sales channel, selected product, transaction, order or subscription identifiers, purchase token where used by a store, payment and subscription status, entitlement period, renewal/cancellation state, refunds, the Minimal Sudoku account association, and the provider events needed to keep access accurate. Payment-card and wallet credentials are handled by the payment provider, not Minimal Sudoku.

For a direct web order, Stripe processes contact and billing details, payment method information, billing country/address, tax calculation data, fraud-prevention signals, checkout consent, invoices and receipts. We send Stripe the account reference, selected plan, checkout legal-document version, and return URLs. For Google Play billing, Google processes the Play account and payment; we receive the product and purchase token/order information necessary to verify, acknowledge, restore, cancel, refund, and synchronize the entitlement through Google's developer services. Apple and Microsoft perform comparable store functions for purchases made through their channels.

Processing is necessary to enter into and perform the purchase contract, prevent duplicate or fraudulent entitlements, handle withdrawal/refund requests, and meet accounting and tax obligations (Article 6(1)(b), (c), and, for security evidence, (f) GDPR). Purchase records are not used for advertising.

Optional analytics

Umami Cloud, Vercel Web Analytics and Vercel Speed Insights load only after you select Allow optional services, or allow analytics separately under Privacy settings. They measure page views, broad referral and device categories, country-level location, anonymous sessions, selected product events and web-performance metrics. Query strings, URL fragments and identifiers in dynamic routes are removed before transmission. We do not send account identifiers or email addresses and do not use Umami's identification function. The legal basis is your consent (Article 6(1)(a) GDPR and § 165(3) TKG 2021).

Consent is optional and can be changed at any time through Privacy settings in the footer. Withdrawal does not affect processing that occurred before withdrawal or any core feature.

Feedback and contact

We process messages and contact details you submit so we can respond. The Sleekplan feedback SDK is blocked until you select Allow optional services, allow the widget separately in Privacy settings, or consent in the contextual Feedback prompt. Even after consent, the SDK does not load until you click Feedback. Once loaded, the embedded widget transmits technical connection information to Sleekplan, including IP address, approximate location, operating system and browser version, and uses first-party cookies and local storage as detailed in our Storage and Analytics Policy. Sleekplan states that its servers are in the European Union. The legal basis for loading the widget, accessing device storage and processing its technical data is your consent (Article 6(1)(a) GDPR and § 165(3) TKG 2021).

Information you deliberately submit through the widget may include your name, email address, feedback, votes and comments. We and Sleekplan process it to receive, manage and respond to your request (Article 6(1)(b) or (f) GDPR). Google Forms loads only after you explicitly load the form. Alternatively, you can contact us directly by email without using either provider.

Browser storage

Essential session, game, preference, quota and offline storage is used to provide features you request. Analytics and Sleekplan feedback-widget storage/access are optional. Details and durations are provided in our Storage and Analytics Policy.

Recipients and international transfers

Data is disclosed only as necessary to hosting and database providers, Umami, authentication providers, Stripe, Apple, Google Play/Google developer services, Microsoft Store, Sleekplan, Google Forms, professional advisers and public authorities where legally required. A payment or app-store provider also acts under its own privacy notice for the payment account, checkout, store and fraud controls it operates. Some providers may process data outside the EEA. Where applicable, transfers are protected by an adequacy decision, the EU-US Data Privacy Framework, Standard Contractual Clauses or another lawful safeguard provided for by the GDPR.

Retention

• Account and gameplay records are kept while the account is active and then deleted or anonymized, subject to necessary backups, abuse prevention and legal claims.
• Billing, purchase, refund, checkout-consent and accounting evidence is generally retained for seven years after the end of the relevant accounting period where Austrian commercial or tax law requires it. Individual records may be kept longer only while needed for an audit, enforceable legal claim, fraud dispute, or another binding legal duty.
• Operational provider payloads and webhook records are reduced or deleted when they are no longer needed to prove and synchronize the purchase, subject to the accounting, tax and legal-claim periods above.
• Security logs are retained only for the operational periods configured with our hosting provider unless an incident requires longer preservation.
• Analytics are retained according to the configured provider plan and only as long as reasonably needed for trend and performance analysis.
• Contact and feedback records are retained until the request is resolved and thereafter only as needed for legal claims or documentation.

Your rights

Subject to the GDPR's conditions, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time. Contact us at office@laware.gmbh. You may also lodge a complaint with the Austrian Data Protection Authority.

Changes

We may update this policy when the service or legal requirements change. Material changes will be indicated by updating the date above and, where appropriate, through an in-product notice.