Xeester, the publisher of the Opencards software, is the controller of the personal data collected on the website www.opencards.net and by the Opencards software.
Xeester is committed to protecting your privacy and to complying with Regulation (EU) 2016/679 of April 27, 2016 (the "GDPR") and the French Data Protection Act of January 6, 1978, as amended.
01Contact us
For any question about your data or to exercise your rights, write to contact@opencards.net, or by post to Xeester, 9 villa Wagram Saint-Honoré, 75008 Paris, France.
02Why we process your data
- to create and manage your account, and to sign you in to the site and the software;
- to sell software licences, invoice them and check that they are valid;
- to answer your support requests and complaints;
- to run the publishing of replays;
- to send you the emails the service needs (forgotten password, invoices) and, if you asked for it, the newsletter;
- to let you know when Opencards launches, if you joined the waiting list;
- to keep the site and the software secure (protection against bots, abuse and account sharing).
This processing is based on our contract with you (your account and your licence), on our legal obligations (invoicing), on our legitimate interest (security) and, for the newsletter and the waiting list, on your consent.
03The data we process
Your account: first name, last name, email address, username, password (stored in a hashed form we cannot read back), country, language, how you heard about us, your newsletter choice and, if a partner sent you, their affiliate code.
Billing: name, address, company, VAT number and phone if you provide them, your licences, your payments and your invoices. Card numbers are entered with our payment providers: we never receive them.
The software: the computer's name and identifier, MAC address, IP address, operating system, software version, sign-in dates and the volume of hands played. We use them to check your licence, to limit the number of computers per licence and to help you when something goes wrong. If you tick "Remember me", the computer receives a sign-in token, which you can revoke at any time in "My account".
The waiting list: your email address and the language of the page where you signed up, to write to you in your language at launch.
Replays: the replays you publish, with your username.
Support: your requests, our exchanges and the useful technical details (logs, screenshots you send us).
Security: IP address, sign-in dates and times, failed sign-in attempts.
04Signing in with Discord or Google
If you choose to sign up or sign in with Discord or Google, that service sends us, with the consent you give on its own screen:
- the identifier of your Discord or Google account;
- your email address, and whether that service has verified it;
- your name (Google: first and last name; Discord: display name).
We do not use or store anything else it sends (profile picture, language…). We never receive your Discord or Google password, nor your contacts, messages or files.
This data is used only to sign you in: to find your Opencards account (by the identifier, or by an identical verified email address), to link it to your Discord or Google account, and to pre-fill the sign-up form. We store the identifier, the email address, the name, and the dates of linking and of the last sign-in.
We do not sell it, do not use it for advertising and do not share it with anyone. You can unlink Discord or Google at any time in "My account": the link and its data are then deleted. They are also deleted with your account.
Opencards' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
05Who receives your data
- the Xeester team, for what it needs in its work (support, billing, technical administration);
- our service providers, who process it on our behalf and on our instructions:
- Amazon Web Services: hosting of the site, the database and the replays, in Paris (European Union);
- Resend: sending emails and the waiting list;
- Cloudflare: protecting forms against bots (Turnstile);
- our payment providers, for payments;
- other members, for what you make public: your published replays and your username.
Some providers are established outside the European Union, notably in the United States. These transfers are covered by the safeguards provided for by the GDPR (the European Commission's standard contractual clauses or the EU–US Data Privacy Framework).
06How long we keep it
-
Account: as long as it is active. When you delete it ("My account" or on request), your data is erased or anonymised.
-
Invoices and payments: 10 years, as required by the French Commercial Code, even after the account is deleted.
-
Waiting list: until the launch email, and at most 12 months after you sign up; sooner if you unsubscribe (link in the email) or simply ask.
-
Support: 2 years after the request is closed.
-
Exchanges with our providers: 5 years after the end of the service concerned.
-
Technical logs: 6 months.
-
IP address and sign-in dates (security checks): 2 years.
07Cookies
The site uses no advertising cookies and no audience measurement tools. The only cookies are those it needs to work; they do not require consent.
| Cookie | What it is for | Lifetime |
|---|---|---|
xw_member | Keeping you signed in to the site | 30 days |
xw_oauth, xw_oauth_pending | Completing a sign-in with Discord or Google | 10 to 30 minutes |
xw_referer | Remembering the partner who sent you, until you sign up | Session |
xeester_publish | Publishing a replay from the software | 24 hours |
xw_staff, xw_staff_pending | Team sign-in to the back office | 10 minutes to 12 hours |
Your theme choice (light or dark) is kept in your browser, not on our servers. On forms, Cloudflare's bot protection (Turnstile) analyses technical information about your browser to tell a human from a bot.
You can delete cookies in your browser settings; you will then be signed out.
08Security
We protect your data with appropriate measures: encrypted connections (HTTPS), hashed passwords, access limited to the team members who need it, limits on sign-in attempts, and backups.
Should a breach of your data pose a high risk to you, we would inform you as soon as possible.
09Your rights
At any time, you can:
- access your data and receive a copy of it;
- correct it (most of it directly in "My account");
- erase it, by deleting your account in "My account" or on request;
- restrict its processing or object to it, in particular to direct marketing (you can unsubscribe from the newsletter at any time);
- receive it in a common, machine-readable format (portability);
- withdraw your consent, where processing is based on it;
- give instructions about what happens to your data after your death.
Write to us at the address in section 1. We answer within one month. If we have reasonable doubts about your identity, we may ask you for proof.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL): www.cnil.fr/en, or with the authority of the EU country where you live.
10Minors
The site and the software are for adults only. We do not knowingly collect data about minors.
11Changes
We may change this policy to follow changes to the site or to the law. If the change is significant, we will let you know by email or on the site.