1. Who is responsible
For visitors and users in the European Economic Area and the United Kingdom, the controller of the personal data described in our Privacy Policy is the Opal team, reachable at support@mail.opal.wtf. Contacting that address is the fastest way to reach the people who actually operate the data.
2. What this page covers
This page supplements the Privacy Policy for people protected by the General Data Protection Regulation. It explains the legal bases we rely on, the rights the GDPR gives you, and how to use them. The Privacy Policy remains the full description of what we collect.
3. Legal bases for processing
Article 6 of the GDPR requires a legal basis for each use of personal data. Ours are:
| Processing activity | Personal data | Legal basis |
|---|---|---|
| Accounts and sign-in | Username, email, password hash, session records | Contract, Art. 6(1)(b) |
| Purchases and delivery | Order records, billing email, payment reference | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c), for accounting records |
| License enforcement and anti-abuse | Device identifiers, device sessions | Legitimate interests, Art. 6(1)(f): preventing license sharing and fraud |
| Chat and content moderation | Chat messages, shared scripts | Legitimate interests, Art. 6(1)(f): keeping the community safe |
| Transactional email | Email address | Contract, Art. 6(1)(b) |
| Error monitoring | Error context, masked replay samples | Legitimate interests, Art. 6(1)(f): fixing defects |
| Website analytics | Anonymous aggregates only | Not personal data once anonymized; the anonymization step relies on legitimate interests, Art. 6(1)(f) |
4. Your rights
The GDPR gives you the right to:
- Access the personal data we hold about you (Art. 15).
- Correct inaccurate data (Art. 16).
- Have your data erased (Art. 17).
- Restrict processing while a dispute is resolved (Art. 18).
- Receive your data in a portable format (Art. 20).
- Object to processing based on legitimate interests (Art. 21).
To exercise any of these, email support@mail.opal.wtf. We respond within one month, and we will tell you if we need longer for a complex request.
5. Automated moderation
Chat messages and shared scripts are screened by an automated moderation system. If an automated decision restricts your account and you believe it was wrong, contact support and a person will review the decision. No other decisions about you are made solely by automated means.
6. International transfers
Our infrastructure and some of our service providers process data in the United States. Where the GDPR requires safeguards for such transfers, we rely on our providers' compliance mechanisms, including standard contractual clauses.
7. Retention
Retention periods are described in the Privacy Policy: account data for the life of the account, order records as long as accounting law requires, and moderation logs for limited periods. Anything else is deleted when it stops being needed.
8. Complaints
If you believe we have processed your data unlawfully, you have the right to lodge a complaint with a supervisory authority in your member state (Art. 77). We would appreciate the chance to resolve the issue directly first: email support@mail.opal.wtf.
