Legal information

Privacy contact: privacy@northvektorlabs.com. support@northvektorlabs.com remains the main customer entry point. We route requests internally; you do not need to resend your request to another address.

The separately published account notice identifies the party responsible for the account service. That identity must not be confused with a different contracting party or controller.

When you contact us, we use the contact details, message and relevant account references you provide to understand and answer your enquiry. Do not send card details to support. The separate account notice describes accounts, email verification, sign-in and participation.

Support messages and limited security and operational information are used to handle enquiries, protect the service and investigate faults. We retain which contract documents and offers were displayed and accepted. Public participation, predictions and rankings are described in the account notice.

Enquiries about the account service and necessary steps you request before a contract are processed for the relevant contractual purpose under GDPR Article 6(1)(b). Limited security and diagnostic data is processed for the legitimate interests in preventing abuse, protecting accounts and maintaining reliable operation described in the account notice, under Article 6(1)(f), subject to necessity and balancing. You may object and request information about that assessment. Handling rights requests follows the specific duties in data protection law under Article 6(1)(c). These bases do not authorize general use for other purposes.

Required account and payment information is necessary for the related service; optional fields are labelled separately. Optional analytics and automatic browser preferences have separate consent choices. Accepting the agreement is not that consent.

Stripe provides payment functions, Vercel web hosting and optional analytics, MongoDB Atlas storage, Railway background services and Resend transactional email. Google handles the domain’s incoming email. Verified Vercel runtime configuration includes the USA and Sweden. The service’s Atlas snapshots examined are located in Sweden. Resend states that data is stored in the USA even when email is sent from Europe. A selected region alone does not establish where all support, access and other processing occur.

Vercel’s standard terms for the active Pro plan incorporate its DPA (https://vercel.com/legal/dpa); Schedule 3 describes the EU Standard Contractual Clauses for relevant transfers outside the EEA. Resend’s DPA is incorporated at signup (https://resend.com/legal/dpa); Section 6 describes corresponding clauses. Module Two is relevant for customer data where we are the controller and the provider is the processor. You can read the agreements at those links and request a copy of relevant safeguards at privacy@northvektorlabs.com. This describes the contractual basis, not a general certification of all processing.

The account data linking an enquiry to you is governed by the specific criteria in the account notice:

We retain account and profile information while providing your account and the features you use. Requests to close an account or delete information are handled manually through the privacy contact; there is no general self-service account-erasure button. On a request, we assess which records can be deleted and which remain necessary for completed game records, security incidents, legal obligations or the establishment, exercise or defence of claims. We explain any applicable retention reason and period or criterion when responding.

Verification links expire after 24 hours; their token records are marked for retention expiry 30 days after issue. This is not a universal 30-day deletion rule. Session expiry, provider logs and backups have separate lifecycles. We do not promise immediate deletion from every provider or backup.

This version does not set new retention periods for future paid subscriptions, payments or accounting material. Before such processing starts, the data types, relevant purpose and retention period or specific criteria must be stated for that service. A future bookkeeping obligation or standard period is not assumed to apply to all data. For a particular enquiry, you can ask the privacy contact which data is retained, why and for what period or criterion; this is not a promise of automatic erasure when a case closes.

Transactional messages and delivery logs at Resend are retained for 30 days on the service’s current Free plan, according to Resend’s stated arrangement. Resend backups persist for 7 days. This covers Resend’s delivery copy, not a general erasure deadline for incoming enquiries in Google email or other server data.

Atlas backups of data stored by the service have separate expiry periods: snapshots taken every six hours and daily snapshots are retained for 7 days, weekly snapshots for 4 weeks, monthly snapshots for 12 months and yearly snapshots for 1 year. Point-in-time recovery has a 7-day window. These are not erasure deadlines for active account records, and immediate selective erasure from every backup is not promised.

Cookies and browser storage describes names, purposes, providers, lifetimes and choices. Browser storage lifetime is different from server-data retention. You can change or withdraw optional browser choices in Cookie settings.

Where the statutory data-protection conditions are met, you can request access, correction, deletion, restriction or portability and object to processing. You can withdraw consent without affecting the lawfulness of earlier processing. Send requests to privacy@northvektorlabs.com. Only necessary and proportionate information may be requested to verify identity.

You are entitled to a response without undue delay, normally no later than one month after receipt. A lawful extension due to complexity or the number of requests must be explained within the first month; the deadline may be extended by up to two further months. You may complain to Datatilsynet (https://www.datatilsynet.no/) or another competent supervisory authority, particularly where you usually live, work or believe an infringement occurred.

We identify the document version and actual effective date. For new processing purposes, you must receive relevant information before the data is used for the new purpose.

Account information, contract acceptance and optional consents have separate purposes. An updated notice does not create consent or rewrite earlier acceptance or acknowledgements.