Privacy policy

Gamentix S.L. (Calle Real, Alcobendas, Madrid, Spain) is the controller of the personal data described here. Data-protection requests, and anything else, go to hello@gamentix.com.

• Account. Email address, password hash (we never store the password itself), display name if you set one, role in your organization, email verification status, and the Google account identifier if you sign in with Google.
• Billing. Your Stripe customer and subscription identifiers, plan, period dates and invoice status. Card numbers never reach our servers; Stripe holds them. Your VAT number, if you add one, is stored by Stripe and shown on invoices.
• Usage. Login sessions (a random token, creation time, expiry), the pages you open inside the app with a timestamp and IP address, server errors tied to your session, and alert-delivery settings (Telegram chat id, Discord webhook URL or email) you configure.
• Messages. What you write to us through Contact us, the emails you send us, and verification requests for game claims.
• Data you connect. If you ever share Steamworks sales or wishlist figures for your own games with us, we treat them as business figures but protect them as if they were personal.

Across the whole site, the signed-in dashboard included, we use Umami, a privacy-focused analytics tool that stores no cookies and no personal identifiers; it counts page views in aggregate. Invitation e-mails we send carry a tracking link and open detection, and we record in Umami whether an invitation was delivered, opened and clicked and how far it went (account, trial, checkout), keyed by an invitation number and your e-mail domain, never your address.

The Service analyzes content that people publish about games: Steam reviews and discussion threads, YouTube videos and comments, Twitch streams, news articles. That content can include a username, a public profile link, the text of a review or comment, its date and the votes it received. We process it to compute sentiment and trends for the game it is about, and we show excerpts with a link to the original so the analysis is verifiable.

• Legal basis: legitimate interest in analyzing public discourse about a product for its own maker, balanced against the fact that the content was already made public by its author on a platform designed for public discussion.
• We do not build profiles of individual reviewers or commenters, do not contact them, and do not combine their activity across games or platforms.
• Authors can ask us to remove or anonymize their content in our systems: email hello@gamentix.com with the link. We also honor removals at the source: content deleted on the platform disappears from our views as our collectors re-read it.

• To provide the Service you asked for: accounts, claims, dashboards, alerts, reports, billing (performance of a contract).
• To keep the Service secure and to debug it: sessions, request logs, error records (legitimate interest).
• To answer you when you write to us (legitimate interest, or contract when it concerns your account).
• To send you service emails: verification, password reset, claim decisions, billing and alerts you configured (contract). We do not send marketing newsletters; if we ever do, it will be opt-in.
• To comply with tax and accounting law: invoices and payment records (legal obligation).

We use only cookies that are needed to run the app, so there is no consent banner:

• gmx_session: keeps you logged in. Expires when you close the browser, or after 30 days if you chose “remember me”.
• gmx_csrf: protects forms against cross-site request forgery.
• gmx_org: remembers which organization you are viewing.
• gmx_game: remembers which game you are viewing.
• gmx_invite: carries an invite code from the invite link to your new account, for up to 30 days.
• gmx_ref: the invitation number from an invitation e-mail link, so analytics can tell the visit came from that invitation, for up to 30 days.
• Short-lived one-shot cookies that carry a message across a redirect (for example the email to prefill after an unverified login attempt).

No advertising or cross-site tracking cookies, ours or anyone else’s.

We use a small number of providers, each under a data-processing agreement, only for the purpose stated:

• Stripe (payments, invoices, tax ids). Stripe is an independent controller for the payment itself.
• Resend (transactional email delivery).
• Google (optional sign-in with Google; Google only tells us your email and account id).
• Anthropic (AI analysis of public reviews, comments and posts, and generation of report text). We send the public content, never your account data. Anthropic does not train on API data.
• Telegram (only if you connect a Telegram chat for alerts).
• Discord (only if you connect a Discord webhook for alerts).
• Our hosting provider in the European Union, where the database and application run.

Some of these providers are in the United States; transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. We do not sell personal data and we do not share it with advertisers.

• Account data: while the account exists, then deleted within 30 days of a deletion request, except what tax law requires us to keep (invoices, up to the statutory period).
• Sessions: until expiry or logout. Request and error logs: 14 days.
• Messages you send us: while the account exists and up to 12 months after, for support history.
• Steamworks sales or wishlist figures, only if you ever share them with us (we collect none ourselves): while the claim exists; deleted with the account or on request.
• Public content and derived scores: for as long as the game is tracked; content deleted at the source drops out as collectors re-read it, and on request as described above.

Under the GDPR and equivalent laws you can ask for access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Write to hello@gamentix.com from the email on your account; we answer within one month. You can also complain to your national data-protection authority (in Spain, the Agencia Española de Protección de Datos).

Passwords are hashed, sessions are random tokens stored hashed, traffic is encrypted in transit, secrets are kept out of the code, and access to production is limited to the people who run the Service. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

The Service is for professionals and is not directed at anyone under 18. We do not knowingly collect data from minors.

We will update this policy when the Service or the law changes and note the effective date at the top. Material changes are announced by email or in the app. The Terms of service and the Legal notice complete this document.