Privacy policy

1. Controller and contact

Flowpatrol UG (haftungsbeschränkt), Lindenberger Str. 38, 06712 Schnaudertal, Deutschland, is the controller for our website, accounts, billing and service administration. Managing Director: Liliya Yakusheva. Contact contact@dashpop.com for privacy questions or rights requests. See the Imprint for our registration information.

This notice covers visitors, account holders and people contacting us. A creator distributing a game may be separately responsible for player data. If we process personal data solely on a business customer’s instructions, the applicable data-processing agreement governs that processing. Contact us to agree one before submitting that data.

2. Data, purposes and legal bases

Website delivery and security: IP address, request time, requested URL, browser/device information and error or security events are processed to serve pages, diagnose faults and prevent abuse. The basis is Article 6(1)(f) GDPR: our legitimate interests in operating a reliable, secure service. Requested account functions also rely on Article 6(1)(b).

Where configured, account sign-in, signup and password-recovery forms use Cloudflare Turnstile to prevent automated abuse. Loading the security check sends Cloudflare network and browser signals, such as your IP address and browser/device information. Supabase verifies the resulting challenge token before processing the account request. Dashpop does not send project files or prompts through this security check. This protects the requested account function under the security purposes and legal bases described above.

Accounts and contracts: email address, account identifier, authentication information, workspace membership, settings and records of terms acceptance are used to establish and perform your contract (Article 6(1)(b)). Authentication is handled through Supabase. We record the accepted document version and server time to evidence the agreement and resolve disputes (Article 6(1)(f)).

Creation and integrations: prompts, uploaded files, code, generated assets, project revisions, run messages and usage records are processed to carry out your requested creation, storage, preview and export operations (Article 6(1)(b)). These can contain personal data if you include it. Only send data needed for the task. Providers receive the content and context needed for the selected operation, not just the text of your last message.

Billing: billing contact, address, tax information, selected plan, purchase and subscription identifiers, usage and payment status support payment and service delivery (Article 6(1)(b)), accounting obligations (Article 6(1)(c)) and fraud prevention or claims (Article 6(1)(f)). Stripe collects payment details; Dashpop stores payment identifiers and statuses rather than full card numbers.

Support and rights requests: we use your message, contact details and relevant account information to respond, resolve problems and fulfil statutory duties (Article 6(1)(b), (c) or (f), depending on the request). We may request proportionate proof of identity when necessary to protect your data. Public cancellation declarations include your name, email, contract identification, requested end date and any extraordinary-cancellation reason. We record receipt and send a confirmation through Resend, with a copy to our support mailbox (Article 6(1)(b) and (c)).

The current website does not run advertising or audience analytics cookies. We do not treat accepting terms, reading this policy or opening the storage disclosure as permission for marketing. Any future optional processing that relies on consent must offer a separate choice before it starts (Article 6(1)(a)); you may withdraw it for the future without affecting earlier lawful processing.

3. Sources and required information

Most information comes from you or your use of Dashpop. We also receive authentication results, payment events and the results of integrations you request. Workspace members may provide shared project information. Account email and the data necessary for a selected paid or creation feature are needed to provide it; without them we cannot fulfil that request. Optional features can be left unused.

4. Recipients and international transfers

Access is limited to personnel and service providers who need data for their role, including hosting, authentication/storage, payment, email delivery, AI generation and support. The Providers page describes the services integrated in the product and the operations that use them. Connecting GitHub sends the selected repository/project information to GitHub. Publicly sharing a game makes its published content available to its audience; do not publish private data.

Depending on the feature and deployment, providers may process data outside the EU/EEA. Transfers require an applicable adequacy decision under Article 45 GDPR or safeguards under Article 46, such as standard contractual clauses and supplementary measures where necessary. Contact contact@dashpop.com for the recipient and transfer arrangements applicable to your workspace and a copy of relevant safeguards. A provider’s availability in the code does not mean every workspace uses it.

We may disclose necessary information to professional advisers or authorities to comply with law or establish, exercise or defend legal claims. We do not sell personal data. We do not use your private project content to train our own general-purpose AI models. Third-party processing must be assessed for the selected route; do not assume a zero-retention or EU-only provider configuration.

5. Retention and deletion

We retain account and project information while needed to provide your requested service. When you close an account or request deletion, we assess which data can be deleted and which must be retained for legal obligations, security incidents or claims. Shared projects may also involve other members’ rights. Data retained for a legal purpose must be restricted to that purpose.

The retention period depends on the record: operational logs are needed for fault and incident investigation; support correspondence for resolving and documenting the issue; contract evidence for the relationship and applicable claim periods; invoices and accounting records for the statutory retention period applicable to that record. Backups are removed through the applicable backup lifecycle and are not an alternative active account. Contact us for the period applying to your specific record or workspace.

Account → Privacy lets you export available account data and submit an erasure request. Export is paginated and an erasure request is not immediate deletion. You can instead email us, including if you cannot sign in. We coordinate necessary checks and confirm the outcome, including any lawful retention exception. Subscription cancellation is separately available in Billing or by contacting us.

6. Your rights

Subject to the GDPR’s conditions, you may request access and a copy, rectification, erasure, restriction and portability of data processed by automated means on the basis of consent or contract. Where we rely on legitimate interests, you may object on grounds relating to your situation. You can object to direct marketing at any time. Withdraw any optional consent as easily as you gave it; contact us if you need help.

Send requests to contact@dashpop.com. We normally respond within one month of receipt. If complexity or the number of requests requires an extension of up to two further months, we explain this within the first month. Requests are generally free; statutory exceptions for manifestly unfounded or excessive requests remain applicable.

You may complain to a supervisory authority, including where you live, work or believe a breach occurred. For our establishment in Sachsen-Anhalt, contact the Landesbeauftragte für den Datenschutz Sachsen-Anhalt at datenschutz.sachsen-anhalt.de. You do not need to contact us before complaining.

7. Automated decisions, children and changes

Dashpop uses AI to generate creative output. We do not use it to make decisions about you having legal or similarly significant effects within Article 22 GDPR. Automated access and balance checks may block an operation; contact us to review an apparent error. Accounts are intended for adults aged 18 or over. If you believe a child has supplied account data, contact us.

We update this notice when processing changes and communicate material changes appropriately. A new notice does not itself authorise a new use that requires consent. See the Cookies and storage page for device-storage details.