Controller

Laware GmbH, Seitenstettengasse 5/37, 1010 Vienna, Austria
Email: office@laware.gmbh

How we process data

Website delivery and security

Vercel hosts Minimal Sudoku and necessarily processes request information such as IP address, requested URL, timestamps, user agent, response status and security events to deliver and protect the service. The legal basis is performance of the requested service and our legitimate interest in reliable, secure operation (Article 6(1)(b) and (f) GDPR).

Accounts and authentication

If you create or link an account, we process the information required for authentication and account management, such as email address, username/display name, password verifier, session data, passkey public-key information, and Google or Discord account identifiers when you choose those sign-in methods. The legal basis is performance of the account service you request (Article 6(1)(b) GDPR). Security logging is also based on our legitimate interests (Article 6(1)(f) GDPR).

Games and community features

Depending on the features you use, we process game results, times, difficulty, achievements, challenges, rankings, ratings and synchronization data. Anonymous play can remain on your device; signed-in features store the necessary records in our database. Processing is necessary to provide the requested features (Article 6(1)(b) GDPR).

Purchases and subscriptions

Purchases may be processed by Stripe, Apple App Store, Google Play or Microsoft Store. We receive and store the provider and sales channel, selected product, transaction, order or subscription identifiers, purchase token where used by a store, payment and subscription status, entitlement period, renewal/cancellation state, refunds, the Minimal Sudoku account association, and the provider events needed to keep access accurate. Payment-card and wallet credentials are handled by the payment provider, not Minimal Sudoku.

For a direct web order, Stripe processes contact and billing details, payment method information, billing country/address, tax calculation data, fraud-prevention signals, checkout consent, invoices and receipts. We send Stripe the account reference, selected plan, checkout legal-document version, and return URLs. For Google Play billing, Google processes the Play account and payment; we receive the product and purchase token/order information necessary to verify, acknowledge, restore, cancel, refund, and synchronize the entitlement through Google's developer services. Apple and Microsoft perform comparable store functions for purchases made through their channels.

Processing is necessary to enter into and perform the purchase contract, prevent duplicate or fraudulent entitlements, handle withdrawal/refund requests, and meet accounting and tax obligations (Article 6(1)(b), (c), and, for security evidence, (f) GDPR). Purchase records are not used for advertising.

Optional image import

When you choose, drop or paste an image for puzzle import, we send it to our server and then to OpenAI to extract the Sudoku grid. Image import is optional; you can play and enter puzzles without uploading an image. The extracted grid returns to your device and may be saved with your games or synchronized with your account. Our application does not save the original uploaded image in its database.

OpenAI processes the image as an API service provider. Under its standard data controls, response data is stored for at least 30 days, and abuse-monitoring logs may retain customer content for up to 30 days. Safety or legal exceptions can require longer retention. See OpenAI's API data controls.

Anonymous audience measurement

We use Vercel Web Analytics and Umami to understand visitor numbers and how people use the game. They collect page views, selected game actions, and general device and location information without analytics cookies. We do not send your name, email address or account identifiers. We respect your browser's Do Not Track setting.

Optional analytics

Vercel Speed Insights loads only after you select Allow optional services, or allow analytics separately under Privacy settings. It measures web performance using redacted URLs. With this consent, we also store a purchase-attempt timestamp in your browser to count an eligible, confirmed web purchase once through Umami. This marker contains no account or transaction identifier and is removed on consumption, observed expiry or consent withdrawal. The legal basis for these optional services is your consent (Article 6(1)(a) GDPR and § 165(3) TKG 2021).

Consent is optional and can be changed at any time through Privacy settings in the footer. Withdrawal does not affect processing that occurred before withdrawal or any core feature.

Feedback and contact

We process messages and contact details you submit so we can respond. The Sleekplan feedback SDK is blocked until you select Allow optional services, allow the widget separately in Privacy settings, or consent in the contextual Feedback prompt. Even after consent, the SDK does not load until you click Feedback. Once loaded, the embedded widget transmits technical connection information to Sleekplan, including IP address, approximate location, operating system and browser version, and uses first-party cookies and local storage as detailed in our Storage and Analytics Policy. Sleekplan states that its servers are in the European Union. The legal basis for loading the widget, accessing device storage and processing its technical data is your consent (Article 6(1)(a) GDPR and § 165(3) TKG 2021).

Information you deliberately submit through the widget may include your name, email address, feedback, votes and comments. We and Sleekplan process it to receive, manage and respond to your request (Article 6(1)(b) or (f) GDPR). Google Forms loads only after you explicitly load the form. Alternatively, you can contact us directly by email without using either provider.

Browser storage

Essential session, game, preference, quota and offline storage is used to provide features you request. Optional analytics and Sleekplan feedback-widget storage/access require consent. Details and durations are provided in our Storage and Analytics Policy.

Recipients and international transfers

Data is disclosed only as necessary to hosting and database providers, Umami, authentication providers, Stripe, Apple, Google Play/Google developer services, Microsoft Store, Sleekplan, Google Forms, OpenAI for optional image extraction, professional advisers and public authorities where legally required. A payment or app-store provider also acts under its own privacy notice for the payment account, checkout, store and fraud controls it operates. Some providers may process data outside the EEA. Where applicable, transfers are protected by an adequacy decision, the EU-US Data Privacy Framework, Standard Contractual Clauses or another lawful safeguard provided for by the GDPR.

Retention

• Account and gameplay records are kept while the account is active and then deleted or anonymized, subject to necessary backups, abuse prevention and legal claims.
• Extracted puzzle grids follow the gameplay retention above. Original image processing is subject to the provider retention described under Optional image import.
• Billing, purchase, refund, checkout-consent and accounting evidence is generally retained for seven years after the end of the relevant accounting period where Austrian commercial or tax law requires it. Individual records may be kept longer only while needed for an audit, enforceable legal claim, fraud dispute, or another binding legal duty.
• Operational provider payloads and webhook records are reduced or deleted when they are no longer needed to prove and synchronize the purchase, subject to the accounting, tax and legal-claim periods above.
• Security logs are retained only for the operational periods configured with our hosting provider unless an incident requires longer preservation.
• Analytics are retained according to the configured provider plan and only as long as reasonably needed for trend and performance analysis.
• Contact and feedback records are retained until the request is resolved and thereafter only as needed for legal claims or documentation.

Your rights

Subject to the GDPR's conditions, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time. Contact us at office@laware.gmbh. You may also lodge a complaint with the Austrian Data Protection Authority.

Changes

We may update this policy when the service or legal requirements change. Material changes will be indicated by updating the date above and, where appropriate, through an in-product notice.