Umbra Orbital is a multiplayer bridge simulation game. This page explains what personal data the game and its website keep, why, who else handles it, for how long, and how you can control it. We try to keep it short and plain.

1. Who is responsible

• Controller: David Sala Duperiel (self-employed).
• Contact for anything about your data: info@umbraorbital.com.
• Data protection officer: we have not appointed one. The law only requires it for public bodies or for large-scale monitoring of people or sensitive data, and this is a small service that does neither.

2. What we keep, and why

Account: Email, interface and game language, your WordPress user id, your Google id if you sign in with Google, a password hash if you registered with a password (never the password itself) · To let you sign in and play · Contract (running the service you asked for)

Character: Callsign (your in-game name), credits, standing with factions, and the history of what the character did · To keep your campaign between games · Contract

Rooms and chat: Which rooms you joined, and the text chat inside them · To run the game room · Contract

Voice: Room audio passes through our own voice server while you talk. It is never recorded and never transcribed. Your callsign is your identity in the call. · To let the crew talk · Contract

Beta tester applications: Your request to take part as a beta tester, the optional note you write and our decision · To choose and contact testers · Legitimate interest (you choose to apply)

Beta test reports: The answers and free-text comments you send in QA sheets, and their review status · To fix the game · Legitimate interest (improving the game); you choose to send them

Event log: Technical events (account linked, room closed, error counters). Some events include an email address. · To run and secure the service, to diagnose faults · Legitimate interest

Game logs: Technical logs of each game run · To diagnose faults and cheating · Legitimate interest

Subscription mirror: Whether you have an active plan and for which product · To unlock what you are entitled to · Contract

Orders (WooCommerce): Billing name, email and country, order history. We removed address, phone, company and shipping fields from checkout. · To process orders and keep accounting records · Contract and legal obligation

Server logs: IP address and technical request data kept by our servers · Security and operation · Legitimate interest

We do not sell your data, we do not show advertising, and we do not build profiles about you.

3. Your callsign and other players

Other players in your room see your callsign, the standing and history attached to it, and your chat and voice. Pick a callsign you are happy to be known by. Do not use your real name unless you want it known: your callsign is the public face of your character and we cannot take back what other people have seen or heard.

4. Minimum age

You must be at least 16 years old to create an account. You confirm this with a checkbox at sign-up. If we learn that someone younger has an account, we will delete it.

5. Who else handles your data

Automattic / WordPress.com: Hosts this website, accounts, WooCommerce, Jetpack (including site statistics) · United States · Processor

Hetzner Online GmbH: Game server, game portal, database, self-hosted voice server · Germany · Processor

Google: “Sign in with Google” (only if you use it) · United States / EU · Processor for login

Google Workspace (Gmail): Sends transactional emails (sign-up, password reset, order notices) and hosts the project mailbox · United States / EU · Processor

Brevo: Sent transactional emails until October 2026. Its account is being closed and its data deleted · EU · Processor (being closed)

Stripe / WooPayments: Card payments. Not live yet. · United States / EU · Not part of the beta

Let’s Encrypt: Certificates for the secure connection only. Receives no personal data about you. · United States · Not a processor of your data

Each processor handles your data under its own data processing terms. We may also disclose data if a court or authority legally requires it.

6. Transfers outside the EU

Automattic, Google and Stripe are based in the United States. Where we send them data, the transfer relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework for certified companies, or on Standard Contractual Clauses, depending on the provider. Voice, the database and the game itself stay on our server in Germany.

7. Cookies and similar technologies

We aim to use only what the service needs. This is what the site and game set today:

Portal session cookie: Keeps you signed in to the game portal. Secure, HttpOnly, SameSite=Lax. · Session · Necessary

WordPress / WooCommerce session and cart cookies: Sign-in, basket, checkout, security · Session, or as WordPress sets · Necessary

umbra_go (plugin intent cookie): Remembers where you were going while you sign in with Google · 15 minutes · Necessary

umbra_lang and the language plugin’s cookie: Remembers your chosen language · Up to 1 year · Preference you ask for

Social login cookies (Nextend, Google): Complete the “Sign in with Google” flow · Short · Necessary for the login you request

Browser storage (localStorage): Remembers display choices such as filters and open panels · Until you clear it · Preference, stays on your device

Statistics. The site uses Jetpack / WordPress.com Stats, a privacy-oriented statistics service run by Automattic. When you load a page, your browser requests a script from stats.wp.com, so Automattic receives your IP address, the page visited and technical data about your browser, and uses them to give us aggregate visit counts. We use the counts to see which pages are read. You can block stats.wp.com in your browser if you prefer.

You can block or delete cookies in your browser settings; the game and sign-in will not work without the necessary ones.

8. How long we keep it

Account and characters: While the account is active; an account inactive for 24 months is deleted or anonymised

Beta tester applications: 12 months

Beta test reports: 12 months

Event log: 12 months

Orders and invoices: 6 years (accounting and tax law)

Room chat: Deleted when the room is deleted

Game logs: 7 days

Database backups: 30 days

Server access logs: 14 days

Voice is never stored, so it has no retention period.

9. Your rights

You can ask us to:

• Access your data and receive a copy (portability). We answer within 30 days and deliver a file.
• Correct data that is wrong.
• Delete your account. We answer within 30 days. Your account and characters are anonymised, your standing and credits are lost, and your WordPress user is deleted. Some history (for example “a pilot flew this mission”) may stay in the game’s records without being linked to you.
• Restrict or object to some uses of your data.
• Withdraw consent where we rely on it.

To exercise any of them, email info@umbraorbital.com from the address of your account. We may ask you to confirm it is you. You also have the right to complain to the Spanish data protection authority, the AEPD (aepd.es), or to the authority of your own country.

10. Payments

During the beta, access is free and no card data is collected. Before any payment is taken, this section will describe the payment provider and the data it receives, and we will tell registered users by email.

11. Security

Connections to the site and the game portal use HTTPS. Voice and the database run on our own server. No online service is perfectly secure, so we limit what we collect. If a breach affects your rights, we will notify you and the authority as the law requires.

12. Changes

If we change this policy in a way that matters, we will tell registered users by email before it takes effect. Previous versions are available on request.