Privacy Policy

Last updated : 08/09/2026

Introduction

TTRPG (hereinafter "the Platform") is an online tabletop role-playing game service published by Sandrenyl. We take the protection of your personal data very seriously. This policy describes what data we collect, why, and how we use it, in accordance with the General Data Protection Regulation (GDPR).

Data Controller

The data controller is Mikael Bernard, sole trader trading as Sandrenyl, 24 rue de la Perrière, 70600 Champlitte, France — SIRET 82116912500035. Contact: contact@sandrenyl.com. No data protection officer has been appointed, as this is not mandatory given the nature of the activity. You may lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).

Data Collected

We only collect data strictly necessary for the service to function:

  • Authentication identifier (via the Lockhart service) — no password is stored on our servers
  • User-chosen nickname
  • Avatar (uploaded image, optional)
  • User preferences (language, theme)
  • Content created within campaigns (character sheets, messages, maps, notes)
  • PayPal transaction data (transaction reference, amount) — we do not store any banking data
  • Billing details, only if you make a purchase: full name, company name and EU VAT number where applicable, postal address, postcode, city and country
  • Tax localisation evidence: the country of the payment account reported by PayPal and, where our host provides it, a country code derived from the connection. Only the country code is retained, never the IP address. This evidence is required by EU VAT rules to justify the rate applied

Purpose of Processing

Your data is used exclusively to:

  • Enable account creation and management
  • Provide platform features (games, sheets, chat, gameboard)
  • Process payments for paid plans
  • Contact you when necessary for service-related matters

Legal Basis

The processing of your data is based on:

  • Performance of a contract (terms of service accepted upon registration)
  • Your consent for optional data (avatar)
  • Legal obligation for billing data

Data Retention

Your data is retained as long as your account is active. If you delete your account, all your personal data and content are permanently deleted within 30 days.

Files uploaded to a campaign on the free plan (images, sounds) are deleted after 90 consecutive days without the campaign being opened, after three email warnings. This deletion affects neither the account nor the other content of the campaign.

By way of exception, issued invoices and the accounting data they contain (billing identity and address, amounts, VAT) are retained for ten years from the end of the financial year, in accordance with article L123-22 of the French Commercial Code and article L102 B of the French Tax Procedure Book. This retention rests on a legal obligation and cannot be the subject of an erasure request; the records are archived separately and are no longer used for any other purpose.

Data Sharing

Your data is never sold, rented, or shared with third parties for commercial purposes. The only third parties involved are:

  • Lockhart — authentication service (hosted by Sandrenyl)
  • PayPal — payment processing (only if you make a purchase)
  • European Commission (VIES system) — validation of an EU VAT number, only if you provide one
  • Mailjet — delivery of transactional emails, including invoices
  • OVH SAS (Roubaix, France) — hosting of the servers and the database
  • Sentry — logging of technical errors, to keep the service secure and working; only error messages and the technical context needed are sent, with no account identifier or IP address

Transfers outside the European Union

Your data is hosted in France. Two providers are however established in the United States: PayPal, for payment processing, and Sentry, for error logging. These transfers rely on the adequacy decision for the EU-US Data Privacy Framework and, as a fallback, on the standard contractual clauses adopted by the European Commission.

Cookies

The public pages of the website (homepage, legal pages) do not use any cookies. The application itself only uses browser-side local storage (localStorage) to maintain your session and preferences. No third-party cookies, advertising trackers or audience measurement tools are used. The only external tool is Sentry, which receives the application's technical errors for security and maintenance purposes, with no cookie and no browsing tracking.

Your Rights

Under the GDPR, you have the following rights:

  • Right of access — view the data we hold about you
  • Right to rectification — correct any inaccurate data
  • Right to erasure — request deletion of your account and data
  • Right to data portability — receive your data in a structured format
  • Right to object — object to the processing of your data

To exercise these rights, contact us at: contact@sandrenyl.com.

Security

We implement technical and organizational measures to protect your data: encrypted communications (HTTPS), token-based authentication, input sanitization, and data access controls.

Changes

We reserve the right to modify this policy. In case of significant changes, users will be notified through the platform.