Privacy

1. Data controller

Johann Flipo, Sole trader (French entrepreneur individuel, micro-enterprise scheme), 6 rue d'Armaille, 75017 Paris, France, SIREN 107 376 071.

For any question about your data or to exercise your rights: privacy@loreside.com.

2. Reading the site: no data requested

Reading the pages requires no account, no registration and no tracking cookie. No audience measurement tool is installed, no profiling is carried out, and no data is sold or passed to brokers.

3. Technical logs

The host keeps technical logs needed to serve the pages and to protect the service against attacks: IP address, date and time, page requested, browser type.

Legal basis: legitimate interest in ensuring the security and the proper working of the service (article 6.1.f of the GDPR). Retention: these logs are kept by the host for a limited period and are not used by Loreside for analysis. Loreside only reads aggregate totals from them, per page and per device type, to count visits to the home page: never an individual line, never an IP address.

4. Your browser's local storage

Two items are saved in your browser's local storage: the theme chosen (light or dark) and the boxes ticked in the preparation checklist.

This information stays on your device. It is never passed to Loreside or to anyone else, it is attached to no identity, and it disappears if you clear the site's data. It is therefore not a processing of personal data by Loreside.

5. Day-one alert

If you request the alert, the following are recorded: your email address, the language of the page, what you asked for (the alert, the Pass opening email, or both), a random token used to confirm and to unsubscribe, the timestamps of the first and latest request, of the confirmation and of any unsubscription, and the date each email was sent, which ensures none reaches you twice. The form you used (for example the home page or the Pass page) and the type of device, phone or computer, are also recorded, with no other detail about your browser: these two facts only serve to tell which placement works.

Purpose: to send you at most three emails linked to the release of the game. Legal basis: your consent (article 6.1.a of the GDPR), obtained by a double confirmation. Retention: until you unsubscribe and, in any event, no later than six months after the last planned email is sent. Unconfirmed addresses are deleted thirty days after the latest request. Withdrawal: every email contains an unsubscribe link that takes effect immediately. If you ask to hear when the Pass plan opens, one additional email is sent to you at that moment, and only one.

6. Anti-robot check

The alert form is protected by Cloudflare Turnstile, which checks that the request comes from a person and not from an automated program.

This check processes technical information about your browser and your connection, for the sole purpose of detecting automated submissions. It is not used for advertising tracking. Legal basis: legitimate interest in protecting the service and the people whose address could be entered without their agreement.

7. Assistant

The assistant uses no language model. Your question is compared, on our servers, with the answers already published on this site: it returns the matching one word for word, with the page link and its verification date, or it states that it has no verified answer. No question is passed to a third party.

When the assistant has no answer, and only then, the question is recorded so that the missing page can be written. What is kept: the question reduced to a grouping form (lowercase, without accents or punctuation), the language of the page, the first wording received, a counter and two dates. Nothing else: no IP address, no session identifier, no timestamp per question asked. This log therefore cannot reconstruct any person's path, and that is deliberate. Questions the assistant can answer are not recorded at all.

Before anything is written, a filter rejects whatever looks like personal data (email address, run of digits, IBAN, web address, password) as well as text too short or too long to be a question. Even so, do not enter any personal or confidential data: this field is not made for that. Legal basis: legitimate interest in knowing what readers look for and we do not yet publish (Article 6(1)(f) GDPR). Retention: 12 months after the last time the question was asked. Beyond that, the row is deleted automatically. Your rights: as this log holds no identifier, we cannot link a row to a person (Article 11 GDPR). If you want a question you asked to be deleted, write to us quoting it at privacy@loreside.com and we will remove it.

If a model provider were ever used to go beyond the answers already published, this section would be updated first, with its name and the applicable retention periods.

8. Buying the Pass plan

When the Pass plan opens, the purchase will be handled by Paddle as Merchant of Record. Paddle collects the data needed for payment, invoicing and VAT, as controller for those operations: see paddle.com/legal.

Loreside will receive from Paddle the information needed to open your access: order identifier, email address, billing country, access start and end dates. Loreside never has access to your bank details. Legal basis: performance of the contract, and legal obligation for accounting retention.

9. Processors and recipients

Cloudflare, Inc.: hosting, database, anti-robot protection. The database data is stored in the European Union. Resend (Plus Five Five, Inc.): sending of the emails, Ireland region. Paddle.com Market Ltd: payment and invoicing, when the Pass plan opens.

These providers act on instruction and are bound by a processing agreement. Some are established outside the European Union: the transfers are framed by the standard contractual clauses of the European Commission.

No data is sold, rented or transferred for advertising purposes.

10. Your rights

You have a right of access, of rectification, of erasure, of restriction, of objection and of portability, as well as the right to withdraw your consent at any time.

To exercise them: privacy@loreside.com. A reply is sent to you within one month. No proof of identity is asked for without a serious reason: for the alert, a request sent from the registered address is enough.

To unsubscribe from the alert, the link in every email is immediate and requires no exchange.

If you consider that your rights are not respected, you may refer the matter to the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, cnil.fr.

11. Security

The site is served over HTTPS only. Access to the database is restricted. The access keys to third-party services are kept encrypted, outside the source code, and are never exposed to the browser.

If you discover a vulnerability, write to support@loreside.com: your message will be handled seriously and with no legal action against an approach made in good faith.

12. Minors and changes

The service is aimed at a general audience. Registration for the alert is not intended for people under fifteen without the agreement of their legal representative; no data about age is collected.

This policy may change, in particular when the Pass plan opens. The update date appears at the top of the page; any substantial change is announced on the site.