Privacy Policy

1. Who is responsible for your data

The data controller is Cup Code Establishment (Cup Code Studio), an establishment registered in the Kingdom of Saudi Arabia under unified national number 7051565781, based in Madinah.

For anything related to privacy: privacy@cupcodestudio.com.

We process personal data in accordance with the Saudi Personal Data Protection Law (Royal Decree No. M/19, 9/2/1443H) and its Implementing Regulations, supervised by the Saudi Data & AI Authority (SDAIA).

2. Our principles

• Minimisation: we ask for the least data needed.
• Purpose limitation: data is used only for the purpose it was collected for.
• Transparency: we explain what we collect and why, in plain language.
• Deletion when no longer needed: we don’t keep data forever.

3. What we collect

Contact details

When you use the contact form: name, email, organisation (optional), subject and message.

Support requests

When you open a support request: name, email, request details, any attachments you choose to upload, and device/browser information if you provide it, plus your browser type to help solve the problem.

Newsletter

Only your email and preferred language, when you subscribe yourself.

Privacy requests and security reports

Whatever you submit in the privacy request form or the security report form, used only to handle that request or report.

Technical logs

• The site’s error logs record technical details about errors only, not form contents.
• The hosting provider may keep standard access logs (such as IP address, time and page) under its operational settings.

Security data

To protect forms from abuse and rate-limit attempts, we compute a hashed fingerprint of the IP address (HMAC) and store that instead of the address.

Cookies

One essential session cookie and one language preference. Details in the cookie policy.

Analytics

A daily aggregate count of page views — no cookies, no IP addresses, no visitor identifiers.

CUP CODE account, council and comments

When you create an account, we store your display name, language, and the username and biography you choose to add. When you sign in through Steam, Google, Discord or Apple, depending on the enabled methods, we store the provider account identifier and available display name. We do not receive your provider password. An email address you add and verify is used for sign-in, notifications you request, and account security messages.

We store account sessions, browser and system types, and sign-in and linking events to protect your account. Public ideas and comments appear under your display name. Voter identities and individual poll answers are not published. New ideas and comments are reviewed before publication when these features are enabled. My account → Privacy lets you export your account data or delete the account. Deletion removes sign-in methods, sessions and votes, erases comment text, and keeps ideas without the account holder's name.

Playtester programme and Steam

When you use the playtester programme, we store your public Steam account number and available display name, and application details such as region, language, device specifications, availability and experience you choose to provide. We also store consents, session bookings and attendance, assigned test keys, bug reports and attachments, and survey answers. We do not receive your Steam password. When game integration is available, the game server validates the Steam ticket and records the validation time, programme and last four account-number digits. AI does not decide whether to accept your application. The portal supports data export or account deletion. Bug reports remain after their link to you is removed.

Admin AI tools

Admin writing and translation tools use Hostinger AI Router and Claude Haiku 4.5. Text selected by the administrator for a task is sent to this service. Inbox triage and public AI search are currently disabled. The processing tools do not send privacy requests or security reports to the assistant. An administrator reviews results before use.

4. Why we process your data

• Answering messages and support requests: at your request and with your consent when you submit the form.
• Newsletter: based on your consent, which you can withdraw anytime via the unsubscribe link.
• Protecting the site and preventing abuse: a legitimate interest in protecting the service, without prejudice to your rights and within the limits the law allows.
• Legal obligations: when a law or a competent authority requires it.

We don’t use your data for automated decisions about you or to build marketing profiles.

5. Retention

We keep data only for as long as the purpose requires, then delete or anonymise it. Current retention periods are listed in the table below.

6. Third parties

We don’t sell data or share it for marketing. We rely on a small number of service providers to run the site (such as hosting and email), who process data on our behalf and under our instructions. The current list is on the subprocessors page.

We may disclose data when a competent authority lawfully requires it.

7. Transfers outside the Kingdom

Hosting server location: to be confirmed and updated on this page.

Where servers or providers are outside the Kingdom, data is transferred in accordance with the rules governing the transfer of personal data outside the Kingdom under the law and its regulations, and only as needed for the purpose.

8. Security

• Connections are encrypted over HTTPS.
• Passwords are stored with secure hashing and sessions are protected.
• Attachments and system files are never publicly accessible.
• Admin access is limited to the person responsible for the site.
• Regular backups.

No system is 100% secure. If a breach is likely to harm you, we notify the competent authority and you as the law requires.

9. Children

The site is not directed at children. We don’t knowingly collect data from anyone under 18 without a guardian’s consent. If you believe a child has sent us data, contact us and we’ll delete it.

10. Your rights

The law grants you rights including: to be informed how your data is collected and processed, to access it, to obtain a copy, to have it corrected, to request its destruction when no longer needed, and to withdraw consent — subject to the exceptions the law sets out.

Details and how to apply: your data rights. You may also file a complaint with SDAIA.

11. Changes to this policy

When we change this policy we raise the version number, update the effective date, and keep previous versions at the bottom of the page. We never silently edit the published version.

12. Contact

Questions or requests: privacy@cupcodestudio.com, or the privacy request form.