Skip to content
Quest for MePlay the demoDeutsch

Privacy policy

Draft – have this reviewed before going live.

This English text is a convenience translation. The German version prevails.

1. Controller

The controller for data processing on this website is:

Brightnext Goods and Services LtdApartment 62 Conquest Tower130 Blackfriars RoadLondon SE1 8BZUnited KingdomEmail: hello@questfor.me

Our representative in the EU (Art. 27 GDPR) is: [name and address of the EU representative]. You can also contact them about any data protection matter.

We have not appointed a data protection officer, because the law does not require one for us.

We are based in the United Kingdom and sell worldwide. The UK General Data Protection Regulation (UK GDPR) applies to us. Because we also sell to people in the EU, the EU General Data Protection Regulation (GDPR) applies as well. The articles below have the same numbers in both. The same policy applies to every buyer.

We run the website and handle your order from the United Kingdom. The United Kingdom is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

2. The short version

  • We only process the data we need for your game and for running the website.
  • The website runs on our own server in a data centre in the EU.
  • We do not set cookies.
  • Visitor counting only happens if you agree. It runs on our own server.
  • Payment is handled by Paddle as the reseller. We do not see your payment details.
  • We do not sell data or use it for advertising.
  • We delete the answers from your form 90 days after purchase.

3. Hosting and server logs

The website runs on a server we rent from OVH SAS (France). The server is in a data centre in Germany. OVH processes the data on the server only on our behalf; we have a contract with OVH under Art. 28 GDPR. The website data stays in the EU and the database is in the United Kingdom (section 14); we access it from the United Kingdom (section 1).

When you visit the website, the server processes technically necessary data: IP address, date and time, the address requested, amount of data sent, browser and operating system, and the page you came from (referrer).

We need this data to deliver the website, find errors and fend off attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation.

Our web server does not write access logs. The application logs errors only, without IP addresses; these logs are limited in size and overwritten continuously.

4. Protection against abuse

To stop anyone using the order form in bulk, we count requests per sender. We do not store your IP address for this, only a one-way check value (hash) derived from it. This value is deleted after about one day.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protection against abuse and overload.

5. Ordering and paying through Paddle

The purchase is handled by Paddle as merchant of record. Your contracting party for the purchase is Paddle.com Market Limited (United Kingdom); for purchases from the USA it is Paddle.com Inc., and from Canada Paddle.com (Canada) Ltd. Paddle processes the data you enter at checkout, such as name, email address, country, payment and tax details, as a controller in its own right. Paddle's privacy policy applies to that: [link to Paddle's privacy policy].

Paddle passes on to us the data we need for delivery: transaction number, amount, currency and payment status. We store only these; we already have your email address from the order form. We do not see your payment details.

The United Kingdom is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

6. Your order with us

For delivery we process your email address, the language, the time, the order status and Paddle's order number. We store your consent to immediate delivery as evidence.

We use this data to carry out your order: we create your game, send you the link and help with questions. The legal basis is Art. 6(1)(b) GDPR.

We must keep accounting records because tax and commercial law require it. The legal basis is Art. 6(1)(c) GDPR.

Without an email address we cannot deliver the game. It is therefore required for the order.

7. Your answers for the game

In the form you enter content for the game: your name and the recipient's name, your relationship, inside jokes, memories, quiz questions and answers, places or things you share, your letter, your final message and the look of the character.

We use these answers only to build your game. The legal basis is Art. 6(1)(b) GDPR.

Before you order, an automatic filter checks the text for prohibited content, links and malicious code. If the filter rejects a text, you can change it. This is not a decision with legal effect within the meaning of Art. 22 GDPR.

While you fill in the form, your browser saves a draft on your device (without your email address). The draft is deleted once you order.

8. Data about the recipient

Your answers also contain data about another person: the recipient. You give us this data, not the recipient.

  • Only enter what you may share for a private gift and what would not hurt the person.
  • Do not enter special categories of data, such as health, religion, political opinions or sex life.
  • Do not enter addresses, phone numbers or bank details.

We process the recipient's data because you want to give them a personal gift. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is creating the gift you asked for.

The recipient can contact us to exercise all rights listed in section 16. We have no contact details for them and so do not inform them ourselves (Art. 14(5)(b) GDPR). This notice is publicly available on our website at any time.

9. Game lines written with AI

Some of the game lines are written by an AI model: Claude Haiku by Anthropic. For this we send the text from your form to Anthropic once. We do not send your email address. Your letter and your final message stay exactly as you wrote them.

Anthropic does not use API data to train its models. Anthropic deletes inputs and outputs within 30 days, unless it must keep them longer to act on misuse or to meet legal duties.

The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the recipient's data. The AI makes no decisions about you.

10. Your gift link

Your game lives at a link with a long random code. Anyone with the link can play the game. Only pass it on to people who should see the game.

We store the finished game content for as long as the link is valid (see section 15). The legal basis is Art. 6(1)(b) GDPR.

11. Sending emails

We send the link and notes about your order through the Resend service (Plus Five Five, Inc., USA). We use Resend's EU sending region. Resend processes your email address and the content of the email on our behalf. The legal basis is Art. 6(1)(b) GDPR.

We do not send newsletters.

12. Visitor counting with Umami

If you agree in the notice, we count page views with Umami. Umami runs on our own server at OVH. No third party receives data from it. Umami sets no cookies.

It records the page visited, the previous page, browser, operating system, device type and approximate location (country, region, city). Your IP address is processed briefly for this but not stored in the statistics. Umami builds an anonymous session code from the IP address, the browser identifier and a random value that changes regularly. The random value changes monthly.

The legal basis is your consent (Art. 6(1)(a) GDPR; for devices in Germany § 25(1) TDDDG, in the United Kingdom regulation 6 PECR). You can withdraw it at any time with "Cookie settings" at the bottom of every page. Withdrawal applies from then on.

We delete the statistics after 24 months.

13. Browser storage

We do not set cookies. Your browser keeps a few settings in local storage (localStorage) on your device. They are not sent to us:

  • your choice on visitor counting
  • the draft of your form, until you order
  • game progress, separately for each gift link
  • whether sound is on or off

This is needed for the features you use (§ 25(2) no. 2 TDDDG; in the United Kingdom regulation 6(4) PECR). You can delete this data at any time in your browser settings.

14. Recipients and service providers

These service providers process data on our behalf and on our instructions (Art. 28 GDPR):

  • OVH SAS, France: server for the website, data processing and visitor counting, data centre in the EU
  • Neon (Databricks, Inc., USA): database, stored in London (United Kingdom)
  • Anthropic (Anthropic PBC, USA): writing the game lines
  • Resend (Plus Five Five, Inc., USA): sending emails through Resend's EU region

Paddle is not a processor for us. As the seller it is a controller in its own right (see section 5).

Neon, Anthropic and Resend are based in the USA or can access data from there. Resend is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). With Anthropic and Neon we have agreed the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). For transfers from the United Kingdom, the UK extension to the Data Privacy Framework (UK-US data bridge) and the UK Addendum to the standard contractual clauses apply. [Check certifications and contracts before going live.]

15. How long we keep data

  • Answers from the form: deleted 90 days after purchase.
  • Finished game and gift link: playable for 12 months from delivery, then deleted within 30 days.
  • Email address and order data: up to [6] years after the order, so we can resolve questions and claims (limitation periods).
  • Accounting records: 6 years from the end of the financial year (Companies Act 2006 and HMRC rules).
  • Server logs: no access logs; error logs without IP addresses are overwritten continuously. Hash value for abuse protection: about one day.
  • Umami statistics: 24 months.
  • At Anthropic: 30 days at most, except in the cases named in section 9.
  • Data in your browser: until you delete it.

How long Paddle keeps data is set out in Paddle's privacy policy.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To do so, write to hello@questfor.me. To help us find your order, please give the email address you ordered with. For data Paddle processes at checkout, please contact Paddle.

17. Complaints to a supervisory authority

You can complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, ico.org.uk. If you live in the EU, you can also complain to the authority in your country.

18. No automated decisions

We make no decisions based solely on automated processing that have legal effect on you (Art. 22 GDPR). The text filter in section 7 only holds back text that is not allowed; you can change it or write to us.

19. Changes

We update this policy when our service or the law changes. The version published here applies.

Last updated: 11 November 2026