GDPR

What Open4ID does with data

When a player signs in or makes a purchase, your game sends only what is needed to Open4ID: a player or device identifier, app and platform details, and the store receipt or purchase token. We forward the receipt to Apple or Google for verification, return the verified entitlement, and write a log entry and an aggregated statistic.

We do not receive payment card numbers, bank details or the player’s store account password. Those stay with the app store. Open4ID does not decide on its own whether a purchase is valid: the store’s response is authoritative, and our verification is a deterministic check, not profiling.

We do not sell personal data, use it for advertising, or combine it across studios to build profiles of players.

Our role: controller and processor

For player and device data that passes through the bridge, including verification logs and per-app analytics, the studio is the data controller and Open4ID is a data processor acting on the studio’s instructions. The studio’s own privacy policy applies to players.

For your publisher account, billing for Open4ID plans, support conversations and visitors to this website, Open4ID is the data controller.

Where we use aggregated or de-identified statistics to operate, secure and improve Open4ID, we act as a controller, but those statistics are not used to identify or target individual players.

Players should send data protection requests to the studio that publishes their game. We give studios the tools and information they need to respond.

Personal data we process

As a processor, we process the data your game sends through the SDK and API:

• player identifiers you choose to send, such as your own player ID or a linked sign-in identifier;
• device and technical data: device identifier, platform, operating system and app version, language, IP address and the approximate country derived from it;
• purchase data: App Store receipts or Google Play purchase tokens, product identifiers, transaction identifiers and the store’s verification response;
• entitlement state and the log records needed to return it, including timestamps, endpoint, response codes and error details.

As a controller, we process your publisher account details (name, email address, organisation), billing records for Open4ID plans, support messages, and technical data about your use of the website and dashboard.

We do not ask for special category data such as health or biometric data, and you should not send it. We also do not need player names, email addresses or phone numbers; if you send them, you do so on your own initiative.

Logs and analytics

We keep logs of SDK and API calls so that purchases can be verified, entitlements restored, errors diagnosed, abuse and replay attacks detected, and the service kept secure. A log entry typically contains a timestamp, app and platform details, a device or player identifier, IP address, product and transaction identifiers, the store response and the result.

We produce aggregated metrics for your dashboard, such as purchase counts, active devices, verification success rates and revenue summaries. These metrics are shown to the studio that owns the app.

We may use aggregated or de-identified statistics to monitor capacity and improve Open4ID. We do not use logs or analytics for advertising, and we do not create cross-studio behavioural profiles.

We do not make automated decisions that produce legal effects about players. Entitlement checks simply reflect the store’s response.

Legal bases for processing

Where we act as controller, we rely on the following legal bases:

• Performance of a contract: to provide the dashboard, verify purchases and bill paid plans.
• Legitimate interests: to secure the service, prevent fraud and abuse, keep logs and improve reliability, balanced against your rights.
• Consent: where we ask for it, for example for optional product emails. You can withdraw consent at any time.
• Legal obligation: to keep tax, accounting and other records required by law.

Where we act as processor, the studio determines the legal basis for processing player data, for example performance of the game’s contract with the player, consent, or legitimate interests in fraud prevention. We process only on the studio’s documented instructions.

Data processing addendum

A data processing addendum (DPA) covering the GDPR requirements for processors is available on request. It includes our commitments on confidentiality, security, sub-processors, assistance with data subject requests and breach notification.

The DPA forms part of the agreement between us once signed or accepted. Contact us to receive the current version.

Sub-processors

We use service providers for cloud hosting, logging and monitoring, email and billing for Open4ID plans. They process data on our behalf under written contracts with appropriate safeguards.

Apple and Google are not our sub-processors: they act as independent controllers for app store accounts and payments, under their own terms and privacy policies.

A current list of sub-processors is available on request. We give notice before adding a sub-processor that processes player data, and you may object on reasonable data protection grounds.

International transfers

Some of our service providers may process personal data outside the European Economic Area or the United Kingdom. Where that happens, we rely on an adequacy decision or on Standard Contractual Clauses together with, where required, the UK International Data Transfer Addendum.

You can request more information about the safeguards we use for a specific transfer.

Security

We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls, least-privilege access for staff, logging and monitoring, and regular backups. No system is completely secure, and we cannot guarantee absolute security.

Retention

Verification logs and receipt records are kept only as long as needed to provide the service, prevent replay and fraud, and resolve disputes. Aggregated statistics may be kept longer because they no longer identify a player.

Account and billing records are kept while your account is active and afterwards for the period required by tax and accounting law. Support messages are kept for a limited period.

Player data is retained according to the studio’s instructions and deleted or returned when the agreement ends, unless the law requires us to keep it. Studios can ask us to delete verification records for a specific player.

Your rights

If you are in the European Economic Area, the United Kingdom or another jurisdiction with similar laws, you have the right to:

• access the personal data we hold about you and receive a copy;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data where there is no lawful reason for us to keep it;
• ask us to restrict or stop processing your data in certain circumstances;
• receive your data in a portable, machine-readable format;
• object to processing based on legitimate interests, including direct marketing;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with your local supervisory authority.

These rights are not absolute. We may need to keep some data to comply with the law or to establish, exercise or defend legal claims.

Exercising your rights

Contact us at the address below to exercise a right or ask a question about how we handle your data. We may ask you to verify your identity before acting on a request.

We respond within one month. If a request is complex or you have made several requests, we may extend that period by up to two further months and will tell you why.

If your request concerns player data in a game, please contact the studio that operates the game first. We support studios so they can respond.

Children

The Services are intended for game studios and are not directed at children. Studios must obtain verifiable parental consent where the law requires it before processing data about children, and configure the SDK accordingly.

Data breaches

If we become aware of a personal data breach affecting data we process for you, we notify you without undue delay and in any event within 48 hours, together with the information you need to meet your own notification obligations. We document breaches and take steps to contain them.

Complaints

If you are unhappy with how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to your local data protection authority, or in the UK to the Information Commissioner’s Office.

Contact us

For privacy and GDPR questions, contact: [email protected]