Privacy notice

Version 2026-08-07.1 · effective 7 August 2026

This notice describes the processing of personal data when using playtesting.de. Account features, security and requested portal workflows work independently of consent to optional statistics cookies or voluntary ARC telemetry.

Controller

The controller is adrastea GmbH & Co. KG, Bielefelder Str. 5, 90425 Nürnberg, Germany. Contact: info@playtesting.de, telephone +49 911 4334 0800. Further company details are available in the Imprint.

Data and purposes

Account and profile: username, email address, display name, roles, language, profile details and voluntarily published links. For new registrations, only confirmation that the person is an adult is recorded; no date of birth or identity-document data is collected for this purpose. Existing accounts are not asked retrospectively.
Playtests: games, builds, requests, encrypted keys, feedback, bugs, comments, messages, creator reports and moderation cases.
Illegal content and moderation: case reference, identified URL or content, report category, explanation, optional name, contact email, language, good-faith declaration, review, decision, measures, legal or rules basis, automation notice and communications with involved persons.
Newsletter: email address, optional name, language and topic selection, and subscription, confirmation and unsubscribe timestamps. Only the source page path without URL query parameters is stored; raw IP addresses and browser identifiers are not retained as newsletter consent evidence.
Optional product updates: selected email preferences, associated product, approval and delivery state, and consent and withdrawal timestamps. A message is queued only for an associated product, and download permission is checked again immediately before delivery.
Paid digital offers: account and order reference, product and edition, total price, currency, tax presentation, language, consent and confirmation timestamps, and checkout, payment, refund, chargeback and receipt status. Full card, bank or Link login details are not stored in the portal.
Security: short-lived sessions, timestamps, temporary IP/browser data and purpose-bound HMAC hashes used to prevent abuse and replay.
Portal search: search area, number of filters used and result count, plus the account reference for signed-in users. Search terms, IP addresses and browser identifiers are not stored for this purpose.
Build deliveries: for each build and calendar day, the number of files successfully provided by the server or redirects, the amount of data provided, and a separate classification as a counted delivery, recognizable automation or an internal team test. Daily values contain no IP address, browser identifier, session identifier or account identifier.
Operations: email delivery state, job and error state, audit events, API token metadata and file scan results.

These data are processed to provide requested functions, account security, contractual workflows, moderation and secure troubleshooting. Where portal activity has occurred, the internal portal administration receives one aggregated daily summary covering accounts, searches, contacts, content and possible abuse signals. The report does not contain search terms, message content, email addresses, IP addresses or browser identifiers. Optional news, website statistics and ARC telemetry are processed only according to the relevant choice; consent can be withdrawn for the future.

Legal bases

Requested accounts, playtests and portal actions are processed to take steps before entering into and to perform a contract (Article 6(1)(b) GDPR). Evidence required by law is processed under Article 6(1)(c) GDPR. Security, abuse prevention, moderation and reliable technical operation are based on our and our users’ legitimate interests in a secure portal (Article 6(1)(f) GDPR). Newsletters, optional email updates about approved test versions and expressly optional analytics are based on voluntary consent (Article 6(1)(a) GDPR). Withdrawal applies to the future and does not affect the lawfulness of processing before withdrawal.

Without data marked as required, the relevant account, portal or contractual function cannot be provided. Newsletters and optional analytics are not required for these functions. No decision producing legal or similarly significant effects is based solely on automated processing.

Files, links and external services

Uploads are checked by type, size and file signature and stored in protected or public areas. Archives and attachments may be scanned locally with ClamAV. When an external download link is validated, the destination server is contacted and receives technical connection data, in particular the requesting server IP. Files are published only after the approvals required for that area.

If a developer voluntarily links an account to ARC, playtesting.de and ARC exchange only scoped connection data and aggregated analytics. ARC raw telemetry is not imported into playtesting.de. Email and hosting providers process data only as needed for delivery and operation.

For expressly paid digital offers, payment is handled on a checkout page provided by Stripe; Link may be offered as a payment method and, where identified in the specific checkout, act as Merchant of Record. In particular, the email address, language, product and price details, and pseudonymous order and account references are sent to Stripe. Payment and billing details are entered directly with Stripe. Stripe returns the reference and status data required by playtesting.de for order status, fulfilment, support, refunds, chargebacks and receipts. The parties identified at checkout and the Stripe Privacy Policy apply.

Internally, data are available only to people who need them for the relevant process. Product-related feedback, issue reports and attachments explicitly intended for a product team are available to authorised provider and organisation members for that product; private contact details are shown only where needed for the requested workflow and clearly disclosed in advance. Contracted hosting, storage, security and email providers may also receive data, as may authorities or other recipients where disclosure is legally required. Data are transferred outside the European Economic Area only where required for a service and where the applicable legal requirements are met, in particular through an adequacy decision or appropriate safeguards.

Build download statistics

After a successful permission check, playtesting.de records on the server whether a build file was successfully provided for delivery or redirected to an approved external download address. Recognizable bots, previews and technical clients, as well as requests made by the responsible product team, are shown separately and are excluded from the main figure. Data are stored immediately as daily aggregates without an individual delivery log.

These statistics are not optional website or ARC analytics, do not set analytics cookies, and support delivery and evaluation of the download path provided by the publisher. They are visible only to accounts with statistics permission for the relevant product team. Technical server access logs may temporarily contain an IP address and browser identifier; they support secure operation and may also be used to complete daily aggregates. IP addresses and browser identifiers are not transferred to the build statistics.

ARC and optional analytics

ARC Analytics is disabled by default. An application may collect telemetry only after a separate voluntary choice; declining does not change game or key access. playtesting.de provides authorised product teams only with suppressed or aggregated daily, version and cohort values above a minimum sample. Installation, session, licence, key, IP and email identifiers are not imported into the portal.

Optional website cookies are set only after a choice in the cookie notice. Necessary session and security features are not treated as marketing consent.

Retention

Unconfirmed newsletter subscriptions: normally 30 days. After unsubscribing, optional profile and consent metadata are removed; the email address, status and necessary timestamps remain only as a suppression and evidence record for as long as needed to respect the withdrawal or defend legal claims.
Anonymous portal sessions: no more than 24 hours; signed-in sessions: no more than 30 days and no more than ten active sessions per account.
Verification and reset links: until used or expired; API idempotency records: 24 hours.
Product-specific unsubscribe links for optional email updates: no more than 400 days; expired tokens are deleted. Consent, withdrawal and delivery evidence is limited to what is necessary and deleted according to the evidence periods below.
Public key-claim abuse protection: HMAC hashes only, normally 31 days.
Data-minimised portal search events: no more than 90 days; the account reference is removed immediately when an account is erased.
Technical server access logs: normally no more than 14 days. Build delivery values derived from them contain no IP, browser, session or account identifier and remain as product-related daily aggregates while the associated build or product is retained.
Revoked or superseded build files: normally up to 180 days for controlled rollback.
Order, payment, refund, chargeback, receipt and consent evidence: for as long as required to perform the contract, comply with statutory retention duties, account for the transaction, or establish, exercise or defend legal claims. Payment references that are no longer required are erased or further minimised.
Optional ARC raw events: 30 days, ARC sessions: 180 days, sufficiently large aggregates: up to 25 months; portal snapshots follow the same aggregate period.
Account content: until the account or individual content is deleted. Necessary audit, acceptance, moderation and legal evidence is reduced to the minimum and normally kept for no more than three years unless a longer legal duty or a specific legal matter applies.
Reports about illegal or rule-breaking content, including decision communications: normally no more than three years after closure unless a specific legal matter or statutory duty requires longer retention. Contact details that are no longer needed are removed earlier once their purpose has ended.
Rotating portal backups: normally 35 days; data may remain in that cycle and is used only for recovery and security verification.

Export, rectification and erasure

After identity verification, a machine-readable copy of personal portal data can be requested. Incorrect profile data can be corrected in the account. Signed-in users can erase their account under “Profile → Account settings”. The current password, username and two explicit confirmations are required. Active sessions and tokens are revoked, direct contact data is removed and user-related content is erased or anonymised. Technically necessary relations and audit or legal evidence remain only in minimised form. The rights and freedoms of others and legal retention duties remain taken into account. Administrator, organization or product responsibilities must be transferred safely before erasure.

Rights and contact

Subject to the applicable requirements, rights may include access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn at any time for the future. Newsletters and optional product updates each include an unsubscribe option; product updates can also be configured globally or by product in the portal. Requests can be sent to info@playtesting.de. You may also lodge a complaint with a competent data protection supervisory authority.