Política de privacidad

1. Introduction

ChessFlare.com is operated by ANAKYOS, which acts as the data controller for the processing described in this Privacy Policy. The protection of your personal data is a priority for ChessFlare.com.
This Privacy Policy explains what data we collect, how we use it, on what legal basis we process it, and what your rights are.
By using ChessFlare.com, you agree to the processing of your data in accordance with this policy.

2. Data Controller

ANAKYOS, a French simplified joint-stock company (SAS) with share capital of €1,000
SIREN: 108 753 716
Registered office: 59 rue de Ponthieu, Office 326, 75008 Paris, France
Email: contact@chessflare.com

3. Data Collected and Legal Bases

3.1 Account Creation and Management

• Email
• Password (hashed and secured)
• Username
• Elo rating and possible title (GM, IM, etc.)
• Imported games and annotations
• Optional third‑party authentication data when you choose it (Google, Apple Sign‑in): name and email (Apple may provide a private relay email).

📌 Legal basis: performance of a contract (Article 6(1)(b) GDPR).

3.2 Payments, Purchases and Subscriptions

The data processed depends on whether a purchase is made on the website or in a mobile application.

Web purchases

• product, price, currency and country associated with the purchase,
• transaction and subscription identifiers, status, renewal, cancellation and refund information,
• billing and tax information required for the transaction.

Eligible web purchases are processed through Stripe Managed Payments. Sold through Link, LLC acts as merchant of record for those transactions. Payment method details are provided directly to Stripe and are not stored in full by ANAKYOS.

Mobile purchases

• App User ID or ChessFlare account identifier,
• store, product and transaction identifiers, receipt or purchase token,
• purchase history, subscription status, entitlement, renewal, cancellation and refund information.

Apple or Google processes the payment and financial information for purchases made through its store. RevenueCat processes the purchase information and identifiers needed to validate receipts, prevent purchase fraud, synchronise subscription status and enable premium features. RevenueCat does not collect payment card information.

📌 Legal bases:

• performance of a contract (Article 6(1)(b) GDPR),
• compliance with legal obligations regarding billing and accounting (Article 6(1)(c) GDPR),
• legitimate interests in preventing fraud and securing access to paid features (Article 6(1)(f) GDPR).

3.3 Emails

• Transactional emails (account confirmation, invoices, security)

📌 Legal basis: performance of a contract.

• Marketing emails / newsletters (offers, updates)

📌 Legal basis: explicit consent (Article 6(1)(a) GDPR).
You can withdraw your consent at any time via the unsubscribe link included in our emails.
Provider used: Brevo.

3.4 Browsing Statistics (Cookies)

On ChessFlare.com, we use cookies to measure traffic and improve our services, exclusively through PostHog. When you first visit the site, a banner allows you to accept or refuse statistical cookies. Your choice can be changed at any time through the same banner or via your browser settings.

Functional cookies necessary for authentication, security and preferences may also be used on ChessFlare.com to ensure the website works properly.

The retention period of analytics cookies is defined in accordance with our analytics configuration (up to 13 months, in line with CNIL recommendations).

Depending on the selected PostHog region, some data may be processed outside the European Union. We ensure appropriate safeguards are in place when data is processed outside the EU.

📌 You can manage, disable, or delete cookies at any time through your browser settings (Chrome, Firefox, Safari, Edge, etc.).

4. Hosting

ChessFlare is hosted by:
Hetzner Online GmbH (Germany)
All your data is stored on secure servers located within the European Union.

5. Purposes of Processing

Your data is used to:

• Provide and improve our services,
• Manage your accounts, purchases, subscriptions and access to premium features,
• Validate purchase receipts and synchronise entitlements across supported devices and platforms,
• Ensure security and prevent abuse,
• Send transactional or marketing communications (with consent),
• Comply with our legal obligations (payment, billing).

6. Data Sharing

We only share data with providers and platforms needed to operate ChessFlare and the selected purchase channel:

• Stripe Managed Payments / Sold through Link, LLC: merchant of record for eligible web purchases; checkout, payment, receipts, indirect taxes, fraud prevention, disputes and transaction support
• Apple App Store and Google Play: mobile payment, purchase and subscription management, receipts, cancellations, refunds and applicable store tax obligations
• RevenueCat: purchase receipt validation, App User ID and purchase-history processing, subscription-status synchronisation and entitlement management
• Sendy: email delivery : host on elastic email.
• Hetzner: hosting
• PostHog: audience analysis (with consent)
• Apple: authentication via Sign in with Applewhen selected

For the affiliate program, identity, contact and connected-account information may be exchanged with Stripe Connect. Bank details and identity documents required for payouts are provided directly to Stripe and are not stored by ANAKYOS.

Some providers may process data outside the European Economic Area. Where required, we rely on appropriate safeguards provided by applicable data-protection law. Each provider may also process certain data as an independent controller for its own legal, payment, fraud-prevention or compliance obligations under its privacy policy.

Your data is never sold to third parties.

7. Data Retention

• User account: retained as long as the account is active.
• Billing and accounting data received by ANAKYOS: retained in accordance with legal obligations (up to 10 years in France).
• Purchase and subscription data: retained for the duration needed to provide access, handle support and disputes, prevent fraud and comply with legal obligations. Stripe, Apple, Google and RevenueCat apply their own retention periods to data they process.
• Marketing emails: retained until unsubscribe.
• Analytics cookies (PostHog): retention period set by our configuration (up to 13 months, in line with CNIL recommendations).

8. Your Rights (GDPR & CCPA)

You have the following rights:

• Access: obtain a copy of your data,
• Rectification: correct your information,
• Erasure: request deletion of your account and data,
• Portability: receive your data in a readable format,
• Objection: object to certain processing (e.g., marketing),
• Restriction: temporarily restrict certain processing.
• Withdrawal of consent: withdraw consent at any time for processing based on consent, without affecting processing already carried out.

These rights apply subject to the conditions and exceptions provided by applicable law. To exercise your rights: contact@chessflare.com. You may also lodge a complaint with the French data-protection authority, the CNIL, at www.cnil.fr .

9. Security

We implement technical and organizational measures to protect your data (password hashing, SSL encryption, secure hosting).

10. Changes

This policy may be updated. Users will be informed of significant changes (by email or on-site notification).

11. Jurisdiction

This policy is governed by French law.
The competent courts are determined by applicable law, without prejudice to mandatory consumer-protection rules.