Privacy Policy

We are pleased that you are visiting our website and thank you for your interest. Below we inform you about the handling of your personal data when using our website. Personal data is any data that can be used to identify you personally.

The controller responsible for data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is:

Leon König, Plorex, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany
e-mail: legal@plorex.games

When using our website for information only, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server ("server log files"): the page visited, date and time of access, amount of data sent, source from which you came to the page, the browser used, the operating system used, and your IP address. This processing is carried out under Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the stability and functionality of our website. The data is not passed on or used in any other way; we reserve the right to check the server log files subsequently if there are concrete indications of illegal use.

For security reasons and to protect the transmission of personal data, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the "https://" prefix and the lock symbol in your browser line.

Vercel. For hosting our website and displaying the page content, we use Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Data collected on our website is processed on the provider's servers. We have concluded an order processing agreement with the provider. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework.

Cloudflare. We use a content delivery network offered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, to deliver media files such as preview clips and images faster via regionally distributed servers. Processing is based on our legitimate interest in the stability and functionality of our website (Art. 6 (1) (f) GDPR). We have concluded an order processing agreement with the provider, which participates in the EU-US Data Privacy Framework for transfers to the USA.

Supabase. For user authentication and the database that stores account data, we use Supabase (Supabase, Inc., USA). The project data is hosted in the European Union (Frankfurt, eu-central-1). We have concluded a data processing agreement with the provider (supabase.com/legal/dpa); where personal data is transferred to a third country, appropriate safeguards apply. This processing takes place only for registered users and is based on the performance of the user relationship (Art. 6 (1) (b) GDPR).

Plorex uses only technically necessary cookies. When you are logged in, an authentication session cookie keeps you signed in; it is essential for the account function and is not used for tracking or advertising. We set no analytics or marketing cookies. Where personal data is processed by such a technically necessary cookie, the legal basis is Art. 6 (1) (f) GDPR (and, for logged-in users, Art. 6 (1) (b) GDPR). Your light or dark theme preference is stored in your browser's local storage only ("theme") and never leaves your device.

When you contact us by e-mail, the personal data you provide is stored and used exclusively to respond to your request and for the associated technical administration. The legal basis is our legitimate interest in responding to your request (Art. 6 (1) (f) GDPR). Our mailboxes run on Google Workspace (Google Ireland Ltd.). Your data is deleted once your request has been finally dealt with, unless legal retention obligations apply.

You can register on our website by entering personal data. The personal data processed for registration is determined by the respective input mask (in particular your e-mail address and the profile information you choose to provide). We use the double opt-in procedure: your registration is not complete until you have confirmed it via a confirmation e-mail sent to you. If you do not confirm within 24 hours, your registration is automatically deleted.

We store the data required to operate your account until you delete it, plus any information you provide voluntarily (such as preferences) for the duration of your use, unless you delete it beforehand. You can view, change and delete this information in your profile at any time. The legal basis is the performance of the user relationship (Art. 6 (1) (b) GDPR) and our legitimate interest in providing the account function (Art. 6 (1) (f) GDPR). If you delete your account, the associated data is deleted, unless legal retention obligations apply.

Plorex uses YouTube API Services to find public game-related videos and retrieve their video IDs, titles, descriptions, tags, channel names and IDs, publication dates, thumbnails, durations, public statistics, availability and embedding status. We use this public, non-authorized API Data to select and display video references on game pages. Automated server-side requests contain game titles and aliases, but do not send your Plorex search text, account details or viewing history to YouTube. We do not request access to your YouTube account, subscriptions or private videos. Signing in to Plorex with Google does not grant us access to your YouTube account.

Public video metadata is stored in our catalogue and refreshed regularly. Stored API metadata is refreshed or removed within 30 days. It is displayed to site visitors and is not used to build viewer profiles or shared for advertising. You can contact us at legal@plorex.games about data relating to you or your channel. Removing information held by Plorex does not remove the original video or other information held by YouTube.

Some game pages embed videos from YouTube (provider: Google Ireland Ltd., Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; data may also be transmitted to Google LLC, USA) in privacy-enhanced mode (youtube-nocookie). These videos are not loaded automatically. A video is only loaded once you actively start playback. Only at that point does your browser connect to YouTube's servers, transmitting information including your IP address to the provider; if you are logged into a YouTube account, playback may be assigned to that account. Because the embed loads solely as a result of your active decision to play it, no data is transmitted to YouTube beforehand. For transfers to the USA, the provider participates in the EU-US Data Privacy Framework. Further information: policies.google.com/privacy.

On our website we provide a single sign-on function offered by Google Ireland Ltd., Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (data may also be transferred to Google LLC, USA). If you have a Google account, you can use it to create an account or sign in on our website. When you use this function, a direct connection is established between your browser and the provider's servers; the provider receives the information that you have visited our site, including your IP address. If you click the sign-in button and log in with your Google account, the provider transmits the information you have released (in particular your name, e-mail address and profile picture) to us, based on your express consent under Art. 6 (1) (a) GDPR, which we use to set up and manage your user account. You can revoke this consent at any time with effect for the future. For transfers to the USA, the provider participates in the EU-US Data Privacy Framework. Further information: business.safety.google/privacy.

As an alternative single sign-on option we offer login via Discord (Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA). If you choose this option, a direct connection is established between your browser and Discord's servers, and Discord receives the information that you sign in via our site, including your IP address. Based on your express consent under Art. 6 (1) (a) GDPR, Discord transmits the information you have released (in particular your Discord user ID, username, e-mail address and avatar) to us, which we use to set up and manage your user account. You can revoke this consent at any time with effect for the future. As Discord is a US provider, personal data is transferred to the USA. Further information: discord.com/privacy.

We also offer login via Twitch (Twitch Interactive, Inc., 225 Bush Street, 9th Floor, San Francisco, CA 94104, USA). If you use this function, a direct connection is established between your browser and the provider's servers, and the provider receives the information that you have visited our site, including your IP address. This is based on our legitimate interest in a user-friendly login (Art. 6 (1) (f) GDPR). If you sign in with your Twitch account, the provider transmits the information you have released (in particular your Twitch user ID, username, e-mail address and profile picture) to us, based on your express consent under Art. 6 (1) (a) GDPR, which we use to set up and manage your user account. You can revoke this consent at any time with effect for the future. For the transfer of data to the USA, the provider relies on the European Commission's standard contractual clauses. Further information: twitch.tv/p/legal/privacy-notice.

On the sign-up, login and password-reset forms we use the CAPTCHA service Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) to determine whether an input is made by a human or by automated processing, in order to block spam and automated attacks such as credential stuffing. For this purpose Turnstile collects the IP address of the device used, browser recognition data, the operating system type and the date and duration of the visit, and transmits these to the provider. This is based on our legitimate interest in preventing abuse and spam (Art. 6 (1) (f) GDPR). We have concluded an order processing agreement with the provider, which participates in the EU-US Data Privacy Framework for transfers to the USA.

Applicable data protection law grants you the following rights with regard to the processing of your personal data: right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure ("right to be forgotten", Art. 17 GDPR), restriction of processing (Art. 18 GDPR), to be informed (Art. 19 GDPR), data portability (Art. 20 GDPR), to withdraw a given consent (Art. 7 (3) GDPR), and to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Right to object. Where we process your personal data on the basis of our predominant legitimate interest, you have the right to object to this processing at any time with effect for the future, on grounds arising from your particular situation. If you object, we will stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. If we process your personal data for direct marketing purposes, you have the right to object at any time.

The duration of storage of personal data is based on the respective legal basis, the purpose of processing and, where relevant, on the applicable statutory retention period (e.g. commercial and tax retention periods). Data processed on the basis of consent (Art. 6 (1) (a) GDPR) is stored until you revoke your consent. Where personal data is processed on the basis of Art. 6 (1) (f) GDPR, it is stored until you exercise your right to object, unless we can demonstrate compelling legitimate grounds for processing. Unless otherwise stated in this declaration, stored personal data is deleted when it is no longer necessary for the purposes for which it was collected.

This privacy policy was created by the specialist lawyers of IT-Recht Kanzlei and is protected by copyright (www.it-recht-kanzlei.de), adapted to the actual data processing of this website.