Privacy Policy

1. Introduction

Turn Zero ("we", "us", or "our") provides an AI-powered playtesting service for tabletop and board game designers. We respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

This Privacy Policy explains what personal data we collect, how we use it, the legal basis for processing it, your rights under GDPR, and the measures we take to keep it safe. By using Turn Zero, you consent to the practices described in this policy.

2. Lawful Basis for Processing

Under Article 6 of the GDPR, we process your personal data under the following lawful bases:

• Performance of a contract — creating your account, running game analysis, and delivering simulation results.
• Legal obligation — retaining billing and tax records as required by applicable financial regulations.
• Consent — sending email notifications, product updates, and marketing communications. You can withdraw this consent at any time.

3. What Data We Collect

We collect the following categories of personal data:

4. Third-Party Processors

We rely on the following third-party services to operate Turn Zero. Each processor is bound by GDPR-appropriate data processing agreements:

• Supabase — database hosting and user authentication. Data center location: Netherlands (EU).
• Stripe — payment processing and billing. Data center location: USA. Stripe is certified under PCI DSS and operates under EU-US Data Privacy Framework principles.
• Zoho — email delivery and transactional notifications. Data center location: USA, operating under EU-US Data Privacy Framework principles.

5. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete personal data.
• Right to erasure — request deletion of your account and associated personal data.
• Right to data portability — receive your data in a structured, machine-readable format and transfer it to another service.
• Right to object — object to processing of your data based on legitimate interests or for direct marketing.
• Right to withdraw consent — withdraw your consent for email notifications or other consent-based processing at any time.

To exercise any of these rights, email us at privacy@turnzerolabs.com. We will respond within 30 days of receiving your request.

6. Data Retention

We retain your personal data only as long as necessary to provide our services and comply with legal obligations:

• Account data is retained until you request account deletion.
• Game data and simulation results are retained until you delete them or close your account.
• Accounts inactive for 90 days are flagged; associated data is permanently deleted after an additional 30-day grace period.
• Billing records are retained as required by applicable tax law (typically 7 years).

7. Security

We implement industry-standard security measures to protect your personal data:

• Encryption in transit — all data is transmitted over TLS 1.3.
• Encryption at rest — stored data is encrypted with AES-256 by our hosting provider (Supabase).
• Database isolation — Supabase row-level security policies ensure each user can only access their own game files and reports.
• Token management — authentication tokens are issued and refreshed by Supabase Auth and never stored in plaintext.

8. Children's Data

Turn Zero is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that data. If you believe we have collected data from a minor, please contact us at privacy@turnzerolabs.com.

9. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. When we make material changes, we will notify you by email and post a prominent notice on the Turn Zero website at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

10. California Consumer Privacy Act (CCPA) — Do Not Sell My Personal Information

Turn Zero does not sell your personal information. We do not share your data with third parties for their direct marketing purposes. California residents have the right to:

• Know what personal information is collected about them.
• Request deletion of their personal information.
• Opt-out of the sale of personal information (not applicable — Turn Zero does not sell your data).
• Not be discriminated against for exercising their privacy rights.

To exercise any of these rights, contact us at management@turnzerolabs.com. We will verify your identity before processing your request and respond within 45 days, as required by California law.

11. Contact

If you have questions about this Privacy Policy or wish to exercise your GDPR rights, please contact our Data Protection Officer at:

You also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data in accordance with the GDPR.