Privacy Policy
Last updated: 28 September 2026
The short version
- We collect only what we need to run Rhythual for you.
- Paddle, our reseller, handles payments and invoices. We never see your card number.
- Players join games without an account. Game answers are deleted after 24 hours.
- No marketing without your consent. We never sell your data.
- Questions or requests: privacy@rhythual.com.
1. Who is responsible
The controller of your personal data is CREATIVE PRO (KE) s.r.o., Moyzesova 24, 040 01 Košice, Slovakia, Company ID (IČO): 46132856 · Tax ID (DIČ): 2023278499 · VAT ID: SK2023278499.
Data protection contact (also our Data Protection Officer contact under Singapore’s PDPA): privacy@rhythual.com.
Paddle. Our reseller Paddle.com is an independent controller of the data it needs for payments, invoices, taxes and fraud prevention. See the Paddle Privacy Policy.
2. What data we process and why
| Data | Purpose | Legal basis (EU/UK GDPR) | How long |
|---|---|---|---|
| Name, email, country, subscription status and marketing choice (received from Paddle) | Giving you access, support, service emails | Contract (Art. 6(1)(b)) | During the subscription, then up to 3 years for claims |
| Team size and team setup (office, hybrid, remote) | Recommending suitable games | Contract | During the subscription |
| Usage data: games hosted, guides opened, ratings | Improving Rhythual; noticing when you may need help | Legitimate interest (Art. 6(1)(f)) | During the subscription, then anonymised |
| Player data: nickname and answers entered during a game | Running the game | Legitimate interest of the host and of us in running the game | Deleted 24 hours after the game; anonymous totals kept |
| Email and name for the free sample or survey | Sending the sample or discount code | Consent (Art. 6(1)(a)) | Until you withdraw consent or the offer ends |
| Emails about new games and offers | Marketing | Consent | Until you unsubscribe |
| Emails you send us | Answering your questions | Legitimate interest | Up to 2 years |
| Cookie and pixel data | Measuring ads | Consent | See Cookie Policy |
| Server logs (IP address, browser) | Security of the service | Legitimate interest | Up to 30 days |
Please do not enter sensitive personal information (for example health data) into games.
3. Who receives your data
We use trusted service providers who process data on our behalf under a data processing agreement:
| Provider | What for | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting the website, library and online games; sending login emails; forwarding emails sent to hello@rhythual.com | Global network, EU–US Data Privacy Framework |
| Microsoft Ireland Operations Ltd (Microsoft 365) | Our mailbox for answering your emails | EU, EU–US Data Privacy Framework |
| Our accountant, ACCTA Consulting, s.r.o. | Bookkeeping | Slovakia |
| Meta, LinkedIn (only with consent) | Ad measurement | EU, transfers to the USA |
Paddle receives the data it needs as an independent controller (see section 1). We share data with authorities only where the law requires it. We never sell personal data.
4. International transfers
Some providers process data outside the EU and UK, mainly in the USA. We rely on the EU–US Data Privacy Framework and its UK extension where the provider is certified. Otherwise we use the European Commission’s Standard Contractual Clauses and the UK Addendum.
5. Your rights
EU and UK
You have the right to access, correct and delete your data. You may also restrict or object to processing and ask for data portability. You can withdraw consent at any time. This does not affect processing before the withdrawal. You can complain to a supervisory authority: in Slovakia the Office for Personal Data Protection (dataprotection.gov.sk), in the UK the Information Commissioner’s Office (ico.org.uk).
Singapore
Under the Personal Data Protection Act 2012, you may ask to access or correct your personal data and withdraw your consent. Contact our DPO at privacy@rhythual.com. You may also contact the Personal Data Protection Commission (pdpc.gov.sg).
United States
Depending on your state, you may have the right to know, access, correct and delete your data. We do not sell or share personal data for cross-context behavioural advertising without consent. Send requests to privacy@rhythual.com.
We answer requests within one month (30 days in Singapore). We may ask you to confirm your identity first.
6. Security
Rhythual uses HTTPS everywhere. Card payments are handled only by Paddle and its payment partners, which meet PCI DSS requirements. Access to our systems is protected with two-factor authentication. If a data breach puts your rights at risk, we will inform you and the authorities as required by law.
7. Children
Rhythual is designed for adult teams at work. It is not meant for people under 16, and we do not knowingly collect their data.
8. Changes
We may update this policy. The date at the top shows the latest version. We will tell subscribers about important changes by email.