Privacy Policy

Data controller

Where2PlayTCG is a project operated by an individual. For any question about privacy or data protection, you can write to dondejugartcg@gmail.com.

What data we collect

• Data you send us voluntarily. If you use the Suggest a store form, we store the store's name, city, the games it offers, its website or social media, additional notes, and — only if you write it — your contact email so we can reply to you.
• Business data we publish in the directory. The name, address, phone, website, and social media of stores in the directory come from public sources — mainly the official store locators published by each game's own publisher (Wizards of the Coast, The Pokémon Company, Bandai, Konami, and others). This is public commercial business information, not private information about individuals. For businesses registered as sole proprietorships, the store's public name may coincide with the owner's name — if you own a listed store and want to correct or remove that information, write to us and we'll take care of it.
• Automatic technical data. Our hosting provider (Vercel) logs standard data for any visit (IP address, device type, pages requested) for security and service-operation purposes. Unless you accept analytics cookies, we don't use this data to build profiles or for any purpose other than the site's technical operation.
• Analytics cookies. We use Google Analytics. Non-essential cookies are only installed if you accept the cookie banner. Full detail is in the Cookie Policy.

What we use this data for

• Reviewing and, when appropriate, publishing the stores you suggest to us.
• Responding to your questions if you left us a contact email.
• Keeping the store directory up to date and fixing incorrect data.
• Keeping the site secure and running, and — only with your consent — measuring site usage.

Legal basis

We process data from the suggestions form based on your consent when you submit it. Public business data in the directory is processed under legitimate interest: informing about publicly accessible businesses for a commercial-directory purpose, the same purpose for which that data is already public in the original official locators. Non-essential (analytics) cookies are only activated with your express consent.

Who we share data with

We use data processors to operate the site: Supabase (database) and Vercel (hosting), both with their own international data-transfer safeguards. With Google Analytics, Google also acts as a processor or joint controller, under its own standard contractual clauses. We don't sell or share personal data with third parties for their own commercial purposes.

How long we keep data

Store suggestions are kept for as long as they're useful for keeping the directory up to date. Contact details you voluntarily leave us are deleted once no longer needed to respond to your query, or sooner if you ask.

Your rights

You can ask us to access, correct, delete, restrict, or object to the processing of your data, as well as request its portability, by writing to dondejugartcg@gmail.com. You also have the right to lodge a complaint with your country's data protection authority if you believe we haven't handled your data correctly.

Changes to this policy

We may update this policy as the site evolves (for example, when adding new third-party services). Material changes will be reflected in this page's last-updated date.