Privacy Policy

1. Who we are and our roles

GameLedger is operated by Fox Software LLC, a Georgia limited liability company, whose registered address is 285 Mayson Avenue Northeast, Apt 373, Atlanta, GA 30307, USA (“GameLedger,” “we,” “us”). You can contact us about anything in this policy at support@gameledger.io.

GameLedger provides reservation and venue-management software for board game cafés and similar venues. Our role under data-protection law depends on the data:

• Guest booking data — we act as a processor. When you make a booking, the venue you book with is the data controller and decides why and how your data is used. GameLedger processes that data on the venue's behalf to run the platform, under the terms of our Data Processing Addendum with the venue. Requests about your booking data are best directed to the venue; we will help the venue respond.
• Venue-account data — we act as a controller. For the operators and team members who hold a GameLedger account, we are the controller of account data (such as login email, name, role, and our records of platform usage), of what you send us through our own website, such as a demo request, and of the security logs and page analytics we keep for our own pages and venues' public pages.

2. Data we collect

• Guest booking data: name, email address, phone number, party size, reservation date/time, and any notes you provide; and, where a venue takes payments, payment status (card details are handled by Stripe, not stored by us).
• Venue-account data: account email, name, job title, phone, and avatar; venue and team configuration; and operational logs.
• Technical data: data needed to keep you signed in and to keep a table session active (see Cookies below), plus basic logs for security and debugging. On our public pages (this website and each venue's public venue, booking and games pages), Vercel Web Analytics records page views and demo or contact request submissions: the page address, the referring site, approximate location (country, region and city), and browser, operating system and device type. It sets no cookies and tells visits apart by a hash of the request that is discarded after 24 hours.

3. Lawful bases

• Contract: to create and manage a booking you request, and to provide the platform to a venue under our terms.
• Legitimate interests: to operate, secure, and improve the platform and prevent abuse, balanced against your rights.
• Legal obligation: to comply with law, including retaining limited records to evidence consent and to honor opt-out requests.

4. How we use data

We use personal data to process and confirm reservations, communicate about a booking, operate guest payments where a venue enables them, provide venue accounts and support, keep the platform secure, and meet our legal obligations. The venue you book with can access the booking details you provide in order to host your reservation. We do not sell personal data, and we do not use guest data for our own marketing.

5. Sharing and sub-processors

We share data with the venue you book with, and with the service providers (sub-processors) we use to run the platform. We do not sell data or share it for third-party marketing.

• Supabase

  Purpose

  Database, sign-in, and file storage

  Data

  Booking, guest, and account data

  Location

  United States (Ohio)

• Vercel

  Purpose

  Application hosting and delivery, and analytics for our public pages

  Data

  Request data, logs, and page-view and form-submission analytics

  Location

  United States (Washington, D.C.), with pages delivered through its worldwide network

• Resend

  Purpose

  Transactional email, such as booking confirmations and reminders

  Data

  Email address and message content

  Location

  United States

• Stripe

  Purpose

  Payment processing for venue deposits and payments, on the venue's own Stripe account

  Data

  Payment details, amount, and limited contact data

  Location

  United States

• Square

  Purpose

  Payment for food and drink orders placed at the table, on the venue's own Square account (in testing; not yet offered to venues)

  Data

  Order contents, payment details, and amount

  Location

  United States

• Google

  Purpose

  Finding a venue's own listing on Google to fill in its profile and opening hours

  Data

  The venue name or address searched for, and the listing details returned

  Location

  United States

• TypeSafe

  Purpose

  Matching questions a venue types into its Settings search to the right settings page

  Data

  The question text, with emails and phone numbers removed (anything else typed, such as a guest's name, is sent as typed), the settings page it was asked from, and the venue's offering names

  Location

  United States (company headquarters; hosting location not published)

• Microsoft

  Purpose

  Our email inbox, including support@gameledger.io

  Data

  Emails sent to us and our replies

  Location

  United States

• Anthropic

  Purpose

  AI assistant GameLedger's founder uses to build, test, and support GameLedger

  Data

  Code, database structure, counts, venues' business details, venue team members' names and login emails, and test bookings; never used to read guests' personal data

  Location

  United States

Venues can see the same list, and how we tell them before it changes, in our Data Processing Addendum.

We may also disclose data where required by law or to protect rights and safety.

6. International transfers

GameLedger is run from the United States, and the personal data we hold is stored there: our database, sign-in, and file storage are hosted by Supabase in Ohio, and the application runs on Vercel in Washington, D.C. The table above shows where each provider processes data. If you are outside the US, including in the UK, the EU, Japan, or Korea, your data is transferred to the United States.

For guest data that venues in the UK, the EU, and Switzerland entrust to us, we rely on the EU's Standard Contractual Clauses and the UK's International Data Transfer Addendum to them, which are part of our Data Processing Addendum with venues, together with our providers' own data-protection commitments. We give venues in Japan and Korea the information they need to tell their guests about the transfer.

7. Data retention

We keep personal data only as long as needed for the purposes above, then delete or anonymize it. Where a venue is the controller, the venue's own retention decisions also apply.

8. Your rights

Subject to applicable law, you have rights to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. Where GameLedger is the processor for guest data, we will forward your request to the relevant venue and assist them in responding; where we are the controller, we respond directly.

To make a request — including to erase your data — email support@gameledger.io. We may need to verify your identity. Note that, for the reasons above, we retain any earlier text-message opt-in record and opt-out entry even after an erasure. You also have the right to complain to your local data-protection authority (in the UK, the Information Commissioner's Office).

9. Text messages

GameLedger no longer sends text messages. Guests could previously opt in on the booking form to receive booking confirmation and reminder text messages. We keep the records of those opt-ins (when the guest opted in and the wording they agreed to) and of any opt-out requests, as described under Data retention above, and we do not use them to contact anyone.

Mobile numbers and text-message opt-in data have not been and will not be shared with third parties or affiliates for marketing or promotional purposes.

10. Cookies

GameLedger uses only strictly necessary cookies — the cookies required to run the service. We do not use advertising, analytics, or cross-site tracking cookies, so no cookie-consent banner is needed.

• Authentication cookies (venue accounts): set by our authentication provider to keep operators securely signed in across requests.
• Table session cookie (guests): a short-lived, HTTP-only cookie used when a guest joins a table at a venue, so they can rejoin the same session. It expires after about 24 hours.

11. Children

The platform is intended for use by venues and adult guests. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will address it.

12. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, provide additional notice where appropriate.

13. Contact

Questions about your privacy, or to exercise your rights, email support@gameledger.io.