Privacy policy

Who is responsible

The controller of your data is Beltastic. Contact: hello@beltasticstudio.com.

What we collect

Site analytics: page views, clicks on buttons and links, how far you scroll, whether you signed up or logged in (no email address is part of that), approximate location (country), device and browser type, and a random identifier set by Google Analytics.

Newsletter: your email address, which we store as a hash (a one-way scramble) together with a referral code. Our email provider MailCheap handles the actual sending and holds the address needed to deliver mail.

Moonrise and Discord login: when you log in with Discord we receive your Discord ID, your display name and the age of your Discord account. We create your balloon, your member number, your pumps and the pumps you give to friends.

Raffles and rewards: the entry itself, the account it came from, and, for winners, the details needed to deliver a prize.

Technical data: IP address and request logs kept by our hosting provider for security and to keep the site running.

We never collect: passwords, payment card or bank details, or anything you type into form fields beyond what a form asks for.

What is public

On Moonrise, these are visible to anyone: your balloon, member number, balloon color, puff count, and the display names of people who pumped your balloon. Do not log in if you do not want that. You can ask us to remove your balloon at any time.

Why we use it and on what legal basis (EU, EEA, UK)

Analytics: your consent (Art. 6(1)(a) GDPR and UK GDPR). In the EU, EEA, UK and Switzerland nothing from Google loads until you accept. You can withdraw at any time, see the Cookie Policy.

Newsletter: your consent, confirmed by double opt-in (Art. 6(1)(a)). Purpose: one release email and a few updates.

Moonrise, raffles and login: to provide what you asked for (Art. 6(1)(b)).

Security, fraud and abuse prevention, such as duplicate accounts in raffles: our legitimate interest (Art. 6(1)(f)).

Legal obligations such as tax or record keeping, if they apply: Art. 6(1)(c).

Advertising signals are always off. We do not use Google data for ads or personalization.

Who receives your data

Google (Google Analytics 4 through Google Tag Manager): analytics, only as described above.

MailCheap (mailcheap.ai): sends our emails.

Discord: login through Discord OAuth. Discord has its own privacy policy and we do not control it.

Railway and its infrastructure providers: hosting and our database (Postgres).

Professional advisers or authorities, only where the law requires it.

We do not sell personal data and we do not share it for cross-context advertising.

Transfers to the United States

Our providers are mainly based in the United States, and our hosting is expected to be there as well. If you are in the EU, EEA, UK or Switzerland, your data is therefore transferred to the US. Where required we rely on the EU-US Data Privacy Framework and its UK and Swiss extensions where the provider is certified, or on Standard Contractual Clauses.

How long we keep it

Analytics data: up to 14 months.

Newsletter: until you unsubscribe. After that we keep only the hash, so we do not mail you again.

Moonrise and login data: while your account exists. If you ask us to delete it, we remove it within 30 days.

Raffle entries of non-winners: deleted 30 days after the draw. Winner data: 12 months, or longer if the law requires.

Server logs: up to 30 days.

Your rights

In the EU, EEA and UK you can ask for access, correction, deletion, restriction, a portable copy, and object to processing based on legitimate interest. You can withdraw consent at any time without giving a reason. You can complain to your data protection authority.

In the United States, depending on your state (for example California under the CCPA/CPRA), you can ask what personal information we hold, ask us to delete or correct it, and opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising. We will not treat you worse for using these rights.

To use any right, write to hello@beltasticstudio.com. We may need to confirm it is you.

Age

Beltastic is for adults, 18 and over. We do not knowingly collect data from anyone under 18. If you think we did, tell us and we will delete it.

Changes

If we change this policy in a way that matters, we update the date at the top and, where needed, ask for your consent again.