Privacy Policy

The Marketing Arena is the controller of the personal data described here. That means we decide what is collected and why, and we are the ones you can hold to account for it.

For anything about your data, including a request to see it or delete it, write to maxwinterleinweber@gmail.com. We have not appointed a data protection officer, as we are not required to. Your request goes to a person, not a queue.

This policy covers the website and the app behind it. It does not cover other people's sites you reach from links in the arena, and it sits alongside our Terms of Service.

Account data

Your email address, a display name, a profile picture URL if your sign-in provider gave us one, and the dates your account and profile were created and last changed. If you sign up with a password, that password is stored only as a hash by our authentication provider. We never see it and we cannot recover it for you.

Google sign-in data

If you choose to sign in with Google, Google tells us your email address, your name, your profile picture and the identifier that links the two accounts. We do not receive your Google password, and we get no access to your Gmail, Drive, contacts or anything else in your Google account.

What you tell us during onboarding

Your challenger name, your website address, your company name and the description of what you do. Where you are a sole trader or your business is named after you, some of this is personal data about you as well as about the business, which is why it is listed here.

What the scout finds on your website

When you give the arena a website address, we fetch that page once from our servers and keep what a banner needs: the page title, the page description and the address of the site's icon. We read only what the site serves publicly, and we store the result against your account so the card can be drawn without fetching it again. You can edit or clear any of it.

Images you upload

If you raise your own banner, we store the image file and the address it is served from. Please read how it is protected: the bucket these files live in is publicly readable by anyone holding the file's address.

Your pledges and your record

The marketing actions you pledge and how often you have promised to do them, plus, for each day you answer for, the date, the note you wrote, any link you attached and when it was written or changed. This is the heart of the product and it is visible only to you.

Your score

Your XP, level, health, streak and credits are not stored at all. They are worked out from your record of answered days each time a page is drawn. We mention them because they are still information about you, even though there is no column holding them.

Technical and security data

Like any website, ours and the services behind it record technical details of requests: IP address, the time of the request, the page asked for, browser and device information, and errors. These logs are kept by our hosting provider and our database provider, and they are used for keeping the service running, diagnosing faults and detecting abuse.

Emails and support messages

We send transactional email only: confirming an address, resetting a password, and similar. Our email provider records delivery information such as whether a message was accepted or bounced. If you write to us, we keep the correspondence so we can deal with it and refer back to it.

We do not collect special category data such as health, religion, political opinions or biometrics, and we ask you not to put any into pledges or evidence notes. We do not take payment details, because the arena is free and nothing here charges anyone.

Under UK GDPR we need a lawful basis for each use. Ours are these.

• Running your account and the game: performance of a contract. Signing you in, storing your pledges, recording your answers, working out your level and showing you your own record. Without this data there is no service to give you.
• Scouting your site and drawing your banner: performance of a contract. You asked for it by entering the address, and it is part of setting up your arena.
• Transactional email: performance of a contract. Confirmations and password resets are part of providing an account, and you cannot opt out of them while you have one.
• Keeping the service secure and working: legitimate interests. Our interest is in a service that stays up and is not abused, and we think that does not override your rights, because the data involved is technical and is kept briefly.
• Answering your messages: legitimate interests. You wrote to us and expect a reply.
• Improving the arena: legitimate interests. Understanding what is breaking or confusing, using the information we already hold rather than by tracking you.
• Meeting our legal obligations: legal obligation. Responding to a valid legal request, and keeping records we are required to keep.
• Anything optional we add later: consent. If we ever want to send you a newsletter or measure how the site is used, we will ask first, and you will be able to withdraw at any time.

Where we rely on legitimate interests, you can object. See your rights.

The arena sets strictly necessary cookies only. They hold your authentication session so that you stay signed in as you move between pages, and they are refreshed on each request. Without them you could not log in, which is why there is no banner asking you to accept them: the law requires consent for cookies that are not essential, and we do not set any.

There are no analytics cookies, no advertising cookies, no pixels and no third party trackers on this site. If you block or clear the session cookies, you will be signed out.

Signing in with Google involves a round trip to Google, and Google may set its own cookies in the process, under its own privacy notice.

We do not sell your personal data, we do not rent it, and we do not share it for anyone else's marketing. We use a small number of suppliers to run the service, and they process data on our instructions under contracts that require them to protect it.

• Supabase hosts the database, the authentication system and the file storage. Everything in what we collect that is stored, is stored there. See Supabase's privacy policy.
• Vercel hosts and serves the site, and handles the request logs that come with that. See Vercel's privacy policy.
• Resend delivers our transactional email and records delivery results. See Resend's privacy policy.
• Google is involved only if you choose to sign in with it, and acts as its own controller for what it does with that sign-in. See Google's privacy policy.

Beyond those, we will disclose personal data only:

• where the law requires it, or to establish, exercise or defend legal claims;
• to protect the rights, property or safety of our users, ourselves or the public;
• to a buyer, if the arena is sold or merged, in which case we will tell you and this policy will continue to apply until it is properly replaced.

Our suppliers are based in, or operate from, countries outside the UK, including the United States. That means your personal data may be transferred out of the UK and the European Economic Area.

Where it is, we rely on the safeguards UK law provides for: transfers to a country the UK has found adequate, or contractual protections in the form of the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with the technical protections described under how it is protected.

You can ask us for details of the safeguards that apply to a particular transfer at maxwinterleinweber@gmail.com.

We keep personal data for as long as you have an account, because the whole point of the record is that it is a history you can look back over. After that:

• When you ask us to delete your account, we delete it and the data attached to it, normally within 30 days. Your profile, onboarding, pledges, evidence and uploaded images all go with it.
• Copies can persist in encrypted backups for a short period after that, normally no more than a further 30 days, after which they age out. We do not restore a deleted account from a backup.
• Technical and security logs are kept for a short period, normally no more than 30 days, unless one is needed for an ongoing investigation.
• Email correspondence with us is kept while it is useful and then deleted, and anything we have to keep for legal reasons is kept for as long as the law requires.

If you delete a single pledge, its history goes with it immediately and is not recoverable. That is deliberate, and worth knowing before you do it.

Technically, the arena is built so that:

• every table holding your data enforces row level security, so a query can only ever return rows belonging to the signed-in user, and that rule is applied by the database rather than by the app asking nicely;
• passwords are stored only as hashes, by our authentication provider, and are never visible to us;
• traffic to the site is encrypted in transit, and your session cookie is refreshed and scoped so it cannot be served to somebody else from a cache;
• uploads are limited to images, of a limited size, stored under a folder that only you can write to.

One exception, stated plainly: images uploaded as your banner are stored in a bucket that is publicly readable. Anyone who has the file's address can open it without signing in. The address is not published or listed anywhere and is not guessable in practice, but you should treat an uploaded image as public. Upload a brand mark, not anything private.

No service can promise perfect security. If a breach affects your personal data and is likely to result in a risk to your rights, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you directly where the risk is high.

Under UK GDPR you have the following rights over your personal data.

• Access. Ask what we hold about you and get a copy of it.
• Rectification. Have anything inaccurate corrected, or anything incomplete completed. Most of it you can edit yourself in the app.
• Erasure. Have your data deleted, where there is no good reason for us to keep it.
• Restriction. Ask us to pause what we do with it while something is disputed.
• Portability. Get the data you gave us in a common machine readable format, or have it sent to another provider where that is technically possible.
• Objection. Object to processing we base on legitimate interests. If you do, we stop unless we can show compelling grounds that override your rights.
• Withdrawing consent. Where we ever rely on consent, withdraw it at any time. That does not undo anything done before you withdrew it.

To use any of these, email maxwinterleinweber@gmail.com from the address on your account. We will answer within one month, and may extend that by two further months for a complex request, in which case we will tell you inside the first month and say why. It is free, unless a request is manifestly unfounded or excessive. We may need to check who you are before we act, which for most requests means confirming control of the account email.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. Complaining to them does not affect any other remedy you have.

The EEA and Switzerland

Where EU GDPR applies to you, you have the same rights as those set out under your rights, and you may complain to the supervisory authority in the country where you live or work, or where the problem happened, rather than to the ICO.

California

If you live in California, you have the right to know what personal information we collect and why, to get a copy of it, to have it corrected, and to have it deleted, and you have the right not to be discriminated against for exercising any of those. The categories we collect and the purposes we collect them for are set out under what we collect and why we use it.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California law. We have not done either in the previous twelve months, including for anyone under 16. To make a request, email us at the address above.

The arena is not for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us their data, tell us at maxwinterleinweber@gmail.com and we will delete the account and its data.

We do not make decisions about you by automated means that produce legal effects or similarly significant effects on you, and we do not profile you. Your level, health and credits are arithmetic performed on the answers you gave, shown back to you inside a game, and they are not used to decide anything about you outside it.

We will update this policy when what we do with data changes. The date at the top tells you when we last did. If a change is significant, for instance a new category of data or a new supplier who sees it, we will tell you by email or in the app before it takes effect, rather than leaving you to notice.

Anything at all about your data, including the requests described under your rights, goes to:

maxwinterleinweber@gmail.com

Please say what you are asking for, so we can start on it rather than start by asking. Our Terms of Service cover the rest of the relationship.