Privacy Policy

The data controller responsible for your personal data is:

We collect and process the following categories of personal data. We apply data minimization principles and only collect data that is necessary for the purposes described.

We process your personal data under the following legal bases (GDPR Article 6):

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Service you requested (account management, training features, game sync).
• Consent (Art. 6(1)(a)): For optional analytics cookies, marketing emails, and optional profile data.
• Legitimate Interests (Art. 6(1)(f)): For security monitoring, fraud prevention, service improvement, and debugging.
• Legal Obligations (Art. 6(1)(c)): For tax records, invoicing, and regulatory compliance.

We use your personal data for the following purposes:

• Providing the Service: Operating your account, delivering training features, synchronizing games
• Communication: Sending important service emails, subscription reminders, security alerts
• Improvement: Analyzing usage patterns to improve features (with consent)
• Security: Detecting and preventing fraud, abuse, and security incidents
• Legal Compliance: Meeting tax and regulatory obligations

We will NEVER sell your personal data to third parties for advertising purposes.

We share data with the following third-party service providers who act as data processors:

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards through:

• EU-US Data Privacy Framework (DPF) certified processors
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable

We retain your personal data for the following periods:

• Active accounts: Retained while your account is active
• Account data after deletion: Deleted within 30 days (backups up to 90 days)
• Payment/invoice records: 10 years (French legal requirement)
• Analytics data: Anonymized after 26 months
• Security logs: 12 months
• Support tickets: 3 years after resolution

Under GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restriction (Art. 18): Request we limit processing of your data
• Right to Portability (Art. 20): Receive your data in a machine-readable format (PGN for chess data)
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time (for consent-based processing)
• Right to Lodge a Complaint: File a complaint with your local supervisory authority

To exercise your rights, contact us at privacy@chessatlas.net. We will respond within 30 days.

If you are a resident of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), or Utah (UCPA), you have additional privacy rights:

• Right to know what data we collect
• Right to delete your data
• Right to opt-out of "sales" of personal information
• Right to non-discrimination

We do NOT sell your personal information. We do not share your data with third parties for monetary consideration.

We use automated processing for the following purposes, none of which produce legal effects or similarly significant effects on you:

• Spaced Repetition Algorithm (SM-2/FSRS): Schedules your training reviews
• Deviation Detection: Identifies when you deviate from your repertoire
• Progress Tracking: Calculates your XP and statistics

We do NOT use profiling or automated decision-making that produces legal effects or significantly affects you.

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: TLS 1.2+ for all data transmission
• Encryption at rest: Database encryption using AES-256
• Password hashing: bcrypt with appropriate cost factor
• Access controls: Role-based access with principle of least privilege
• Regular backups: Encrypted backups with tested restoration procedures
• Security monitoring: Automated detection of suspicious activities

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:

• We will notify the CNIL (French supervisory authority) within 72 hours
• If the breach is likely to result in high risk, we will notify affected users directly
• We will document all breaches and remediation actions

The Service is not intended for children under 13 years old. We do not knowingly collect personal data from children under 13. If you are a parent and believe your child has provided us with personal data, please contact us at privacy@chessatlas.net.

For users aged 13-16 in the EU, parental consent is required under GDPR Article 8.

Our Service currently does not respond to "Do Not Track" browser signals. However, we respect your cookie preferences set through our consent banner.

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy with a new "Last Updated" date
• Sending you an email notification for significant changes
• Displaying a notice in the application

Your continued use of the Service after changes constitutes acceptance of the updated policy.

For privacy-related questions or to exercise your rights: