Privacy policy
What we keep.
And why.
This policy explains how Games2Test uses personal data under the GDPR. It matches the product: accounts, playtest reports, private videos, and payouts through Stripe. Controller contact: hello@games2test.com.
Last updated 20 September 2026
- 01Who is responsible
- 02Data we collect
- 03Why we use it
- 04Who we share it with
- 05Transfers outside the EU
- 06How long we keep it
- 07Automated review
- 08Your rights
- 09Children
- 10Security
- 11Changes
01Who is responsible
Games2Test (https://games2test.com) is the controller for personal data processed on this site. Write to hello@games2test.com.
Stripe is an independent controller for the identity and payout data it collects during Connect onboarding. Google and Discord are independent controllers for their own sign-in screens.
02Data we collect
- Account
- Email, password hash (if you sign in with email), display name, chosen path (creator / tester), and sign-in metadata.
- Sign-in providers
- If you use Google or Discord we receive the identifier, email, and public profile name those services send us.
- Tester profile
- Languages you report in, devices you play on, optional genres, and country of residence when you set up payouts. Used to match missions and create the Stripe recipient account in the right country.
- Creator content
- Game title, summary, cover image, access type, private keys or URLs, campaign brief, and questionnaire.
- Playtests
- Reservations, written answers, session videos, qualification answers and videos, review notes, and claims.
- Payments
- Checkout sessions, order amounts, refunds, Connect account status, transfer history, and legal name or date of birth returned by Stripe after onboarding. Card numbers and identity documents stay with Stripe.
- Technical
- IP address, browser data, and security logs needed to run and protect the service.
03Why we use it
We only use personal data when we have a legal basis.
- Contract — creating your account, running a campaign, delivering a report, paying a tester.
- Legitimate interests — keeping the platform safe, reviewing qualifications, improving matching, preventing fraud. You can object.
- Legal obligation — bookkeeping, tax, and answering a lawful request.
- Consent — optional cookies we do not use today. If we add analytics later, we will ask first.
04Who we share it with
We do not sell personal data. We share it with the providers that make the product work, and with the other party to a playtest (a creator sees the tester’s report and display name; a tester sees the brief and access details for a booked seat).
Administrators see what they need to review qualifications, reports, claims, and payouts.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Accounts, database and file storage | European Union (Paris, eu-west-3) |
| Vercel | Website hosting and the AI Gateway used for qualification review | United States and European edge regions |
| Stripe | Checkout, payouts through Connect, and identity checks for testers | United States and European Union |
| Bunny.net | Private storage and delivery of playtest and qualification videos | European Union (Frankfurt) |
| Resend | Transactional emails (confirmation, password reset, notices) | United States and European Union |
| Optional Google sign-in, and Gemini models used to review qualifications | United States and European Union | |
| Discord | Optional Discord sign-in | United States and European Union |
Each provider has its own privacy policy. Stripe handles tester identity documents on its side.
05Transfers outside the EU
Some providers are in the United States (Vercel, Stripe, Resend, Google, Discord). When data leaves the European Economic Area we rely on an adequacy decision where one exists, or on Standard Contractual Clauses and the safeguards those providers publish.
Your account database lives in the European Union (Paris). Playtest videos are stored in the EU (Frankfurt) on Bunny Stream.
06How long we keep it
- Account and profile — for as long as the account exists, then deleted or anonymised when you ask us to close it, unless we must keep a trace.
- Reports and videos — for the life of the campaign and a reasonable period after, so the studio can use the feedback.
- Qualification samples — while we need them to decide access, then they can be removed.
- Payment records — kept for the statutory accounting period (typically ten years in France).
- Security logs — a short period, unless they are part of an incident.
07Automated review
Qualification answers and, when the video is ready, the session recording may be sent to a Gemini model through Vercel’s AI Gateway. The model can accept or refuse a clear sample. Uncertain cases stay in the admin queue.
You can ask for a human review by writing to hello@games2test.com. You can also object to this processing. If we cannot run the platform safely without it, we may have to close the tester path on your account.
08Your rights
You can ask to access, correct, or delete your data, to limit or object to some processing, and to receive a copy of data you gave us (portability). You can withdraw consent where we relied on it.
Write to hello@games2test.com. We may need to confirm it is you. You can also lodge a complaint with the CNIL or the authority where you live.
09Children
Games2Test is for people aged 18 or over. We do not knowingly collect data from children. If you think a minor has an account, write to us and we will close it.
10Security
Access to private briefs, keys, and videos is restricted. Videos are delivered with token authentication. Payments go through Stripe. No setup is perfect; if we become aware of a breach that affects you, we will follow the law on notifying you and the authority.
11Changes
We will update this policy when our processing changes. The date at the top is the current version. Related pages: Terms, Cookie Policy.