Privacy Policy

The operator of the Tallago service (the „service“) is Highmont, s.r.o., Company ID (IČ) 05925509, VAT ID (DIČ) CZ05925509, registered office Stroužníky 748, 561 64 Jablonné nad Orlicí, Czech Republic. Contact e-mail of the data controller: tallago.info@gmail.com.

Tallago processes data in three roles:

• Agency admin – name, e-mail, encrypted password hash, agency name, organization contact e-mail, payment status, game history within your account. If you invite a co-admin (several admins in one organization), we also store the e-mail address of the invited person until they accept the invitation or it is cancelled.
• Instructor – either temporarily via a one-time magic link (name, if you enter it, an expiring token, assigned station, result entries), or as a permanent profile – first name, last name, e-mail, phone (if you fill it in), login credentials for repeated access across games. A note on an instructor (internal assessment, availability, etc.) is visible only to the agency admin and is not shown to the instructor.
• Player / spectator – no identifying data. The public URLs for results (/r/<code>), tournaments (/t/<code>) and, where applicable, the shared game library (/g/<code>, /gl/<code>) are anonymous and require no login – no cookies except those necessary for operation.

• Operating the service (login, storing games, scoring, instructors' notes on games, game library) – legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Payments and invoicing (Stripe Checkout, Customer Portal) – legal basis: performance of a contract + legal obligation (accounting; Art. 6(1)(b) and (c) GDPR). Stripe is a separate processor; see stripe.com/cz/privacy.
• Operational e-mails (invitations, notices of plan changes) – legal basis: performance of a contract. E-mails are sent through Resend (a processor based in the USA, see section 4).
• Website traffic analytics (Google Analytics 4 via Google Tag Manager) – we measure how many people visit the site and where they come from. Legal basis: consent (Art. 6(1)(a) GDPR) – it only starts after you agree in the cookie banner, see section 7.
• Logging (Pino on the backend) – IP address, request time, status code. Legal basis: legitimate interest (security, debugging). Retention: max. 30 days.

Third parties that have access to the data as our processors:

• Neon (Postgres hosting) – database, EU region.
• Stripe – payment processing; card details never reach us (Stripe Checkout is hosted).
• Resend – sending transactional e-mails. Based in the USA – a transfer of personal data (name, e-mail) outside the EU/EEA. Resend is certified under the EU-US Data Privacy Framework; the transfer is covered by this certification and by standard contractual clauses (SCC).
• Vercel (web application hosting) and Fly.io (backend hosting) – both based in the USA and both certified under the EU-US Data Privacy Framework, supplemented by standard contractual clauses (SCC).
• Google (Google Analytics 4 / Google Tag Manager) – only if you accept analytics cookies; measurement of website traffic. Based outside the EU/EEA; the transfer is secured by standard contractual clauses / DPF.

We do not sell any data. Data that we transfer outside the EU/EEA (Resend, Vercel, Fly.io, possibly Google) is always covered by appropriate safeguards under the GDPR – for all major providers specifically by EU-US Data Privacy Framework certification supplemented by standard contractual clauses.

• Active account – as long as it exists. Game data, results, instructors' notes, magic-link tokens including expired ones.
• Deleted account – all data is irreversibly deleted from the database no later than 24 hours after you confirm deletion in /dashboard/settings.
• Accounting documents (Stripe invoices) – retained for 10 years under Czech accounting law. These documents do not contain the data of your games, only the identification of the invoice.
• Logs – 30 days.
• Analytics data (GA4) – retained according to the default Google Analytics settings (usually 14 months); can be changed in the Google Analytics administration.

As a data subject you have the following rights under the GDPR:

• Right of access – at any time you can download a structured JSON export of your organization's data in /dashboard/settings.
• Right to rectification – change your name, e-mail and agency name directly in the settings.
• Right to erasure – in /dashboard/settings you will find the option to cancel your access to the organization. If you are the sole/last admin, you thereby cancel the entire organization and irreversibly delete all its data; if the organization has several admins, the data remains for the other admins when you leave – the whole organization can only be cancelled by the last remaining admin.
• Right to data portability – the JSON export is in an open format and you can move it anywhere.
• Right to object / lodge a complaint – you can contact tallago.info@gmail.com at any time or turn to the Czech Office for Personal Data Protection (uoou.cz).

Tallago uses:

• Necessary cookies – the session cookie after login (NextAuth, name authjs.session-token) and a cookie for the language choice (lang). These are always stored, without consent (they are necessary for the service to function).
• Analytics cookies (Google Analytics 4 via Google Tag Manager) – measure website traffic. They are stored only after your consent in the cookie banner; until you give consent, these cookies are not stored and analytics does not run. You can withdraw or change your consent at any time via Cookie settings in the website footer.
• No marketing or advertising cookies.

If we materially change the scope of processing, we will notify the admins of all active organizations by e-mail and update the effective date at the top.