Privacy policy

The data controller is SPA Planeamento SL, tax identification number B36477537, with registered address at Campo da Torre 14, 27220 Friol, Lugo, Spain. The privacy contact channel is privacy@openbimgame.com.

SPA Planeamento SL is registered with the Lugo Commercial Registry, volume 573, folio 101, sheet LU-21974, and operates openBIMGame under the IfcAddict brand. This policy applies to openbimgame.com, its authorized preview versions, and features associated with user accounts.

We process only the data required to provide, protect, and improve game features.

Depending on how you use the service, this may include:

• Account data: email address, public name, identifier, time zone, and account status.
• Game activity: answers, attempts, points, streaks, statistics, dates, and leaderboard position.
• Technical data: IP address and user agent transformed by hashing, anonymous session identifier, and security logs.
• Administrative data: roles, score adjustments, and audit actions where applicable. We also process the email and language of people who request to join the waitlist.

We use data to operate openBIMGame and provide a consistent experience to visitors and registered users.

The specific purposes are:

• Creating and managing accounts, sessions, and access recovery.
• Recording answers and calculating scores, progress, streaks, and leaderboards.
• Preventing duplicate answers, fraud, automation, abuse, and unauthorized access.
• Handling requests, incidents, data rights, and notifying people who request it when registration reopens.
• Maintaining, debugging, and protecting service availability.

Processing relies on different legal bases depending on the requested feature.

These bases are:

• Performance of the terms of use to manage your account, answers, and leaderboard entries.
• Legitimate interests in protecting the service, preventing fraud, and resolving incidents, balanced against your rights.
• Compliance with legal obligations and consent to retain a waitlist email and notify you when registration reopens.

Your chosen public name, country, score, accuracy, streak, and position may appear on leaderboards accessible to other users and visitors.

We do not publish your email address. Do not include personal data about yourself or others in your display name.

We currently use no advertising cookies or product analytics cookies. We use storage that is strictly necessary to provide requested features.

This includes:

• Supabase cookies to maintain and securely refresh an authenticated session.
• NEXT_LOCALE to remember the selected language.
• anon_session, a secure 24-hour cookie that prevents repeated answers before sign-in.

We use providers acting as processors that receive only the information required to deliver their services.

The main providers are:

• Supabase, for authentication, database, and storage.
• Vercel, for hosting, content delivery, and application execution.
• If a provider processes data outside the European Economic Area, we apply safeguards provided by the GDPR, such as adequacy decisions or standard contractual clauses. You may request further information through the stated contact.

Account and activity data are retained while the account is active and afterwards for as long as needed to handle requests, prevent abuse, or comply with legal obligations.

The anonymous session cookie expires after 24 hours. Pseudonymized technical records associated with anonymous answers are automatically deleted after 30 days. Waitlist emails are retained until registration reopens, consent is withdrawn, or deletion is requested.

You can exercise your rights by writing to privacy@openbimgame.com. We may request reasonable information to verify your identity.

Under the GDPR, you may request:

• Access to your personal data.
• Correction of inaccurate data.
• Deletion of your account and data where applicable.
• Restriction of or objection to processing.
• Portability of data you provided.
• A complaint to the Spanish Data Protection Agency.

We apply access controls, role isolation, encryption in transit, row-level security policies, and measures to limit abuse and unauthorized access.

No system is completely infallible. If you identify a vulnerability or misuse, report it responsibly using the contact provided.

openBIMGame is not specifically directed at children under 14. Anyone below the legal age for consent must use the service with authorization from a legal representative.

If we learn that a child's data was registered without valid authorization, we will take steps to delete it.

We may update this policy when features, providers, or legal requirements change. We will publish the new version with its update date.

For questions not resolved here, contact IfcAddict at privacy@openbimgame.com.