Privacy Policy

Who processes your data

SunStar Decision, 19 avenue d'Italie, 75013 Paris, is the data controller for your account and club data. Contact: contact@mypokercaptain.com

What we collect

Your account: e-mail address, name, and a password we never store in plain text — only a cryptographic hash of it is kept. If you sign in with Google, we receive your address, your name and your profile photo, nothing else.

Your club: its name, its city, its members and their role, its partners and their logos.

Your players and tournaments: names and nicknames, license numbers, contact details if you enter them, registrations, stacks, eliminations, payouts, standings.

Your subscription: the plan, its status and its renewal date. No banking data ever passes through our servers — the card number is entered with Stripe, on a page that isn't ours, and we never see any of it.

Technical logs: IP address, date and time of connections, errors encountered. They're used for security and troubleshooting, nothing else.

Why, and on what basis

To run the service and manage your subscription: performance of the contract between us.

To keep invoices: a legal obligation, ten years, which we cannot bypass even at your request.

To secure accounts and prevent fraud: our legitimate interest, and yours.

We do no advertising, no profiling, no reselling of data. There's nothing to turn off, because there's nothing there.

Your club's players

Your players' records are entered by you, not by us. For this data, the club is the data controller and we are its processor: we host and process it solely on your instructions.

This is your responsibility: only record what's useful to you, inform your players that their details are being recorded, and respond to anyone who asks for their record to be deleted. The application gives you the tools to do it.

For how long

Your account and club data lives as long as the account exists, then three years after our last exchange.

Invoices and accounting records: ten years, a legal obligation.

Connection logs: one year.

When an account is deleted, the data is erased from our databases within thirty days. Automatic database backups are then removed according to our host's retention cycle.

Who else has access

Five providers, each for a single purpose: Neon (database, European Union), Railway (application hosting, servers in the Netherlands), Resend (sending e-mails), Stripe Payments Europe (subscription payments, Ireland), and Google (only if you choose to sign in with a Google account).

None of them is allowed to use your data for its own purposes. Resend is based in the United States: the e-mails entrusted to it — your address and the message content — are transferred there under the European Commission's standard contractual clauses.

We do not sell or rent data to anyone.

Cookies

A session cookie, which keeps you signed in, and a local storage space that retains your plan and the current tournament so the application works without a network. Both are strictly necessary for the service.

No audience measurement, no advertising trackers, no social networks. That's why you've never seen a consent banner here: there's nothing to consent to.

Your rights

You can request access to your data, its correction, its deletion, its portability, or object to processing. Write to contact@mypokercaptain.com: we reply within one month.

If our response doesn't satisfy you, you can refer the matter to the CNIL (Commission nationale de l'informatique et des libertés — the French data protection authority), 3 place de Fontenoy, 75007 Paris, cnil.fr.

Security

Exchanges are encrypted end-to-end via HTTPS. Passwords are hashed. Activation codes are hashed too and expire after fifteen minutes. Access to the databases is restricted and logged.

No system is unbreakable. In the event of a breach posing a risk to your rights, we will inform you and the CNIL, within the timeframes set out by the regulation.

Changes

Any change to this policy will be announced by e-mail to account holders before it takes effect.