Privacy Policy — Padel & Poker
Version 1.3 · Effective from 06-10-2026
1. Who is responsible
Data controller: We make AI work s.r.o., IČO 29697115, Nové sady 988/2, Staré Brno, 602 00 Brno, contact support@wemakeai.work. Padel & Poker is our product; this policy covers only it.
2. Our default: minimise
We collect as little as we can, technically and legally (our internal rule: minimise → hash → encrypt). We do not sell data. There is no third-party advertising, analytics or cross-site tracking of any kind in the app. Players need no account; everything about your game is kept in your own browser.
3. What we collect and exactly why
A complete table — if it is not here, the app does not keep it. Not collected: no analytics, no advertising, no tracking or third-party cookies, no profiling, no location, no payment data. A "Suggest a template" link carries the setup inside the link itself, with player names removed, and we store nothing from it.
| What | Why | Legal basis | Kept for | Where |
|---|---|---|---|---|
| Dealer account: the dealer's email address, the password as a bcrypt hash (never the password itself), when it was last changed, and a sign-out counter | the one admin login, so only the dealer can save, change and delete templates | legitimate interest (Art. 6(1)(f)): securing the admin login | until the dealer account is removed | Scaleway (EU, Paris) |
| Password-reset code: the random code in the last reset link and when it expires | letting the dealer set a new password | legitimate interest (6(1)(f)) | valid for 1 hour; wiped when it is used, otherwise left unusable until the next reset request replaces it | Scaleway (EU, Paris) |
| Dealer session cookie (dealer_session): the dealer's email address, the sign-in time and the sign-out counter — signed so it cannot be forged, not encrypted | keeping the dealer signed in | legitimate interest (6(1)(f)) | 30 days, or until the dealer signs out or changes the password | the dealer's own browser; sent to our server with each request |
| Saved templates: a name and the whole setup at the moment of saving — chips, prices, blind and payout settings, and any player names typed into the setup | letting the dealer re-use a setup; every visitor of the site can see and load the saved templates | legitimate interest (6(1)(f)) | until the dealer deletes the template | Scaleway (EU, Paris); the public list is also cached for a few minutes at Bunny's edge (EU) |
| Sign-in attempt counter: for every attempt on the dealer sign-in or password-reset forms, a keyed hash (HMAC) of the email address typed in — or of the reset code — and the time; never the address itself | stopping password guessing and mail flooding (at most 10 sign-ins per 15 minutes and 3 reset requests per hour per address) | legitimate interest (6(1)(f)): security | removed once older than one day, at the next attempt after that | Scaleway (EU, Paris) |
| Audit log: for each dealer sign-in (successful, failed or blocked), password-reset request, password change and sign-out — the time, what happened, a keyed hash of the email address typed in, and before/after timestamps or counters; never a password, hash, code or cookie | so no change to the admin login is silent, and misuse can be traced | legitimate interest (6(1)(f)) | no automatic deletion today | Scaleway (EU, Paris) |
| Technical logs and alarm state: the app's error and event lines (event names, error messages, counts) and which alarms are firing. The app never writes an email address, password, code, cookie or IP address into them | keeping the service working; errors are mailed to our own technical team | legitimate interest (6(1)(f)) | logs under Scaleway's standard log retention; an alarm's state until it recovers | Scaleway (EU, Paris) |
| Edge request log: your IP address, the time, the page or file requested and your browser's user agent. Our app code itself never reads your IP address | delivering the site and protecting it from abuse; we also count distinct visitors per day from it and keep only that daily number | legitimate interest (6(1)(f)) | under Bunny's log retention; the daily count without a time limit | BunnyWay (EU, Slovenia) |
| Password-reset email: the dealer's email address and the reset link — only ever to the one dealer address | sending the dealer a reset link they asked for | legitimate interest (6(1)(f)) | not kept by us after sending | sent through Scaleway's transactional mail service (EU) |
| In your browser only: your setup (chips, players and their names, prices, blinds), the running game (rebuys, add-ons, who is out, final chip counts), your language and the offline copy of the app — listed in the Cookie Policy | running the planner and the clock on your screen | none needed by us: it never reaches our server — unless the dealer saves the setup as a template (row above) | until you clear the site data in your browser | your device only |
| Your email to support@wemakeai.work: your address and what you write | answering you | legitimate interest (6(1)(f)) | as long as needed to handle your message | Google Workspace (Google Ireland Ltd.) |
4. Who else touches the data (processors)
Each processor is bound by a data processing agreement and may not use the data for its own purposes. No AI service receives any data.
- Scaleway SAS (Paris, France, EU) — hosts the app, its database and its logs, and sends the dealer's password-reset email when one is requested.
- BunnyWay d.o.o. (Ljubljana, Slovenia, EU) — the content delivery network and DNS in front of the site: your browser talks to its edge first, so it sees your IP address and what you request, and keeps the request log in §3. EU visitors are served from EU nodes.
- Google Ireland Ltd. (Dublin, Ireland) — Google Workspace hosts the mailbox behind support@wemakeai.work: when you write to it, your message and address are stored there; nothing else from the app goes to Google.
- Not a processor: if you use the WhatsApp contact link in the footer, you leave this site for WhatsApp (WhatsApp Ireland Ltd., part of Meta), which handles that conversation as its own controller under its own privacy policy. This site sends WhatsApp nothing.
5. Your rights
Access, rectification, erasure, restriction, portability, objection — write to support@wemakeai.work, we act within 30 days. If your name is in a saved template, tell us which one and we remove it. The sign-in counter and the audit log hold only keyed hashes: tell us the email address you typed and we can find the rows. You can complain to the Czech supervisory authority: ÚOOÚ, https://uoou.gov.cz.
6. Cookies and consent
This site sets one cookie, dealer_session, and only after the dealer signs in. Everything else it keeps in your browser — your setup, the running game, your language and the offline copy of the app — is listed in the Cookie Policy at https://poker.wemakeai.work/cookies. All of it is strictly necessary for something you asked for, so there is no consent banner: there is nothing optional to agree to.
7. If you decline everything — the honest trade-off
There is nothing optional to decline: no analytics, no ads, no tracking. The planner and the clock work fully without any account, and your setup lives only in this browser — clearing the browser's site data deletes it. What we still see when you visit is what our edge sees for every visitor (the edge request log in §3), nothing more.
8. Changes
Changes to the service that touch data (a new feature, a new cookie, a new processor) update this policy in the same release — the version and date above always tell you where you stand.