Privacy Policy

This policy explains how we process your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish data protection law.

1. Data controller

Data controller: David González Nuez, the private individual who runs Leonida Bay in a personal capacity, resident in Spain and with no economic activity. Contact for any personal data matter: contacto@leonidabay.com. We have not appointed a data protection officer because, given the kind of processing, it is not mandatory.

2. What data we process

• Account data: email, encrypted password (kept by our authentication provider; we never see it) and, if you sign in with Google, the basic profile data Google shares with us (name, email and photo).
• What you post: comments, suggestions, votes, images and the public name and profile you choose. It is visible to other visitors, except private messages.
• Preferences: language, theme and the email notifications you subscribe to.
• Technical data: security and error logs (IP address, browser, page and time) to protect the Site, limit abuse and fix bugs.
• Chat and private messages: the text of user chat messages and private messages, with their date and author. Private messages are only visible to the people in the conversation; the owner only accesses them if needed to handle a report or a legal obligation.
• Newsletter: your email, chosen language, sending preferences and the confirmation of your subscription (we ask you to confirm it from the email itself).

3. Purposes and legal basis

• Giving you access and operating your account — performance of the contract (the Terms).
• Displaying your activity and content — performance of the contract.
• Sending you the newsletter and the alerts you ask for — your consent, which you give by confirming the subscription from the email and can withdraw at any time with the unsubscribe link in every email.
• Security, abuse prevention and improving the Site — legitimate interest.
• Complying with legal obligations where applicable.
• Translating a chat message or a comment when you ask for it with the «Translate» button: only then is that text sent to DeepL, never automatically and never private messages — legitimate interest in letting users who speak different languages understand each other. You can object by writing to us.

We do not sell your data, we do not use it for advertising and we do not make automated decisions that significantly affect you.

4. Providers and international transfers

We rely on these providers, which process data on our behalf (processors) under their data processing agreements: Supabase (accounts, database and image storage), Cloudflare (hosting, content delivery, attack protection and aggregate, cookieless visit statistics), Resend (email delivery), Sentry (error diagnostics) and DeepL (translation of chat messages and comments, only when you press «Translate» on one of them: it then receives that text and nothing else; an EU company). If you sign in with Google, Google identifies you and passes us your basic data. Several of these providers are based in the United States: in that case the international transfer relies on the EU-US Data Privacy Framework, where the provider has joined it, or on the European Commission's standard contractual clauses (art. 46 GDPR). YouTube videos only load if you press play; from then on Google processes your data as a controller under its own policy. Our Discord server and Telegram channel are services of those platforms, with their own policies; we receive no data about your account from them.

5. Retention

We keep your account data and what you post while your account is active and, afterwards, only what is needed to meet legal obligations or resolve disputes. You can delete your account yourself from Account → Privacy → "Delete my account" (or by writing to contacto@leonidabay.com): we delete your profile, your contributions and your email subscription, except what the law requires us to keep. Other periods: newsletter, until you unsubscribe (unconfirmed subscriptions are deleted after 30 days); own analytics, 14 months; security logs, a few days; backups, rotated and gone within 8 weeks at most.

6. Cookies and local storage

We use strictly necessary storage for the Site to work: your sign-in session, your language and your cookie choice. Your browser also keeps preferences you choose, such as the theme or the music volume, and the progress of some mini-games, without sending them to measure you. Our own anonymous analytics only runs if you accept it. We do not use advertising cookies. Details in the cookie policy.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time (for example, by unsubscribing from emails). To do so, write to contacto@leonidabay.com; we will reply within one month at the latest. You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es) if you think we have not respected your rights.

8. Minors

To create an account, comment, use the chat or subscribe to the newsletter you must be at least 14 years old (article 7 of Spanish Organic Law 3/2018). GTA VI is a game for adults (PEGI 18): the Site only reports on it and does not sell or distribute it. If we detect data from a child under 14 without their parents' or guardians' authorisation, we will delete it.

9. Changes

We may update this policy; we will publish the new version here with its date. The Spanish version prevails over any translation.