Privacy Policy

Version: 2026-10-05 · Last updated: 5 October 2026

1. Controller

The controller for Plaidia's own processing is the service provider identified in the Imprint. Privacy enquiries can be sent to contact@plaidia.com.

2. Data we process

• Account data: username, display name, email address, date of birth, verification status, authentication/security settings, and account status.
• OAuth data: where you connect a supported account such as Discord, identifiers and profile information returned by that provider.
• UGC and social data: games, assets, posts, comments, communities, messages or reports you submit, plus related metadata and moderation records.
• Usage and technical data: sessions, device/browser information, IP/security signals, logs, feature activity, and records needed to keep Plaidia reliable and secure.
• Economy and billing data: Plaix ledger entries, orders, product/price snapshots, payment-provider customer/payment/invoice/subscription/refund/dispute identifiers, settlement records, and transaction-support history. Plaidia does not receive or store full payment-card numbers from hosted checkout.
• Risk and abuse-prevention data: transaction velocity, account age, verification state, disputes, restrictions, manual-review records, and other signals used to prevent fraud and protect the creator economy.
• Consumer-rights and support data: withdrawal/cancellation declarations, support communications, and the information needed to identify and process the relevant contract.

3. Why we process data and legal bases

• Provide the service and perform contracts (Art. 6(1)(b) GDPR), including accounts, games, subscriptions, Plaix, entitlements, purchases, and support.
• Comply with legal obligations (Art. 6(1)(c) GDPR), including accounting, consumer-rights, tax/documentation, lawful requests, and safety obligations where applicable.
• Legitimate interests (Art. 6(1)(f) GDPR), including service security, fraud prevention, abuse detection, moderation, enforcing platform rules, reliability, and defending legal claims. We balance these interests against user rights.
• Consent (Art. 6(1)(a) GDPR) where a feature specifically requires it, for example optional non-essential tracking if introduced. Consent can be withdrawn for future processing at any time.

4. Payments and Stripe

Hosted payments are processed by Stripe and its affiliates. Depending on the product and checkout configuration, Stripe can act as payment processor or, where Stripe Managed Payments is enabled for an eligible transaction, the applicable Stripe/Link affiliate can act as merchant of record. Stripe processes data needed for checkout, payment methods, receipts, fraud/disputes, transaction support, and related compliance; Managed Payments can also cover applicable indirect-tax functions. Stripe can act as an independent controller or processor depending on the processing activity. Please review the privacy information presented by Stripe/Link during checkout.

Plaidia receives provider identifiers and transaction status needed to grant Plaix or Premium, process refunds and disputes, reconcile provider records, and support users. Full card data stays with the payment provider.

5. Other recipients and service providers

We disclose data only where needed for the service, legal compliance, or a legitimate purpose. Recipients can include hosting/storage providers, email delivery providers, security/anti-abuse services, authentication providers you choose to connect, payment providers, professional advisers, and competent authorities where legally required.

Providers are selected and configured according to their role. Where required, data-processing agreements and appropriate safeguards are used.

6. International transfers

Some providers may process data outside Germany or the EEA. Where GDPR transfer rules apply, transfers are based on an applicable adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary safeguards where appropriate.

7. Retention

We keep personal data only as long as necessary for the relevant purpose. Account and user content data is generally retained while the account/content exists, subject to deletion and backup cycles. Security logs and abuse records are kept for periods proportionate to the security purpose. Billing, accounting, legal, consumer-request, and transaction records may be retained longer where required by law or necessary for disputes, fraud prevention, or legal claims.

Deleting an account does not require immediate deletion of records that must be retained by law or are necessary to establish, exercise, or defend legal claims.

8. Automated risk signals and manual review

Plaidia uses automated rules and risk signals to detect suspicious payments, transfers, and creator-commerce activity. A transaction can be allowed, blocked, or sent to manual review. Where an automated decision would produce legal or similarly significant effects and applicable law grants additional protections, we will provide the safeguards required by law, including human review where appropriate.

9. Children and younger users

Plaidia can be used by younger users subject to our age rules. We use date of birth to apply age-related product and safety rules. We do not permit another person's payment method to be used without authorization. Additional parental controls and consent mechanisms may apply as the platform develops and where required by law.

10. Your rights

Depending on the circumstances, GDPR gives you rights of access, rectification, erasure, restriction, data portability, and objection. Where processing is based on consent, you can withdraw consent for the future. Where processing is based on legitimate interests, you can object on grounds relating to your particular situation.

You also have the right to lodge a complaint with a competent data-protection supervisory authority. You may contact the authority in the EU/EEA country of your habitual residence, place of work, or the place of an alleged infringement.

11. Security

We use technical and organizational measures designed to protect personal data, including access controls, authentication protections, audit records, payment-provider separation, and security monitoring. No internet service can guarantee absolute security.

12. Cookies and local storage

Necessary cookies and similar storage are used for login sessions, security, CSRF protection, and preferences. Optional tracking technologies, if introduced, are handled according to applicable consent requirements. See our Cookie Policy.

13. Changes

We may update this Privacy Policy when our processing or legal obligations change. We will provide appropriate notice of material changes.