1. Data Controller#

The data controller for purposes of the General Data Protection Regulation (GDPR) and applicable Spanish data protection law (LOPDGDD) is:

·Company: Atiempo.Me SL
·CIF (Tax ID): B56542111
·Registered address: Calle Timón 58 — Oficina 17, Centro Comercial Torrequebrada, 29631 Benalmádena (Málaga), Spain
·Commercial registry: Registro Mercantil de Málaga, Tomo 6412, Libro 5320, Folio 161, Sección 8, Hoja MA-177456, Inscripción 1
·Data Protection Officer: [email protected]

2. Data We Collect#

We collect the minimum data necessary to provide the Service:

·Affiliate attribution: if you open the bot via a partner referral link, we record which partner code referred you and the timestamp, so we can credit recurring commission to that partner (legitimate interest / contract performance)
·Telegram ID (a numeric identifier assigned by Telegram)
·Telegram username (if set by the user)
·Telegram interface language setting
·Game progress data (current case, choices made, token balance, subscription status)
·Payment events (timestamp, amount, currency, transaction reference) — we do NOT store card numbers; all payment processing is handled by Stripe

3. Legal Basis for Processing#

We process your data on the following legal bases:

·Contract performance (Art. 6(1)(b) GDPR): processing necessary to deliver the game Service you have requested, including managing your account, delivering content, and processing subscriptions
·Legitimate interest (Art. 6(1)(f) GDPR): analytics and service improvement, fraud prevention, and security monitoring
·Consent (Art. 6(1)(a) GDPR): for non-essential cookies, where you have expressly provided consent via our cookie banner
·Legal obligation (Art. 6(1)(c) GDPR): where required by applicable law, including tax and accounting regulations

4. Data Retention#

We retain personal data for the following periods:

·Account data (Telegram ID, username, game progress): lifetime of the account, plus 90 days after deletion to allow for reactivation
·Payment records: 6 years from the transaction date in compliance with Spanish tax law (Ley General Tributaria)
·Cookie consent records: 6 months or until withdrawn
·Support communications: 2 years

5. Third-Party Service Providers#

We share data with the following third-party processors, all bound by appropriate Data Processing Agreements:

·Stripe, Inc. (USA) — payment processing. PCI DSS certified; operates under Standard Contractual Clauses.
·Anthropic PBC / OpenAI, Inc. (USA) — AI content generation for narrative and storylines. Anonymised game prompts only.
·ElevenLabs, Inc. (USA) — text-to-speech audio for voice clues. Narrative script text only.
·Google LLC (USA) — AI and cloud services. Anonymised content generation requests.
·Cloudflare, Inc. (USA) — CDN, DDoS protection, DNS. Processes IP addresses in transit under Standard Contractual Clauses.
·Sentry / Functional Software, Inc. (USA) — error tracking. Anonymised error logs.
·Telegram Messenger Inc. — the primary interface through which the Service is delivered. Subject to Telegram's own Privacy Policy.

6. International Data Transfers#

Some of our service providers are located in the United States. Where we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

·Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914)
·Data Processing Agreements incorporating all required GDPR safeguards
·Adequacy decisions where applicable

7. Your Rights#

Under the GDPR and Spanish data protection law, you have the following rights:

·Right of access (Art. 15): to request a copy of the personal data we hold about you
·Right to rectification (Art. 16): to request correction of inaccurate or incomplete data
·Right to erasure (Art. 17): to request deletion of your data ("right to be forgotten"), subject to legal retention requirements
·Right to data portability (Art. 20): to receive your data in a structured, machine-readable format
·Right to restriction of processing (Art. 18): to request we limit processing of your data in certain circumstances
·Right to object (Art. 21): to object to processing based on legitimate interests
·Right to withdraw consent: for consent-based processing, to withdraw consent at any time
·Right to lodge a complaint: with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es

8. How to Exercise Your Rights#

To exercise any of your rights, please contact us at [email protected]. We will respond within 30 days of receiving your request.

We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests.

The Service is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected data from a person under 18, we will delete that data promptly.

If you believe we may have collected data from a minor, please contact us immediately at [email protected].

10. Updates to This Policy#

We may update this Privacy Policy from time to time. We will notify active users of material changes via the Telegram bot. The "Last updated" date at the top of this page indicates when the policy was last revised.

Continued use of the Service after changes constitutes acceptance of the updated policy.