Privacy Policy
Last updated: May 6, 2026
Rosters Co. (“we,” “us,” or “our”) is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and what rights you have. It applies to all users of the Service, with additional rights described for users in the European Union, the United Kingdom, and Mexico.
1. Data Controller
Rosters Co. is the data controller for personal information collected through the Service. For questions about your data, contact us at rostersco@gmail.com.
2. Data We Collect
We collect the following categories of data:
- Account data: your email address, chosen company name, and avatar selection. Collected when you register.
- Gameplay data: cafe names and settings, menu configurations, supply purchase history, financial transactions within the game, and session activity timestamps.
- Payment data: if you subscribe as a Supporter, your payment is processed by Stripe. We receive a customer identifier and subscription status from Stripe. We do not store your card number, expiry date, or CVV.
- Technical data: IP address and basic device information collected automatically by our hosting provider (Supabase and Vercel) for security and abuse prevention.
3. How We Use Your Data
We use your data exclusively to:
- Operate and maintain your account and game state
- Process Supporter subscription payments and enforce account protection
- Apply the 30-day inactivity deletion policy for free accounts
- Prevent fraud, abuse, and unauthorized access
- Send transactional communications related to your account (such as payment receipts or service notices)
We do not sell your personal data. We do not use your data for advertising or share it with third-party marketing partners.
4. Data Sharing
We share data with the following service providers, strictly to operate the Service:
- Supabase: database and authentication infrastructure. Your account data and gameplay data are stored on Supabase servers.
- Vercel: hosting and deployment. Processes web requests and may log IP addresses for security.
- Stripe:payment processing for Supporter subscriptions. Stripe's privacy policy applies to data you provide during checkout.
5. Data Retention
We retain your data for as long as your account is active. Free accounts inactive for 30 consecutive days are permanently deleted along with all associated gameplay data. Supporter accounts are retained for as long as the subscription remains active.
After account deletion, residual data (such as anonymized aggregate statistics) may be retained indefinitely. Payment records are retained for the period required by applicable financial regulations.
6. Your Rights Under GDPR (EU and UK Users)
If you are located in the European Union or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:
- Access: request a copy of the personal data we hold about you
- Rectification: request correction of inaccurate data
- Erasure: request deletion of your personal data (subject to legal retention obligations)
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interests
- Restriction: request that we limit how we process your data while a complaint is resolved
To exercise any of these rights, contact us at rostersco@gmail.com. You also have the right to lodge a complaint with your local supervisory authority.
7. Your Rights Under LFPDPPP (Mexico Users)
If you are located in Mexico, your personal data is processed in accordance with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). You have the ARCO rights: Access, Rectification, Cancellation, and Opposition.
To exercise your ARCO rights, submit a written request to rostersco@gmail.com including your full name, a description of your request, and any supporting documentation. We will respond within 20 business days.
8. Cookies
We use essential cookies only. See our Cookie Policy for details.
9. Security
We use industry-standard security measures including encrypted data transmission (HTTPS), secure authentication tokens, and access controls. No method of transmission over the internet is completely secure. In the event of a data breach affecting your rights, we will notify you as required by applicable law.
10. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated by email or in-app notice before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
11. Contact
For any privacy-related questions or requests, contact us at rostersco@gmail.com.