1. Controller
Vibe Lab, Spanish self-employed business (autónomo), VAT ESY7067844A, C/ Cristo de la epidemia 60, 29013 Málaga, Spain. Contact: support@somewars.com. Vibe Lab is the data controller. Privacy requests may be sent to support@somewars.com and complaints may be submitted to the Spanish Data Protection Agency (AEPD).
2. Data collected
Account/profile data; birth date, country and policy acceptance; authentication/security records; provider IDs, encrypted OAuth tokens and scopes; selected post URLs and analytics; participation, scores, rankings, invites; moderation/audit records; device, preference and service logs.
3. Purposes and legal bases
Contract supports account, competition and scoring operations. Legitimate interests support security, fraud prevention, service integrity and proportionate improvement. Legal obligations support compliance. Consent applies to optional analytics/marketing storage and processing where specifically requested; it may be withdrawn without affecting earlier lawful processing.
4. Social providers
SoMe Wars does not receive uploaded copies of social posts. APIs return permitted metadata and analytics. Tokens are encrypted. Providers remain responsible for their platforms. Disconnecting stops future access but may not erase scoring evidence required for integrity or disputes.
5. Sharing and transfers
Vetted hosting, database, security, email, monitoring and social providers may process data. Public profiles, leaderboards and arenas show limited competition information. Personal data is not sold. Transfers outside the EEA require an adequacy decision or approved safeguards.
6. Retention
Account data is kept while active; OAuth tokens until disconnect or invalidation; security logs normally up to 12 months; scoring and audit evidence normally up to 24 months after challenge completion; backups rotate under the operational schedule. Legal holds may extend retention.
7. Rights
Depending on law, you may request access, correction, deletion, restriction, portability or objection, withdraw consent and complain to the AEPD or your local authority. We may verify identity. Parents may exercise applicable rights for a child.
8. Children
The service rejects users under 13. Under Spanish law, a 13-year-old requires parental authorization for consent-based processing; other countries differ. Date-of-birth self-declaration and guardian attestation are MVP controls, not completed verifiable parental consent. High-privacy defaults apply.
9. Security
Passwords are hashed, OAuth secrets encrypted, administration least-privileged, data services private and privileged changes audited. No system is risk-free; report concerns to support@somewars.com.