Privacy Policy

Last updated 5 August 2026

Who is responsible

The data controller is The Monkey Co., KVK 82424357, Livingstonelaan 898, Utrecht. For anything about your data, email invites@essolis.com.

What we collect

Data	Why	Legal basis
Email address and password	To create and secure your account	Performance of a contract
Username, tag and colour	So other players can recognise you	Performance of a contract
Your campaign content — characters, maps, notes, lore, uploads	It is the product	Performance of a contract
Billing name, address and country	Required for VAT on digital sales	Legal obligation
Order records — what you bought, when, for how much	Accounting and support	Legal obligation
Error reports — message, page, browser, your uid	To find and fix crashes	Legitimate interest
Feedback you submit in the app	To improve Essolis	Consent — you chose to send it
Last-seen timestamp and session count	To show who is online and stop ghost sessions	Legitimate interest

We never see your card details. Payment happens entirely on Stripe's own hosted page. We receive only the outcome: that a payment succeeded, the amount, the tax, the country and the email you gave Stripe.

There is no advertising, no analytics tracking, and no third-party trackers on Essolis.

Who processes it for us

Google Firebase — authentication, database and file storage. Data is held in the EU (europe-west1).
Stripe — payment processing, receipts and VAT invoices.
Brevo — sending invite and order emails.
Cloudflare — domain and email routing.

Each is a processor acting on our instructions. Some may transfer data outside the EU under Standard Contractual Clauses.

Who else can see your content

Only the people you invite. Campaign content is readable by that campaign's members and no one else — this is enforced by database rules, not just by the interface.

As the operator, we have administrative access to the database and can technically see your content. We look at it only when you ask for support, or when investigating abuse or a technical fault.

How long we keep it

Account and campaign data — until you delete your account.
Order and payment records: 7 years, because Dutch tax law requires it. This survives account deletion; we are not permitted to delete it on request.
Error reports: 90 days.
Used invite and order codes — kept as a record of who was given access.

Your rights

Under the GDPR you can ask us to:

give you a copy of your data (there is also a campaign export inside the app);
correct anything wrong;
delete your account and content — the Account page does this immediately and permanently;
restrict or object to processing based on legitimate interest;
port your data elsewhere.

The one thing we cannot delete on request is the financial record of a purchase, for the tax reason above.

If you are unhappy with how we handle your data you can complain to the Dutch DPA, the Autoriteit Persoonsgegevens.

Cookies and local storage

Essolis sets no advertising or analytics cookies. It stores your login session and a few interface preferences in your browser's local storage, which is strictly necessary to keep you signed in. That is why there is no cookie banner — there is nothing to consent to.

Security

Passwords are handled by Firebase Authentication and never stored by us. Access to campaign data is enforced server-side by database rules. Account entitlements can only be written by our server, never by a browser.

If a breach ever affects your data, we will tell you and the DPA within 72 hours of becoming aware of it.