Privacy policy

Controller

Bmetrix Sweden AB, company registration number [org.nr], [adress] is the controller for the processing described here.

Contact for data protection matters: andreas.waleij@bossmetric.com. Data protection officer: [dataskyddsombud, om något är utsett].

1. Customer data

About you as a user of the service we process: your name if you provide it, your email address, sign-in details from the email link or Google sign-in, your settings, and logs of what you did in the service (runs, timestamps, error messages, technical logs).

The legal basis is performance of contract - we need the data to give you an account and run analyses. Logs kept for security and debugging are processed under legitimate interest.

Customer data is not used for profiling, advertising, or sold to third parties.

2. Invite requests

When you request an invite we collect your name and work email, plus company, role and games if you choose to provide them. We use the information to assess the request and reply personally by email.

For spam prevention and security we also store a one-way hash of the submitting IP address, the browser user-agent and the time of the request. The raw IP address is not stored with the request. The legal basis is our legitimate interest in handling genuine business enquiries and protecting the form from misuse.

New, contacted and invited requests are retained while the business dialogue is active and as needed to document it. Declined requests are deleted after 12 months. You may ask us to delete your request earlier unless we need a limited record to prevent abuse or meet a legal obligation.

3. Personal data in Steam reviews

Steam reviews contain personal data about the person who wrote them: a persistent identifier for the review and the account, playtime, whether the review is positive or negative, date, language, and the free text, which may contain anything the reviewer chose to write.

These people are not our customers and have not been asked. We say so plainly rather than glossing over it: we process their published text in order to aggregate it into a report for the developer of the game they reviewed.

The legal basis is legitimate interest under Article 6(1)(f) GDPR. The balancing test in short: the data was published publicly by the individual on a public page, the purpose is aggregate analysis for the developer of the very game the person reviewed, processing is limited to what the review contains, and no decisions are made about the individual.

What we do not do

• We do not build profiles of individual reviewers or players.
• We do not contact reviewers, and the service may not be used for that.
• We do not enrich review data with data from other sources.
• We do not sell review data or report output.
• We do not use review data to train our own models.

Information to reviewers

Informing each individual reviewer would require attempting to contact thousands of people we only know through a public account identifier, which is neither possible nor proportionate. We therefore rely on the exemption in Article 14(5)(b) GDPR.

This policy is the public notice instead, and it describes the processing, the basis for it, and how to request erasure.

Sub-processors

The following providers process data on our behalf. Locations and transfer mechanisms marked in square brackets must be verified against the provider's current terms before being stated as established fact.

• Anthropic - model inference. Review text is sent to the Claude API for labelling, synthesis and translation. Processing takes place in [United States - to verify]. Transfers outside the EU/EEA rely on [standard contractual clauses - to verify].
• Supabase - database, authentication and storage. Processing takes place in [EU region - to verify]. Any transfer to the United States for support and operations relies on [standard contractual clauses - to verify].
• Lovable - application hosting. Processing takes place in [EU/global edge infrastructure - to verify]. Any transfer outside the EU/EEA relies on [standard contractual clauses - to verify].
• [Email provider] - sending sign-in links and monitoring emails. Added here with location and transfer mechanism when email sending is enabled.

Retention

• Fetched reviews and labels: as long as needed for your reports and to track change over time, at most 24 months after the last run for that game.
• Reports: as long as the account exists, or until you delete the run.
• Account data: as long as the account exists, then deleted within 30 days.
• Technical logs: at most 12 months.
• Invite requests: while the dialogue is active; declined requests are deleted after 12 months.
• You can delete an individual run at any time, and request deletion of all your runs and reports.

Your rights

You have the right of access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interest.

Send requests to andreas.waleij@bossmetric.com. We respond within one month.

You may also complain to the Swedish Authority for Privacy Protection (IMY), the supervisory authority in Sweden.

If your review was processed

If you are a reviewer and want your reviews deleted from the service, send a request to andreas.waleij@bossmetric.com. Include the game name or app ID and a link to your review, or your Steam profile ID, so we can find the right row. We need nothing more than that.

We delete the review text and its labels, and block the identifier from being fetched again. Reports already generated may contain a quote - tell us if a quote should go and we will remove it from the report.

You can also object to the processing without requesting erasure. We will then rebalance and stop processing unless we have compelling legitimate grounds to continue.

Security

Access to data requires sign-in, and the database uses row level security so you can only reach your own runs and reports. Traffic is encrypted in transit.