1. Controller (Art. 4 (7) GDPR)

Cosmic Drift Game Studio Marc Frost Slevogtstr. 10 04159 Leipzig Germany Privacy contact: hello@kumiko.rocks

2. Data Collected + Purpose

2.1 When visiting the site

• IP address (truncated after 7 days)
• User-Agent
• Request time

Legal basis: Art. 6(1)(f) — legitimate interest (security, performance monitoring). Retention: server logs max. 7 days.

2.2 When submitting an RSVP (guest, anonymous)

• Name (required)
• Email address (optional, confirmation mail only)
• Attendance status (yes/no/maybe) + number of extra guests
• Free-text note (optional)

Legal basis: Art. 6(1)(f) — the host's legitimate interest in organizing their event, on whose behalf we act as processor. Retention: while the event or host account is active; afterwards per the host's deletion policy.

2.3 Account creation (host account)

• Email address
• Display name
• Hashed password
• Events, invite pages and guest lists you create

Legal basis: Art. 6(1)(b) — contract performance. Retention: while your account is active; after deletion, personal data is removed within 30 days unless statutory retention applies.

3. Roles on guest events

Show Pony lets individuals and teams ("hosts") publish their own event invite pages and collect guest RSVPs.

• If you are a host: You are the controller for the event content you publish and for your guests' RSVP data. We process this data as a processor under GDPR Art. 28 as part of your use of the service.
• If you only RSVP on an invite page as a guest: That host is the controller. We provide the platform and send a confirmation email on the host's behalf if you provided an email address.

4. Cookies

We use:

• one strictly necessary auth-session cookie (Art. 6(1)(f))
• no tracking cookies — no marketing cookie banner required

Sub-processors

We use the following sub-processors per GDPR Art. 28:

| Provider | Purpose | Location | Data processed | |---|---|---|---| | Hetzner Online GmbH | Hosting, database | Germany (Falkenstein) | Application, account and log data | | Cloudflare, Inc. | CDN, DDoS protection, DNS | EU edge (parent company USA) | IP address, request metadata | | Stripe Payments Europe, Ltd. | Payment processing (host subscription) | Ireland (EU) | Payment status, billing data (no full card numbers) | | SMTP email provider (EU-hosted) | System email (password reset, RSVP confirmation mails) | EU | Email address, name, delivery status |

We have DPAs (GDPR Art. 28) or Standard Contractual Clauses (SCC) with Hetzner, our email provider and Stripe.

Third-country transfers

Some sub-processors (notably Cloudflare, US parent company) may transfer data to the USA. Such transfers are safeguarded by Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework. Stripe operates via an EU entity; any third-country transfers by our sub-processors are contractually regulated.

Your Rights

Per Art. 15–22 GDPR. Requests to hello@kumiko.rocks.

Right to Complain

You may complain to your local supervisory authority or to the supervisory authority responsible for us: Saxon Data Protection and Transparency Commissioner (SDTB), Maternistraße 17, 01067 Dresden, Germany, post@sdtb.sachsen.de, https://www.datenschutz.sachsen.de/.