1. Controller (Art. 4 (7) GDPR)

Cosmic Drift Game Studio
Marc Frost
Slevogtstr. 10
04159 Leipzig
Germany
Privacy contact: hello@kumiko.rocks

2. Data Collected + Purpose

2.1 When visiting the site

• IP address (truncated before storage: IPv4 to /24, IPv6 to /64)
• User-Agent
• Request time

Legal basis: Art. 6(1)(f) — legitimate interest (security, performance monitoring). Retention: server logs are deleted after 31 days.

2.2 When submitting an RSVP (guest, anonymous)

• Name (required)
• Email address (optional, confirmation mail only)
• Attendance status (yes/no/maybe) + number of extra guests
• Free-text note (optional)

Legal basis: Art. 6(1)(f) — the host's legitimate interest in organizing their event, on whose behalf we act as processor. Retention: while the event or host account is active; afterwards per the host's deletion policy.

2.3 Account creation (host account)

• Email address
• Display name
• Hashed password
• Events, invite pages and guest lists you create

Legal basis: Art. 6(1)(b) — contract performance. Retention: while your account is active; after deletion, personal data is removed within 30 days unless statutory retention applies. After deletion, copies in backups remain for up to 30 days, and in the delete-locked backup copy for up to about two months longer.

3. Roles on guest events

Show Pony lets individuals and teams ("hosts") publish their own event invite pages and collect guest RSVPs.

• If you are a host: You are the controller for the event content you publish and for your guests' RSVP data. We process this data as a processor under GDPR Art. 28 as part of your use of the service.
• If you only RSVP on an invite page as a guest: That host is the controller. We provide the platform and send a confirmation email on the host's behalf if you provided an email address.

4. Cookies

We use:

• one strictly necessary auth-session cookie (Art. 6(1)(f))
• no tracking cookies — no marketing cookie banner required

Sub-processors

We use the following sub-processors per GDPR Art. 28:

| Provider | Purpose | Location | Data processed | |---|---|---|---| | Hetzner Online GmbH | Hosting, database, DNS | Germany (Nuremberg) | Application, account and log data | | Scaleway SAS | Offsite backup mirror (object storage) | France (EU) | Encrypted backup copies | | Stripe Payments Europe, Ltd. | Payment processing (host subscription) | Ireland (EU) | Payment status, billing data (no full card numbers) | | SMTP email provider (EU-hosted) | System email (password reset, RSVP confirmation mails) | EU | Email address, name, delivery status |

We have DPAs (GDPR Art. 28) or Standard Contractual Clauses (SCC) with Hetzner, Scaleway, our email provider and Stripe.

Third-country transfers

Stripe operates via an EU entity; any third-country transfers by our sub-processors are contractually regulated.

Your Rights

Per Art. 15–22 GDPR. Requests to hello@kumiko.rocks.

Right to Complain

You may complain to your local supervisory authority or to the supervisory authority responsible for us: Saxon Data Protection and Transparency Commissioner (SDTB), Maternistraße 17, 01067 Dresden, Germany, post@sdtb.sachsen.de, https://www.datenschutz.sachsen.de/.