Privacy policy

1. Controller

Behr Bros. GmbH

Steinbergstr. 22, 73061 Ebersbach/Fils, Deutschland

contact@zeroaislop.com

2. Delivery and security logs

When you access the site, technically necessary connection data such as IP address, time, requested URL, browser information, and status code is processed. This supports secure and stable delivery under Art. 6(1)(f) GDPR. Logs are retained only as long as required for operation, troubleshooting, and abuse prevention.

3. Accounts and community

For registration and sign-in we process email address, display name, authentication data, and technical session data. Display name, library, wishlist, ratings, reviews, and comments are processed to provide the requested features. The legal basis is Art. 6(1)(b) GDPR; security and moderation measures additionally rely on Art. 6(1)(f) GDPR.

Community contributions publicly display the chosen display name, content, rating, and publication time. Email address and private profile data are not published.

4. Creator data

For creator applications and publishing we process studio, company, contact, billing, and content data for review, contract preparation, publication, and abuse prevention. Legal bases are Art. 6(1)(b) and (f) GDPR and, where required, Art. 6(1)(c) GDPR.

5. Service providers and transfers

Confirmation, security and password-reset messages, report receipts and moderation decisions are sent through goneo's mail server. This processes the recipient address, message content and the confirmation links or codes needed for the requested account operation.

We use Supabase for authentication, database, and file storage and Vercel for hosting and delivery. Data may be processed in third countries. The published processing agreements of Vercel and Supabase provide EU Standard Contractual Clauses for applicable international transfers. Regional hosting does not fully exclude worldwide support access or additional subprocessors. Contact us for information and a copy of safeguards applicable to your data. When external media or games are opened, connection data may be transmitted to their providers. YouTube trailers are loaded only after you explicitly play them on the game page; before that your browser does not connect to Google.

6. Cookies and local storage

Password sign-in, registration and password-reset requests use self-hosted ALTCHA to prevent abuse. Your browser solves a computational challenge, which our servers verify. No external CAPTCHA provider is contacted. A necessary security cookie binds the challenge to your browser for up to five minutes. Rate limits use identifiers derived from IP and email addresses with a secret key. Used challenges are blocked by their hashes until expiry and cleaned up during subsequent checks.

Recently played is off by default. Only after you voluntarily enable it in your library do we store up to twelve game identifiers and launch times in the zais_recent_games cookie on this device. The zais_recent_games_consent cookie records your account ID and consent time. Both last at most 30 days. The legal bases are section 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw consent in your library at any time, deleting both cookies. Declining does not affect playing. History is not synced across devices and is included in this device’s export.

Game launches do not send your account ID to the game host. A short-lived access proof contains the game and build IDs, issue and expiry times, and a generic guest value. It only enables technical access (Art. 6(1)(b) GDPR). Games may save requested progress, audio and display settings locally (section 25(2)(2) TDDDG); you can erase these using your browser’s site-data settings. The platform stores your selected light/dark setting for up to a year. Necessary login cookies remain until sign-out, manual deletion or expiry and may be renewed during continued use.

ZeroAISlop uses technically necessary session information so sign-in, security, and explicitly requested account features work. It is used without consent under section 25(2) TDDDG. Advertising trackers and cross-device analytics profiles are not currently used. If such technologies are added later, they will be activated only after consent.

7. Reports, moderation and adulthood confirmation

For reports we process the location, reasons, voluntarily supplied evidence and, except for the child-protection reports specified in the form, name and email. We also record a reference, timestamps, decision and any review request. The bases are Art. 6(1)(c) GDPR with DSA obligations, and Art. 6(1)(f) GDPR for abuse prevention and rule enforcement. Reporter contact details are not automatically disclosed to the reported user. Moderators and the email provider receive data needed for their tasks.

We retain your confirmation that you are at least 18, its time and the accepted terms version until account deletion (Art. 6(1)(b) and (f) GDPR: providing and documenting the service). We do not request a birth date or ID copy. This confirmation is not technical age verification. Game quality checks may use AI; legally significant moderation decisions are made by the operator. We do not use exclusively automated decisions with legal or similarly significant effects under Art. 22 GDPR.

8. Retention

Account data is stored until the account is deleted. Community content is stored until deletion, moderation, or account termination unless retention or evidence obligations require otherwise. Account deletion also removes associated uploads and reports linked by account ID or email. A documented, time-limited hold required by law or for specific legal claims may prevent deletion of individual reports. Tax-relevant records follow the applicable statutory periods; we currently collect no payment data for game purchases.

9. Your rights

You have rights including access, rectification, erasure, restriction, data portability, and objection. Consent can be withdrawn at any time for the future. Your account provides data export and deletion options. You may also lodge a complaint with a data protection authority.

Right to object: Where processing is based on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to direct marketing without giving reasons.

To exercise privacy rights, contact us using the details above; no account is required. The technical export does not replace your full right of access. Our regional supervisory authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg. You may also contact another competent supervisory authority. LfDI Baden-Württemberg