Privacy Policy

1. Introduction

We take your privacy seriously. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have under the General Data Protection Regulation (GDPR) and Danish data protection law (Databeskyttelsesloven).

If you have questions, contact us at: [email protected]

2. Data We Collect

2.1 Account & Identity Data

• Steam ID / Steam profile URL — collected when you log in via Steam OpenID or paste a public inventory link
• Username and profile picture — imported from your Steam profile where available
• Email address — collected during registration or subscription sign-up, used to deliver alerts and service communications

2.2 Inventory & Tracking Data

• CS2 inventory contents — retrieved via a third-party API provider based on your Steam ID

2.3 Payment Data

• Billing information — processed exclusively by Stripe, Inc. on our behalf. We do not store card numbers, CVV codes, or full payment credentials. We retain Stripe customer IDs and subscription status only.

2.4 Usage & Technical Data

• IP address, browser type, device information, and pages visited, collected for security, fraud prevention, and service improvement

2.5 Communications Data

• Email delivery and engagement data (opens, clicks) processed via Amazon Web Services Simple Email Service (AWS SES)

3. Legal Basis for Processing

We process your data under the following legal bases as defined in GDPR Article 6:

4. How We Use Your Data

• To create and manage your account
• To read your CS2 inventory and detect price movements on items you own or track
• To send real-time (Pro) or delayed (Standard) email alerts
• To process subscription payments and manage billing via Stripe
• To send transactional emails (receipts, password resets) via AWS SES
• To improve and maintain the service
• To comply with applicable laws

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling with legal or similarly significant effects.

5. Third-Party Processors

We share data with the following processors, each bound by a Data Processing Agreement (DPA):

All transfers of personal data outside the EEA are protected by appropriate safeguards in accordance with GDPR Chapter V.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account or request erasure:

• Account and inventory data is deleted within 30 days
• Payment records are retained for 5 years to comply with Danish bookkeeping law (Bogføringsloven)
• Backup copies may persist for up to 90 days before being purged

7. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of access (Art. 15) — request a copy of all data we hold on you
• Right to rectification (Art. 16) — request correction of inaccurate data
• Right to erasure(Art. 17) — request deletion of your data ("right to be forgotten")
• Right to restriction (Art. 18) — request we limit processing of your data
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing

To exercise any right, email us at [email protected]. We will respond within 30 days.

8. Cookies

We use strictly necessary cookies to maintain your session and authentication state. We do not use third-party advertising cookies. If we introduce analytics cookies in the future, we will request your consent first via a cookie banner.

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), access controls, and regular security reviews. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Danish Data Protection Authority (Datatilsynet) within 72 hours and you directly where required.

10. Supervisory Authority

You have the right to lodge a complaint with the Danish supervisory authority:

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notice at least 14 days before taking effect. Continued use of the service after the effective date constitutes acceptance.