Privacy notice

1. Who is responsible

The controller is DevFIRE WEB SRL, Corvinilor 64, Ap. 1, 440080 Satu Mare, Satu Mare County, Romania.

Contact for privacy questions: privacy@beaconstep.app.

When a company uses BeaconStep for its own team event, that company decides who plays and what the quest contains. For the players’ data inside that quest, the company is the controller and BeaconStep processes the data on its behalf (data processing agreement, Art. 28 GDPR).

2. What we use, and why

Organizers (people who create quests)

• Email address — to sign you in with a one-time code (no password).
• Company name, default language, the time you accepted our terms.
• Purpose and legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Players (people who join a quest)

• A display name you choose (a nickname is fine), your team, and the time you confirmed you are 16 or older. We do not ask for your birth date, email or phone.
• An anonymous account id, so the app can remember your quest on this device.
• Coming in a later version: photos you take with the in-app camera for a quest step, and your location while a step is being checked. The app does not collect photos or location yet.
• Purpose and legal basis: running the quest you joined (Art. 6(1)(b) GDPR; for company events, the company’s legitimate interest, Art. 6(1)(f)).

Website (beaconstep.app)

• No cookies, no analytics, no tracking. Our host keeps short technical logs (IP address, time, page) for security, for at most 30 days.

Technical logs (app)

• When the app talks to our servers, our providers keep short technical logs (IP address, time, request) for security and error finding, for a limited time set by the provider.

Support email

• If you write to us, we keep your message and email address to answer you. Our mailbox is provided by Google Workspace.

3. Location

Your location is used only to check that your team is at the place of the current step. Raw location traces are deleted right after the check; only the result (“at the place: yes/no”, distance, time) is kept. Organizers never see your route or your live position trail.

4. Artificial intelligence

The current app does not use AI yet. When these features arrive, BeaconStep will use AI in two places, and we will update this notice first:

1. Quest drafts for organizers. An organizer can ask AI to draft a quest from a place, a group size and a theme. The organizer reviews and edits every step before players see it. No player data is used for this.
2. Photo checks. A photo you take for a step can be checked by an AI vision model (“does the photo show what the step asks for?”). The result is a suggestion: the organizer can change it, and you can ask for a human review. In schools, a teacher always confirms the result.

Planned AI provider: Google (Gemini via Vertex AI), in an EU region. We will send only the photo and the step text — never your email, device id or location trail. Under Google’s terms for Vertex AI, this data is not used to train its models. Before your first photo is checked, the app will ask for your permission.

5. Where your data is stored

All app data is processed in the European Union:

• Supabase (database, sign-in; later also photo storage) — Frankfurt, Germany.
• Vercel (our API) — Frankfurt, Germany.
• Later, with the AI features: Google Cloud Vertex AI — EU region.

Our support mailbox (Google Workspace) is not limited to the EU.

This website is a set of static pages delivered by Vercel’s global network, so a page may be served from a location near you. It stores nothing about you; Vercel keeps short technical logs as described in section 2.

These providers act as our processors under data processing agreements. We do not sell data and we do not share it for advertising.

6. How long we keep it

• Player names, photos and quest answers: 30 days after the quest ends by default, then deleted by a daily job (so within 31 days). Only anonymous statistics stay (for example “6 teams, 8 steps”). A company can set a different period for its quests; players can ask their organizer which period applies.
• A quest that is never ended ends by itself 7 days after it went live.
• Demo quest players: deleted after 1 day.
• Organizer accounts: until you delete your account or ask us to.
• Support emails: as long as needed to answer, then at most 2 years.
• Raw location traces: deleted right after each check.

7. Children

Company and consumer quests are for people aged 16 or older; players confirm this when they join. School quests for younger pupils will only be offered with parental consent and a teacher in charge.

8. Your rights

You can ask us to access, correct, delete or export your data, to restrict its use, or to object (Art. 15–21 GDPR). Write to privacy@beaconstep.app. Players can also ask their organizer. You can complain to a data protection authority — our lead authority is Romania’s ANSPDCP (dataprotection.ro); you can also contact the authority where you live or work, for example the CNPD in Luxembourg (cnpd.public.lu).

9. Security

Data is encrypted in transit (HTTPS). Every company’s data is kept apart from other companies’ data by database rules. Joining a quest is checked on our server, never trusted from the phone. When photo checks arrive, photos will only come from the in-app camera and every check will run on our server.

10. Changes

If we change this notice, we update the date above and tell organizers by email.