Privacy Policy

1. Data controller

The data controller is Rovto (French sole proprietorship, based in Grenoble), publisher of the platform.

Contact: support@rovto.app.

2. Data collected

• Google authentication (via Supabase Auth): email address, name and profile picture.
• Data created in the app: organisations, tournaments, teams, casters, scenes, assets, playlists and related settings.
• Audit log: for security and administration, create, update and delete actions on key entities are logged with the author's email and a timestamp.
• Technical data: session cookies required for authentication and navigation preferences (organisation, language).

3. Purposes and legal bases

• Provide and manage access to the service - legal basis: performance of the contract.
• Secure the platform and trace actions (audit log) - legal basis: legitimate interest in the security of the service.
• Remember your preferences - legal basis: legitimate interest / proper functioning.

4. Recipients and processors

Your data is neither sold nor shared with third parties for commercial purposes. It is processed by our technical sub-processors, strictly to run the service:

• Google - authentication (sign-in via Google account).
• Supabase - database, authentication and file storage.
• Render - hosting of the site and API.

5. Transfers outside the European Union

Some sub-processors (Google, Supabase, Render) are located in the United States. The corresponding transfers are governed by the appropriate safeguards provided by the GDPR: European Commission standard contractual clauses and/or adherence to the EU-US Data Privacy Framework.

6. Retention period

Your account data is kept as long as your account is active, then deleted within 30 days of account closure. Audit log entries are kept for 12 months for security purposes.

7. Your rights

In accordance with the GDPR (EU Regulation 2016/679), you have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to withdraw your consent at any time.

To exercise them, contact support@rovto.app. You may also lodge a complaint with the French authority, the CNIL.

8. Cookies

The site only uses technical cookies required for authentication (Supabase session) and to remember your preferences (selected organisation, language). No advertising or tracking cookie is used; no cookie consent is therefore required.

9. Security

Rovto implements reasonable technical and organisational measures to protect your data (delegated authentication, restricted access, logging of sensitive actions).

10. Changes

This policy may change. The date of the last update is shown below.