Privacy Policy

Publisher: GLUCEED SAS — 8 Allée des Fleurs, 13100 Aix-en-Provence, France
Covered applications: TrickyMatch, OverLud, ScoryBoard, CoSeason
Last updated: 29 July 2026

This policy describes how GLUCEED collects, uses and protects personal data of users of its applications. It reflects the privacy and data-management provisions of our Terms of Use.

1. Data controller

The data controller is GLUCEED SAS (SIRET 882802630 00013, RCS 882802630), located at 8 Allée des Fleurs, 13100 Aix-en-Provence, France.

Contact: contact@gluceed.fr (or the contact address shown in the relevant application).

2. Confidential data and sensitivity levels

Within the application we distinguish different confidentiality levels for data.

2.1 Level 1 data

Critical data that we do not store in clear text in the database and that is never displayed in the application. Application administrators do not have access to it.

• User password

2.2 Level 2 data

Non-public personal data. It is not displayed in the application outside your personal area. Application administrators can access it.

• User email address

2.3 Level 3 data

Data considered public. It is displayed in the application, often with partitioning: not all users can see all of this data. It may still be visible to certain users (application administrators, members of a partner organisation, users of the same Arena, etc.). Some of this data may be visible to an unauthenticated person, for example when sharing results or Arena invitations on social networks.

• Other personal data (name, first name, gender, …), results, user publications, …

3. Purposes of processing

Personal data is collected for the following purposes:

• Provide, operate and improve the user experience of TrickyMatch, OverLud, ScoryBoard and CoSeason.
• Manage user accounts, secure access and account recovery.
• Offer personalised services and recommendations based on application usage.
• Process payments through third-party services.
• Prevent fraud, ensure user security and comply with legal obligations.

4. Sharing with third-party services (subprocessors)

We use subprocessors to operate the services. They act only on our behalf, within the purposes described above, and are bound by contractual security and confidentiality obligations.

• Stripe: payment processing (Stripe Privacy Policy).
• Google Firebase / Firebase Cloud Messaging (FCM): push notifications and technical management of device tokens (Firebase Privacy).
• Hostinger: hosting and technical infrastructure.

Depending on the provider, a transfer of data outside the European Union may occur. In that case, appropriate safeguards are implemented under the GDPR (standard contractual clauses or equivalent mechanisms).

5. User rights

Under applicable law (including the GDPR), users have rights of access, rectification, deletion and objection regarding their personal data. These rights can be exercised in particular:

• from the personal area in the application (edit information, deactivate or delete the account);
• by contacting the Arena owner to request a result correction;
• via the application contact form for any other request.

If your data-protection rights are not handled by the application, you may lodge a complaint with the French supervisory authority (CNIL).

6. Retention periods

• Account data: retained until the user deletes the account (or upon request via the contact form / personal area).
• Technical and security logs: retained for 12 months, then deleted or anonymised.
• Billing / payment data: retained for the statutory period required for accounting and tax obligations.

After account deletion, some data may be kept for a limited time if required by law, or in anonymised form. The application does not guarantee lossless long-term retention of data.

7. Age of users

The applications do not set a specific minimum age. They are intended for general use. When a minor uses the service, parental authority consent is recommended where required by law.

8. Cookies

• When visiting the application, a cookie may be automatically placed on the browser.
• Cookies are required for the application to function.
• They do not contain personally identifying information; they use a randomly generated anonymous identifier.
• Some cookies expire at the end of the visit; others remain.
• Cookies used are strictly necessary for the service and are not used for advertising or commercial tracking.
• Users can manage cookie preferences in their browser settings; without acceptance, some features may be unavailable.

9. User publications

The application allows users to publish content (photos, results, comments, ads, contests). Users are solely responsible for their publications and must comply with applicable law and not harm third-party interests. Arena and Organisation administrators act as moderators and must remove unlawful content. Content may be modified or removed by the application without prior notice.

10. Information provided in the application

Information published in the application is provided for general guidance. Despite regular updates, the application and GLUCEED do not guarantee that it is free of errors or omissions and cannot be held liable for how that information is used or interpreted.

11. Contact

For questions about this privacy policy or your personal data: contact@gluceed.fr.

The full Terms of Use are available at: /current_terms/.