The data this site collects.

SlotShop is an independent slot game development studio. We build games for licensed operators and publishers. We do not operate a casino, we do not take wagers, and we hold no player accounts or player funds.

For the purposes of data protection law, SlotShop is the controller of the personal data described in this policy. We handle personal data in line with the EU General Data Protection Regulation (GDPR) and the UK GDPR, whichever applies to you.

The fastest way to reach us about anything in this policy, including a request to see or delete your data, is the contact form on this site or the studio Discord server. Both are answered by the studio directly.

We collect only what a business enquiry needs. There is no tracking pixel, no advertising tag, and no analytics product on this site.

When you send a project enquiry through the contact form, we receive:

• Your name and email address.
• The brief you write, and the budget figure and currency you select.
• The partnership types you tick, and which channel you prefer to be contacted on.
• Your Discord handle and Telegram handle, where you provide them.
• A one-way cryptographic hash of your IP address, and your browser user-agent string. The hash is used to rate-limit submissions and block spam. We do not store the IP address itself, and the hash cannot be reversed back into one.

When you apply through the careers form, we receive your name, email address, the crafts you selected, your portfolio link, your message, and your Discord or Telegram handle.

If you hold a client portal account, we hold your name, email address, a hashed version of your password, your Discord handle, and your role. We also hold the project records, task comments and files that belong to your projects, because those are the reason the portal exists.

We do not ask for, want, or knowingly store special category data: nothing about health, ethnicity, religion, politics, biometrics or sexuality. Please do not put any of it in a brief.

Project enquiries and careers applications are handled on the basis of our legitimate interest in responding to people who deliberately contacted us about work. You chose to send it. We use it to reply, quote, and follow up on that conversation, and for nothing else.

Client portal data is handled to perform our contract with you: it is how a project gets delivered and reviewed.

The IP hash and user-agent string are held on the basis of our legitimate interest in keeping the forms usable and free of automated abuse.

We never sell personal data, never rent it, never trade it, and never use it to build advertising or profiling audiences.

This site sets two cookies. Neither is used for advertising and neither is shared with anyone.

• slotshop_age_ok — records that you confirmed you are over 18, so the age notice stops appearing. It stores a single value and expires after one year.
• A session cookie, set only if you sign in to the client portal, which keeps you signed in. It is removed when you sign out.

Both are strictly necessary for the function they serve, so the site does not carry a consent banner. Web fonts are served from this domain rather than from a font provider, so loading a page makes no request to a third party on your behalf.

We keep the list of processors as short as it can be. Each one handles data only to provide its service to us, under a data processing agreement.

• Vercel: hosting and content delivery for this site.
• Neon: the managed database that stores project enquiries and portal records.
• Vercel Blob: storage for files uploaded to a project in the portal.
• Discord: receives a notification when an enquiry or application arrives, so the studio sees it quickly. That notification contains the details you submitted and goes to a private studio channel, not to any public server.

Some of these providers operate infrastructure outside the European Economic Area. Where personal data is transferred outside the EEA, it is covered by the European Commission standard contractual clauses or an equivalent safeguard.

We may also disclose data where we are legally required to, for example in response to a valid order from a court or a regulator.

Project enquiries are kept while the conversation is live and for up to 24 months afterwards, because a buyer who did not proceed this year frequently returns the next. Ask us to delete one sooner and we will.

Rate-limit records are swept regularly and hold nothing but a hash and a timestamp.

Careers applications are kept for up to 12 months, in case a matching craft opens up.

Client portal accounts and their project records are kept for as long as the account is open, and afterwards only where we need to for tax, accounting or contractual reasons.

Traffic to this site is encrypted in transit. Portal passwords are stored as salted hashes and are never recoverable, by us or by anyone else. Submitter IP addresses are hashed before they are written down, so the raw address is never stored. Access to the database and to the studio notification channels is limited to the people who need it to do the work.

No system is beyond reach. If a breach ever affects your personal data and creates a real risk to you, we will tell you and the relevant supervisory authority without undue delay.

You can ask us to do any of the following, free of charge, and we will respond within one month:

• Tell you what personal data we hold about you, and give you a copy of it.
• Correct anything that is wrong or out of date.
• Delete it. Where we are able to, we will, and we will tell you plainly if a legal obligation stops us.
• Restrict or object to how we use it.
• Send it to you, or to someone else, in a portable machine-readable format.

We do not make automated decisions about you and we do not profile you.

If you think we have handled your data badly, tell us first: it is usually a faster fix. You also have the right to complain to your national data protection authority, and you can do that instead of or as well as contacting us.

This is a business-to-business site aimed at licensed operators, publishers and people who work in the industry. It is not aimed at players, and it is not aimed at anyone under 18. We do not knowingly collect data from minors, and if we learn that we have, we delete it.

When we change how we handle personal data, we update this page and move the date at the top. If a change materially affects people whose data we already hold, we will contact them rather than rely on them re-reading the page.