Privacy Policy

Updated 27 August 2026

What is the GDPR

The General Data Protection Regulation has applied since May 2018 to any organisation processing personal data of people located in the European Union.

Your privacy and the security of your data are major concerns for QuantumCraft Studios. This page describes what data we process, why, for how long, and which rights you can exercise.

The data controller is QuantumCraft Studios SAS, 58 rue de Monceau CS 48756, 75380 Paris CEDEX, France.

Data controller

QuantumCraft Studios SAS - 58 rue de Monceau CS 48756, 75380 Paris CEDEX, France. Data protection contacts: Jessy DAVID and Philippe GAULIN, reachable at the address below.

[email protected]

Your data

You can ask us for details about your data at any time by email: [email protected]

Data you provide to us

First and last name
Postal address
Email address
Phone number
VAT number, for business customers
The content of your support tickets and their attachments

This information is accessible to QuantumCraft Studios staff only. It is never sold or shared with any marketing company. It may be disclosed to judicial authorities where they order us to do so.

Your information allows our agents to authenticate you during a phone call, email, or chat exchange.

We keep a record of invoices so we know which product belonged to you and when, along with the history of your support tickets.

We also record technical logs (IP address, action performed, timestamp) in order to secure the platform and detect payment fraud.

Audience measurement

We measure our site's audience with Umami, a solution we host ourselves on our own servers in France. This measurement sets no cookies, does not record your IP address, and allows no tracking across sites. The resulting statistics are aggregated and cannot identify you. No data is sent to any third party. Our client and administration areas are excluded from this measurement.

Legal bases and retention periods

Each processing activity rests on a specific legal basis and is subject to a defined retention period:

Account management Performance of the contract. Kept for the duration of the contractual relationship, then 3 years after your last order.
Orders and invoicing Performance of the contract and legal accounting obligation. Kept for 10 years, as required by French commercial law.
Customer support Performance of the contract. Kept 2 years after the ticket is closed; attachments are deleted 30 days after closure.
Security and fraud detection Legitimate interest in protecting the platform and preventing payment fraud. Logs kept 12 months, then deleted automatically.
Audience measurement Legitimate interest in understanding site traffic. Aggregated statistics kept for a maximum of 13 months, in line with the French data protection authority's recommendation.
Information emails Your consent, collected through a box unticked by default. Kept until withdrawn, which you can do at any time from your profile.

Automated decisions

To combat payment fraud, every order is subject to an automated analysis taking into account technical signals as well as the risk assessment provided by our payment processor. An order flagged as risky is placed on hold and reviewed by a human before any final decision. You may contest this analysis, obtain human intervention, and express your point of view by writing to us.

Our processors and recipients

We rely on a limited number of providers, all bound by contract:

Stripe Payment processing. Stripe Inc. is established in the United States: this transfer outside the European Union is governed by the European Commission's Standard Contractual Clauses. Privacy Policy
Umami Audience measurement hosted on our own servers. No data leaves our infrastructure, so this is not a third-party processor.
Hosting and email Our database, file storage, and email servers are located within the European Union.
Sign-in via Discord, GitHub, or Google Only if you choose this sign-in method. We then receive your identifier, email address, and avatar; the chosen provider learns that you are signing in to our service. You can avoid this by creating an account with an email address and password. As GitHub and Google are established in the United States, this transfer is governed by the European Commission's standard contractual clauses.

No sale or transfer of your data

We do not sell, rent, or trade your personal data. None of your data is shared with any advertising network, data broker, or profiling service whatsoever.

We use neither Google Analytics, nor Google Ads, nor any advertising tracker. The site's fonts are hosted on our own servers: unlike many websites that load them from Google's servers, your IP address is never sent to Google when you simply browse our pages.

The only third-party recipients of your data are the providers listed above, strictly necessary for the service to operate, along with the judicial authority should it so order.

Security of your data

Your passwords are hashed and never stored in plain text. Two-factor authentication is available on your account. Exchanges with the site are encrypted over HTTPS, and access to data is restricted and logged.

Your rights

You have the following rights over your personal data:

Right of access - Obtain a copy of all the data we hold about you. Downloadable directly from your client area.
Right to portability - Retrieve your data in a structured, machine-readable format in order to pass it to another provider.
Right of rectification - Correct your personal information at any time from your profile.
Right to erasure - Request deletion of your account. Your data is then anonymised; only invoices are retained, as accounting law requires.
Right to restriction - Request that a processing activity be temporarily frozen while a dispute is examined.
Right to object - Object to processing based on our legitimate interest, on grounds relating to your particular situation.
Rights regarding automated decisions - Request human intervention on any automated decision concerning you, and contest it.
Withdrawal of consent - Withdraw your consent to information emails at any time, as easily as you gave it.

How to exercise them

Access, portability, rectification, and erasure can be exercised directly from your client area. For the other rights, write to us. We reply within one month at most. We may need to verify your identity before acting on your request. [email protected]

Complaints

If you believe the processing of your data does not comply with the regulation, you have the right to lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07, France. cnil.fr