Privacy policy
Last updated: 19 October 2026
This policy explains which personal data HQLM processes, why, and what your rights are, under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Italian data-protection law. We collect only the data needed to run the service and to let you buy games and AI Credits. We do not sell, rent or give your data to anyone for their own purposes, we send no marketing, and we do not profile you.
1. Who is responsible for your data
The data controller is Bizonweb srl, VAT no. IT02232630984, Brescia, Italy. You can contact us about your personal data by email at contact@hqlm.games.
2. What we process and why
Your account
To create an account you give us your email address, first and last name and country. We also keep when you signed up, confirmed your email, last signed in and confirmed you had read this policy. There is no password: each time you sign in we email you a 6-digit code, which we store only in hashed form and which expires after 10 minutes. The country sets the VAT applied to the AI Credits packs you buy. You can see and change your name and country on your profile page.
Legal basis: performance of the contract you enter into by creating the account (Art. 6(1)(b) GDPR).
We email you only the sign-in codes: no newsletters or promotional messages.
Purchases and AI Credits
When you buy a game or an AI Credits pack we record what you bought, the amount paid, the country used for VAT, its status and the transaction and customer references given by our payment provider, so that we can unlock what you bought. We also keep the postal code you gave in the checkout, so that the next one opens with your country and postal code already filled in; it is deleted when you change country. For the answers paid with your AI Credits we record, for each answer, the game, the model used, the number of tokens and the cost: this is how your balance is kept. We do not record the text of your questions for this.
Payments are handled by Paddle (Paddle.com Market Ltd), which acts as reseller and Merchant of Record: it collects your payment and billing details, issues the receipt and handles taxes, as an independent controller under its own privacy policy. We never receive your card or other payment details. To show prices with the taxes of your country and to open the checkout, pages that sell something load Paddle's script from Paddle's servers.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c) GDPR).
Your questions to the assistant
The questions you write or dictate, and, when you use the VASSAL check, the state of your game board, are processed only to produce the answer. Voice questions are turned into text on our servers and the audio is not kept. The conversation is kept in your browser: our servers do not store it.
To answer, the question is sent, together with excerpts from the game's rules, to the AI model in use. Local models run on our own servers. Remote models (from Anthropic, Google, OpenAI or DeepSeek, depending on the model chosen in Settings) receive the text of the question to generate the answer, as service providers. Some of these providers are established outside the European Economic Area; where this is the case, the transfer relies on the safeguards of Chapter V GDPR, such as adequacy decisions or standard contractual clauses. Please do not include personal information in your questions: the assistant does not need it.
If you add your own API key for a model provider, we store it encrypted and use it only to send your questions to that provider on your behalf; nobody at HQLM can read it back. Your use of that provider is governed by its own terms.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Wishlist
If you ask for a game that is not available yet, we record your request linked to your account, to know which games to prepare next. You can remove it at any time from the game page. Legal basis: Art. 6(1)(b) GDPR.
Security and operation of the service
Our servers receive your IP address with every request. We use it to limit abuse (for example too many sign-in attempts), keeping it in a counter that expires within minutes, and our servers keep technical logs for troubleshooting. A "like" is counted once per visitor through a one-way hash of the IP address and browser, which cannot be turned back into either. Legal basis: our legitimate interest in keeping the service secure and working (Art. 6(1)(f) GDPR).
Fonts and all the other files of the site are served by our own servers. We use no analytics, advertising or social-media trackers. See the cookies policy for what is stored in your browser.
3. Who receives your data
Your data is accessed only by the authorized staff of Bizonweb srl and, for the part each needs, by these providers:
- the providers of the infrastructure that hosts HQLM and delivers its emails, acting as data processors on our instructions;
- Paddle, for purchases, as described above;
- the provider of the remote AI model in use, only for the questions and the rules excerpts needed to answer them.
No data is sold, rented or disclosed to third parties for their own purposes. We disclose data to public authorities only when the law requires it.
4. How long we keep it
- Account data: for as long as your account exists. You can delete your account yourself from your profile (Delete account): your details, your API keys and models and your wishlist are deleted at once. If you ask us instead, we delete it within 30 days.
- Purchases and AI Credits records: for as long as your account exists. When it is deleted they are kept without your name and email, and only where tax and accounting law requires it (in Italy, up to 10 years); the AI Credits left and the games bought are lost.
- Sign-in codes: 10 minutes. Abuse-limiting counters: a few minutes. Technical logs: for a short period, then deleted.
5. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format (Articles 15–21 GDPR). To exercise them, contact us by email at contact@hqlm.games; you can also delete your account yourself from your profile. You also have the right to lodge a complaint with a supervisory authority: in Italy, the Garante per la protezione dei dati personali.
Giving your data is voluntary, but without the account data we cannot create an account for you, and without it you cannot buy games or AI Credits.
6. Security
HQLM is served over an encrypted connection; sign-in codes are stored hashed and personal API keys encrypted, and access to the data is limited to the staff who need it.
7. Changes
If this policy changes, we publish the new version on this page with its date.