Privacy Policy

Jorocon AB (Swedish reg. no. 556239-2208, Södertälje, Sweden) is the data controller for the processing described in this policy, with one important exception: when an operator (e.g. a hotel or event agency) runs games and events through Jorocon Studio, the operator is the data controller for its players' and participants' data, and Jorocon AB acts as data processor.

Privacy questions: johan@jorocon.ai

Operator accounts (Studio): name, email address, organisation details, login credentials and the content you create on the platform.

Players and participants: team name (freely chosen — do not use personal names), game results and scores, quest and quiz answers, and photos a team chooses to submit as answers. Live quizzes and votes use anonymous participant tokens — no login required.

GPS location: in location-based adventures, the team's position is processed in real time in the browser to unlock quests. Positions are not continuously stored — only event logs noting that a quest was unlocked (method and GPS accuracy) are kept for game results and anti-cheat purposes.

Buyers: name, email, phone, company and shipping address when ordering game materials. Card details are handled by Stripe and never reach our servers.

Website visitors: we use no advertising or tracking cookies. Only strictly necessary cookies for login and session handling are used, plus browser local storage for game preferences (e.g. sound volume).

• Delivering the service (games, quizzes, accounts, support) — performance of contract.
• Payments and bookkeeping — performance of contract and legal obligation.
• AI assessment of submitted photos (see section 4) — performance of contract; photo submission is always voluntary for the team.
• Improving and troubleshooting the platform — legitimate interest.

Some quests let a team submit a photo as an answer. Depending on how the operator has configured the quest, the photo may be assessed automatically by an AI model (OpenAI) against the operator's criteria, reviewed by the game host, or both. Photos are stored in our EU-based storage (Supabase) and deleted when the operator removes the game or session. Do not submit photos of people who have not consented.

• Supabase — database, authentication and file storage (EU region: Stockholm, eu-north-1)
• Vercel — hosting and operations
• Stripe — payments
• Resend — transactional email (order confirmations)
• OpenAI — AI assessment of submitted photos
• fal.ai — AI generation of images, video and 3D models (operator prompts, no player data)
• ElevenLabs — text-to-speech for narrator voices (operator texts, no player data)
• Spotify — music playback in Music Live (the operator signs in with their own Spotify account)

Where data is transferred outside the EU/EEA (e.g. to US providers), transfers are safeguarded by the European Commission's Standard Contractual Clauses or equivalent measures.

• Operator accounts: for as long as the account is active, then deleted within 90 days.
• Game sessions, results and photos: until the operator deletes them or the account is closed.
• Anonymous participant tokens: tied to the session, with no link to identity.
• Order and accounting records: 7 years under the Swedish Bookkeeping Act.

Under the GDPR you have the right of access, rectification, erasure, restriction, data portability and objection. Contact johan@jorocon.ai and we will respond within one month. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

Playing a game run by an operator? Please contact the operator (your event organiser) first — we assist the operator in fulfilling your request.

All traffic is encrypted (TLS). Data is stored within the EU with row-level security (RLS) in the database. Access to production data is restricted and logged. Card data is handled solely by Stripe (PCI DSS certified).

If we make material changes to this policy we notify operators by email and update the date at the top of this page.