Privacy and your data
The card game your facilitator is running, and everything it does with your data. Written to be read in two minutes.
1 What we collect from participants
- Your first name, or any name you choose to type. It is shown to the people in your group and to the facilitator. It is held in the server's memory only, never written to a database, and deleted when the facilitator ends the game or 12 hours after it was created, whichever comes first.
- Your votes. During the game your group sees them next to your name. When your group finishes, the game keeps a record of the votes on each card under a random number, without your name. That record lets the facilitator and AIM see which cases groups find hardest. Once your name has been deleted, nothing in it leads back to you.
- A copy of the game in progress, so that a restart of the server does not end your game: the cards, the phase, the timers and the votes, again under random numbers and without any name. After a restart your phone tells the game your name again from its saved seat. The copy is deleted 12 hours after the game was created.
The game does not ask for your email, does not use your location, camera or microphone, and does not store your IP address. Your phone needs the IP address to receive the page, as with any website, but the game does not keep it or write it to its logs.
2 On your phone
The game sets no cookies. It keeps two small notes in your browser's own storage:
- Your seat in the game (the game code, your first name, your group and the random number), so that if you close the tab or your phone locks you go straight back to your seat. It is removed after 12 hours, the next time you open the game.
- Whether you have already seen "How a round works", so it does not open twice.
Your phone makes no request to any other company while you play: the pages, the fonts, the illustrations and the QR codes all come from the game's own server.
3 Facilitators
Facilitators sign in with an account created by AIM. For them we hold their work email, their password (stored only in scrambled form, never readable), and when they last signed in. Password reset emails are sent through Brevo, an email service based in France. A facilitator's account is kept until AIM removes it.
4 Where your data is
| What | Provider | Where |
|---|---|---|
| The game server (names in memory, the live game) | OVH, a French company | Frankfurt, Germany |
| The anonymous vote records, the copy of games in progress, and facilitator accounts | Supabase, a US company, in its EU region | Frankfurt, Germany |
| Facilitator password reset emails | Brevo, a French company | EU |
Participants receive no email and no message from the game.
5 Who is responsible
The organisation running your session (your employer, your agency, or the body that invited you) decides to use the game and why. Under data protection law it is the controller. AIM Learning Solutions provides and runs the game for them, which makes us the processor. We do not sell or share anything collected during a session.
Where the session is run by an institution, body, office or agency of the European Union, its obligations arise under Regulation (EU) 2018/1725 and its supervisory authority is the European Data Protection Supervisor. Our own obligations, as a Belgian company, arise under the GDPR.
6 Your rights, and who to ask
You may ask to see, correct or delete your data, or object to its use. Because your name only lives for the length of the game, the quickest way is to tell the facilitator during the session. Otherwise contact the organisation that invited you, or write to us and we will act on their instruction.
Data protection contact: dpo@aim-associes.com
AIM & Associés SRL, enterprise number 0864.046.009, Avenue de Tervueren 36A, 1040 Brussels, Belgium
You can also complain to a supervisory authority: the European Data Protection Supervisor where the organiser is an EU body, otherwise your national authority. In Belgium that is the Autorité de protection des données / Gegevensbeschermingsautoriteit.
GF-PS-01 · Version 1.1 · 5 November 2026