Alpha Factory ("we", "us", or "our") operates the website www.thealphafactory.io. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform. We are committed to complying with the General Data Protection Regulation (GDPR) and applicable Dutch privacy laws.
Alpha Factory is registered in the Netherlands (KVK: 87420309).
1. Data We Collect
We collect the following categories of personal data:
Account Data (via Discord OAuth)
- Discord username and discriminator
- Discord user ID
- Discord avatar
- Email address associated with your Discord account
Payment Data (via Stripe)
- Billing information (name, email, payment method) is processed and stored by Stripe. We do not store your full credit card number or payment details on our servers.
- We receive from Stripe: subscription status, plan type, payment dates, and a truncated card identifier for reference.
Usage Data (via Google Analytics)
- Pages visited, session duration, and interaction patterns
- Device type, browser, operating system, and screen resolution
- Approximate geographic location (country/region level)
- Referral source (how you found our site)
Technical Data
- IP address (logged temporarily by our hosting provider)
- Browser type and version
- Session tokens for authentication
2. How We Use Your Data
- Authentication: To log you in via Discord OAuth and manage your account.
- Service delivery: To provide access to premium educational content and tools based on your subscription status.
- Payment processing: To manage subscriptions, process payments, and handle refunds via Stripe.
- Analytics: To understand how our platform is used and improve the user experience.
- Communication: To send service-related emails (account updates, subscription changes).
- Legal compliance: To comply with legal obligations and resolve disputes.
3. Legal Basis for Processing
- Contract performance: Processing your account and payment data is necessary to provide the service you signed up for.
- Legitimate interest: Analytics and platform improvement are based on our legitimate interest in providing a better service.
- Consent: Where required (e.g., optional cookies), we obtain your consent.
- Legal obligation: We process certain data to comply with tax and financial regulations.
4. Data Storage and Security
Your data is stored in Supabase, which hosts our database in the European Union (EU). All data is encrypted in transit (TLS) and at rest. We use industry-standard security measures to protect your information, including row-level security policies and encrypted authentication tokens.
5. Third-Party Services
We share data with the following third-party services, each with their own privacy policies:
6. Cookies
We use the following cookies:
- Essential cookies: Authentication session cookies that keep you logged in. These are strictly necessary for the platform to function and cannot be disabled.
- Analytics cookies: Google Analytics cookies (_ga, _ga_*) that help us understand site usage. These are loaded only in production and collect anonymized usage data.
You can control cookies through your browser settings. Disabling essential cookies may prevent you from using parts of the platform.
7. Data Retention
- Account data: Retained for as long as your account is active, plus 30 days after deletion to allow recovery.
- Payment records: Retained for 7 years as required by Dutch tax law.
- Analytics data: Google Analytics retains data for 14 months by default.
- Server logs: Retained for up to 30 days.
8. Your Rights Under GDPR
As a data subject in the European Economic Area, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete data.
- Right to erasure: Request deletion of your personal data ("right to be forgotten").
- Right to data portability: Request your data in a machine-readable format.
- Right to restrict processing: Request that we limit how we use your data.
- Right to object: Object to processing based on legitimate interests, including analytics.
- Right to withdraw consent: Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, contact us at the email address below. We will respond within 30 days as required by GDPR.
9. International Data Transfers
Our primary database is hosted in the EU (Supabase). Some third-party services (Google Analytics, Vercel edge network) may process data outside the EU. Where this occurs, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions to ensure appropriate safeguards for your data.
10. Children's Privacy
Alpha Factory is not intended for users under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly. If you believe a child under 16 has provided us with personal data, please contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make significant changes, we will notify registered users via email. The "Last updated" date at the top of this page indicates when the policy was last revised.
12. Contact
For privacy-related questions, data requests, or to exercise your GDPR rights, please contact us:
If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at www.autoriteitpersoonsgegevens.nl.