DajeZii Privacy Notice
Last updated: October 22, 2026
This notice explains which personal data we process when you play DajeZii in the iPhone and iPad app or on the web, why we process it, how long we keep it, and how you can control it. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Who is the data controller
The controller of the game's personal data is DDArch S.r.l., Viale Giorgio Ribotta 21, 00144 Rome, VAT number 13672341008, PEC (certified email) [email protected].
The app is distributed on the App Store by DDA Capital S.r.l., which is the seller named in the store. DDArch S.r.l. remains the controller of the game's personal data.
For any request about your data, write to [email protected]. This is our privacy and support address. Certified email remains available as a secondary formal channel. We have not appointed a data protection officer (DPO).
2. In brief
We need little data for you to play: a player name, an avatar, your games, and whatever you choose to share with your group (messages, photos, videos). There are no ads, we do not track you across apps and websites, and we do not use third-party analytics. We do not sell your data. We do not ask for your email, phone number, surname, or date of birth to create an account. There are no purchases in the iPhone app; purchases exist only on the web and are handled by Stripe. You can delete your account in the app at any time.
3. What data we process, why, and for how long
The table lists the data the system actually processes. If you do not use a feature, the associated data is not created.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Game profile: player name (up to 32 characters), avatar, character (stage name, motto, traits, portrait), technical identifier, group membership | Create your player and let other group members recognize you | Performance of the contract (providing the service you request) (GDPR Art. 6(1)(b)) | Until account deletion |
| Sign-in credential: in the app, a session code kept in the iPhone Keychain (accessible only when the device is unlocked and not transferable to other devices); on the web, a technical session cookie | Keep you signed in without asking you to sign in each time | Performance of the contract (Art. 6(1)(b)) | 30 days to 1 year, depending on how you signed in; ends earlier if you sign out or delete your account |
| Games, scores, experience (XP), trophies, and leaderboard position | Run the game and show results | Performance of the contract (Art. 6(1)(b)) | Until account deletion. Games played with others then remain in their history under the name "Deleted player" |
| Room chat messages, reactions, blocks of other players, and message reports (reason and copy of the reported text) | Let you communicate with others in the room and moderate content | Performance of the contract (Art. 6(1)(b)); community safety and protection (Art. 6(1)(f)) | Messages are no longer visible to anyone after 30 days and are then deleted from our systems. Blocks last until account deletion. Message reports disappear with the message |
| Photos and videos you upload to stages (photos up to 10 MB; videos up to 60 MB and 20 seconds), caption, any line for an animation, and the resulting animated clip | Show your contributions to the group and create the animation you request | Performance of the contract (Art. 6(1)(b)) | Until you remove the contribution or delete your account |
| Problem report: text (up to 1,000 characters), screenshot if attached (up to 4 MB), app page, screen size, device model or browser (user agent), time, player name | Understand and resolve the problem you report | Legitimate interest in helping players and keeping the service secure (Art. 6(1)(f)) | Until account deletion |
| Network fingerprint for registration: an irreversible code calculated from your connection (for IPv6 addresses, only the /64 network). We do not store your IP address in our database | Limit the number of registrations from one connection in an hour to prevent abuse | Legitimate interest in preventing abuse (Art. 6(1)(f)) | Cleared by automatic cleanup, usually within about one hour of registration |
| Push notifications (web only): browser notification address and keys, for up to 5 devices | Tell you when it is your turn or a message arrives | Your consent, given through the browser permission (Art. 6(1)(a)) | Until you turn them off, sign out, or delete your account |
| Shared ledger: ledger title, participant names, expenses, and amounts you enter; photos you take or select for the ledger stay on your device | Split expenses with friends | Performance of the contract (Art. 6(1)(b)) | Until account deletion. After deletion the ledger remains, without a link to your profile |
| Purchases (web only): purchased content, amount, payment status, any refund, technical payment identifiers supplied by Stripe, receipt link | Deliver what you purchased and document payment | Performance of the contract (Art. 6(1)(b)); tax and accounting obligations (Art. 6(1)(c)) | 10 years, including after account deletion (without your name or a link to your profile) |
| Technical request security data (for example, IP address, request type, outcome) processed by Cloudflare | Deliver the service and protect it against attacks and abuse | Legitimate interest in security (Art. 6(1)(f)) | We do not retain it: service logs are visible only in real time and are not saved. Cloudflare processes it for security for the period set by its own rules |
Further details: your player name can be made up; we do not ask for your real name. The iPhone app asks for camera access only for the shared ledger, when you decide to take a photo. Chats are not end-to-end encrypted: the service stores them to show them to other room members.
4. Who sees your data
Other players in your group see your player name, avatar, character, results, room messages, and contributions (photos and videos) you upload. Photos and videos can be opened only by people signed in to the same group; they are not public on the internet. The group administrator and authorized DDArch staff may view contributions and reports to moderate content and answer support requests. No one else has access except the providers in the following section.
Unlawful, offensive, or rule-breaking content may be removed by group moderators or DDArch.
5. Who we share it with
We do not sell data, share it for advertising, profile users, or make decisions based solely on automated processing.
We use these providers.
Cloudflare, Inc. provides hosting, database, file storage (photos, videos, portraits), and security services. It acts as a processor on our behalf (GDPR Art. 28).
Stripe handles payments on the web. Payment takes place on a page hosted by Stripe: card details do not pass through DajeZii. Stripe processes payment data under its own notice, available on its website.
Apple distributes the app through the App Store. Data Apple collects when you download the app is processed under Apple's own notice and is outside the scope of this one.
Animated clips are produced only on our own systems: no external provider receives your photos.
We may disclose data to authorities or professional advisers when required by law or to defend our rights.
6. Transfers outside the European Economic Area
DajeZii's database and file storage are hosted by Cloudflare in data centers in Europe. There is no contractual requirement to keep them in the European Union, however, so Cloudflare may also process some data outside the European Economic Area, subject to the safeguards described below.
Cloudflare and Stripe are companies with headquarters or infrastructure also in the United States. When data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework adequacy decision for participating providers, or on standard contractual clauses approved by the European Commission.
7. What happens when you delete your account
You can delete your account in the app and on the web: choose “Delete my account” in your Profile. Deletion is final and cannot be undone. We ask for explicit confirmation first. If you no longer have access to the app, write to [email protected]: we verify the request through your group administrator and, if confirmed, let you sign in again and delete the account yourself.
When you confirm, the system deletes your messages, blocks, reports you made, notification subscriptions, sign-in links, character with experience and trophies, invitations, game currency (chips) and in-game spending, your photos and videos (including files in storage), animated clips, screenshots attached to reports, and portrait. Your profile becomes “Deleted player”, leaves the leaderboard, and loses all active sessions. If a file cannot be deleted immediately, the system marks it, retries automatically, and we manually delete any remaining cases.
Two things remain. First, games you played with others remain in those players' history under the name “Deleted player”, because otherwise their results would no longer add up. Second, orders and payments remain for 10 years without your name or a link to your profile, to meet the controller's tax and accounting obligations (Article 2220 of the Italian Civil Code, Codice civile, and tax law). Stripe retains payment information in its own name for these records under its own obligations.
If you have unused animation credits, you lose them when deleting the account. We therefore tell you clearly before confirmation. You may request a refund for unused credits by writing to [email protected]: we refund them within 14 days of your request.
The database keeps a 30-day technical history used for recovery after a failure: deleted data also disappears from it within 30 days. We do not keep backup copies of photos and videos: deleting a file removes it from storage.
8. Your rights
At any time you may ask to access your data and obtain a copy, correct or delete it, restrict its processing, receive it in a readable format for another service (portability, for data you supplied), and object to processing based on our legitimate interest. If you gave consent, such as for notifications, you may withdraw it at any time; withdrawal does not change what was done before.
To exercise a right, write to [email protected]. Because we do not collect email at registration, we will ask for your player name, group, and group administrator's name to find your profile; we may contact the administrator to confirm the request is yours. We do not ask for identity documents. This prevents others from making requests in your name or accessing your data. We respond within one month, extendable by two months in complex cases, as provided by GDPR Article 12.
If you believe our processing violates the law, you may lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (the Italian Data Protection Authority, garanteprivacy.it). You do not have to contact us first.
9. Minors
DajeZii is intended for people aged 14 or older. If you are under 14, you must not create an account. If a parent or guardian discovers that a child under that age created an account, they may write to [email protected] and we will delete the data. In Italy, the age at which a person can consent independently to data processing in digital services is 14 (Article 2-quinquies of the Italian Personal Data Protection Code, Codice in materia di protezione dei dati personali).
10. Security
Communications among the app, browser, and server are encrypted. Sessions are signed and revocable, the iPhone session code is kept in Keychain, and files are in private storage and open only after signing in to the game. No measure is infallible: if you discover a vulnerability, write to [email protected].
11. Changes
If we make a significant change to this notice, we update the date above and provide a visible notice in the app.
This notice is published at https://dajezii.com/en/privacy/