BiteRocket
Privacy notice
The short version
To play you choose a nickname. We store that nickname, your scores and a random ID kept in your browser so the leaderboard knows which scores are yours.
We do not ask for your real name, email, phone number or location. There are no accounts, no advertising and no tracking cookies.
You can delete everything yourself at any time with the Delete my data button at the bottom of any games page.
1. Who is responsible for your data
BiteRocket is operated by [LEGAL NAME OF OWNER OR COMPANY], [BUSINESS ADDRESS], [VAT / REGISTRATION NUMBER, IF ANY] ("BiteRocket", "we"). We are the data controller for the personal data described in this notice under Regulation (EU) 2016/679 (the "GDPR").
Contact for any privacy question or request: pietrosartoribusiness@gmail.com. We have not appointed a Data Protection Officer because we are not required to under Article 37 GDPR.
The restaurant whose QR code you scanned offers and hands over the prizes. It can see the nicknames, table numbers and scores on its own leaderboard and the nickname, table number, score and claim code of prize winners. It receives nothing else about you from us.
2. What we collect, why, and on what legal basis
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Nickname you type in | To show you on the restaurant's leaderboard, to show the people at your own table what you are playing and your best scores in each game, and to name the winner of a prize round | Art. 6(1)(b): needed to provide the game you asked to play under our Terms |
| Random device ID created in your browser (not linked to your phone number, advertising ID or identity) | To link your scores together, show your position, show a prize code only to the winner, limit one prize per phone per round and let you delete your data | Art. 6(1)(b) |
| Scores and game sessions: game, score, date and time, restaurant, and the table number printed in the QR code you scanned (if any) | Leaderboards, prize rounds, fair play checks | Art. 6(1)(b); for fair play checks Art. 6(1)(f): our legitimate interest in preventing cheating |
| Prize records: winning nickname, score, prize, 4 digit claim code, time | So the restaurant can hand the prize to the right person; to handle complaints about a prize | Art. 6(1)(b); Art. 6(1)(f): our legitimate interest in keeping evidence of how prizes were awarded |
| Technical data: IP address, browser type, time of request | Processed automatically by our hosting providers to deliver the site and keep it secure. We do not use it to identify or profile you | Art. 6(1)(f): our legitimate interest in a secure, working service |
We do not collect special categories of data, we do not use your data for marketing, and we do not make automated decisions that have legal or similarly significant effects on you. Picking the highest score as the winner is a simple, transparent rule described in the Terms.
Giving a nickname is voluntary, but you cannot appear on a leaderboard or win a prize without one. Please do not use your full real name or anyone else's name as a nickname.
3. Restaurant contacts
If you manage a restaurant that uses BiteRocket, we process your business contact details (name, restaurant name, email if you write to us, your Telegram chat ID and the messages you send to our Telegram bot, your logo) to set up and run the service for you (Art. 6(1)(b)) and to keep business and tax records (Art. 6(1)(c)).
4. Who receives the data
| Recipient | Role | Location |
|---|---|---|
| Supabase, Inc. (database and server functions) | Processor | Data stored in the EU ([REGION, e.g. Ireland]). Supabase is a US company; see section 5 |
| [HOSTING PROVIDER, e.g. Netlify, Inc.] (website hosting) | Processor; processes technical data only | Global network; see section 5 |
| Telegram (messaging with the restaurant) | Used to send the restaurant the winner's nickname, score and claim code. No other player data is sent | See section 5 |
| The restaurant you are playing at | Independent controller for handing over its prizes | Where the restaurant is |
We do not sell your data and we do not share it with advertisers. We may disclose data if the law requires it.
5. Transfers outside the EEA
Our database is hosted in the European Union. Some providers above are based outside the European Economic Area or may access data from outside it. Where that happens the transfer is covered by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified companies) or by the Standard Contractual Clauses approved by the Commission. You can ask us for a copy of the safeguards at pietrosartoribusiness@gmail.com.
6. How long we keep it
| Data | Kept for |
|---|---|
| Nickname and scores on a leaderboard | Until you delete them, the restaurant removes them or the restaurant stops using BiteRocket; in any case no longer than 24 months from the score |
| Game sessions that were started but not finished | 2 days |
| Prize records | 12 months |
| Provider security logs | As set by each provider, normally no more than 90 days |
| Data in your own browser (see Cookies) | Until you clear it or press Delete my data |
7. Your rights
Under the GDPR you have the right to access your data, have it corrected, have it erased, restrict or object to its processing, and receive it in a portable format. Where we rely on legitimate interests you can object at any time on grounds relating to your situation.
Fastest way: the Delete my data button on any games page erases your nickname, your scores and your device ID immediately, and removes your nickname from past prize records.
For anything else write to pietrosartoribusiness@gmail.com. Because we do not know who you are, we may ask you to send the request from the same phone and tell us your nickname and restaurant so we can find your data (Art. 11 GDPR). We answer within one month.
You also have the right to complain to a supervisory authority, in particular where you live or where the issue happened. In Malta: the Office of the Information and Data Protection Commissioner (idpc.org.mt). In Italy: the Garante per la protezione dei dati personali (garanteprivacy.it).
8. Children
BiteRocket is meant for guests aged 16 and over. Younger guests may play only with the permission and supervision of a parent or guardian, who should choose a nickname that does not identify the child. We do not knowingly collect any data that identifies a child. A parent or guardian can have a nickname removed at any time with the delete button, by asking the restaurant, or by writing to us.
9. Security
Connections are encrypted (HTTPS). The database is not publicly accessible: every read and write goes through our server function, which only returns nicknames and scores. Device IDs are never shown to other players or to restaurants.
10. Changes
If we change this notice we will update the date at the top. If a change is significant we will show a notice on the games page before it applies.