Skip to main content

Privacy policy

How Multi 2 Diamonds handles your personal data. Last updated 2026-08-17.

This is a courtesy translation. The binding version of this document is the Polish one, which is written against Polish law rather than translated into it. W razie rozbieżności wiąże wersja polska — where the two differ, the Polish version prevails.

Who is responsible for your data

The controller of your personal data — within the meaning of art. 4 pkt 7 RODO (GDPR) — is Multi2Diamonds Bartłomiej Słupik, Borowego 37A/18, 30215 Kraków, Poland. For anything to do with personal data, including the requests below, write to support@multi2diamonds.com.

We have not appointed a data protection officer — art. 37 RODO does not require one in our case — so the same address handles data-protection correspondence.

What we process, why, and on what basis

We collect what the service needs to work, and little else. There is no advertising, no analytics, no tracking, and nothing is sold or shared for marketing.

  • Your account — email address, username, and your password held only as an Argon2id hash, which cannot be reversed back into your password. Also your hand-valuation preference. Purpose: creating and running your account. Basis: art. 6 ust. 1 lit. b RODO — performance of the contract, which is the terms of service.
  • Sign-in sessions — a session identifier matched to the cookie in your browser, with its expiry (art. 6 ust. 1 lit. b RODO).
  • Federation player ids you choose to add, so we can find your own tournament results. These are self-declared, we never verify them, and we never treat them as proof of who you are (art. 6 ust. 1 lit. b RODO).
  • What you create — deals, collections, comments, chat messages at a table, friendships and the things you share (art. 6 ust. 1 lit. b RODO).
  • Guest identities — if you join a table by invitation without an account, a display name and a secret for that seat (art. 6 ust. 1 lit. b RODO).
  • Security signals — your IP address is read from the request to rate-limit sign-in and password-reset attempts, and is passed to Cloudflare Turnstile to tell you apart from a bot. We do not store it in our database. Basis: art. 6 ust. 1 lit. f RODO — our legitimate interest in keeping the service available and un-abused.
  • Server logs and traces — kept to operate and debug the service (art. 6 ust. 1 lit. f RODO).

We do not process special categories of personal data (art. 9 RODO), and no decision about you is made by automated means, including profiling (art. 22 RODO).

Whether providing data is obligatory

Giving us an email address, a username and a password is voluntary but necessary to create an account — without them we cannot conclude the contract. Everything else, including federation player ids and the content of your deals and comments, is entirely voluntary and can be withdrawn without affecting the account. Reading content marked public requires no data at all.

Tournament results about people who never signed up

Multi 2 Diamonds imports published tournament results. Those results carry the names and scores of everyone at the event, including people who have no account here. The data comes from publicly available sources — the results sites of tournament organisers and bridge federations — and covers names, scores and, where the organiser published them, player numbers and club affiliation.

The basis is art. 6 ust. 1 lit. f RODO: our legitimate interest in showing a deal in the competitive context it was played in. Names are rendered exactly as the tournament published them and are not merged into profiles.

If that is you and you would rather we did not, you have the right to object (art. 21 ust. 1 RODO). Write to support@multi2diamonds.com and we will remove your data from our copy.

Who else sees it

We use three providers. Each is a processor acting only on our documented instructions and under a data processing agreement (art. 28 RODO):

  • Google Cloud — hosting and the database, in the EU region europe-west1 (Belgium). Your data is stored in the European Union.
  • Resend — sends your verification and password-reset email, and so receives your email address. Resend is established in the United States.
  • Cloudflare — the Turnstile check on the registration and password-reset forms, which receives your IP address and browser signals. Cloudflare is established in the United States.

Sending data to Resend and Cloudflare is a transfer outside the European Economic Area. It rests on Standard Contractual Clauses (art. 46 ust. 2 lit. c RODO) and on both providers' certification under the EU–US Data Privacy Framework, covered by the European Commission's adequacy decision (art. 45 RODO). You can obtain a copy of those safeguards by writing to support@multi2diamonds.com.

Beyond that, other people see only what you choose to show them: a deal or collection you mark public is readable by anyone with its link, and anything you share with a friend is visible to that friend.

How long we keep it

  • Your account and what you created — until you ask us to delete it.
  • Sign-in sessions — 30 days from sign-in, and immediately when you sign out.
  • Email verification and password reset links — they expire within hours of being issued and can only be used once.
  • Logs and traces — for as long as we need them to operate the service.

Your rights

So far as we process your data, you have the right to:

  1. access your data and receive a copy of it (art. 15 RODO);
  2. have inaccurate data corrected (art. 16 RODO);
  3. have data erased (art. 17 RODO);
  4. restrict processing (art. 18 RODO);
  5. receive the data you gave us in a commonly used format and have it ported (art. 20 RODO);
  6. object to processing based on art. 6 ust. 1 lit. f RODO (art. 21 RODO).

We do not rely on consent today. If we ever ask for it, you will be able to withdraw it at any time, without affecting the lawfulness of processing before the withdrawal.

Send requests to support@multi2diamonds.com. We answer without undue delay and no later than one month from receiving the request (art. 12 ust. 3 RODO). We handle these by hand, so please say clearly what you want; we may ask you to confirm you are writing from the account in question.

If you think we are processing your data unlawfully, you have the right to lodge a complaint with the supervisory authority (art. 77 RODO), which is the Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa — https://uodo.gov.pl.

Cookies

We use two cookies: the one that keeps you signed in, and one that remembers which language you are reading. There is no tracking and no advertising cookie, which is why you are not being asked to accept anything. The detail is in the cookie notice.

Age

Accounts are intended for people aged 16 or over — Poland did not lower the age in art. 8 ust. 1 RODO. If you believe a younger child has registered, tell us and we will remove the account.

Changes

If we change how we handle your data we will update this page, and where the change matters we will tell account holders by email before it takes effect.