Privacy Policy Version: 1.0 — Beta Effective date: 15 May 2026 1. Introduction Cloud Domains srls (“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect information about you when you use the RD100 Hub (the “Service”). This policy complies with the EU General Data Protection Regulation (GDPR) and the UK General Data Protection Regulation (UK GDPR). We act as the data controller for the personal data described in this policy. 2. Data We Collect 2.1 Account information When you authenticate using OAuth (Discord or Kanka or other supported provider), we receive and store the following information provided by those services: • Your display name or username • Your email address • An identifier from the OAuth provider We do not receive or store your password for any third-party service. Authentication is handled entirely by the OAuth provider. 2.2 Third-party platform data If you connect the Service to third-party platforms such as Kanka, we access data from those platforms on your behalf, limited to what you have authorised. Examples include campaign names, character data, and entity entries. This data is fetched at the time of your request and used to generate AI responses. We do not permanently store full copies of third-party platform data. 2.3 Uploaded documents You may upload documents (e.g. rulebooks, campaign notes) to the Service. These are stored on our infrastructure for the purpose of providing the Service. See the Terms of Service for important distinctions between Ruleset documents (shared) and Game/Campaign documents (private). 3. Legal Basis for Processing (GDPR) We process your personal data on the following legal bases: • Contract (Article 6(1)(b)): Account information is necessary to provide the Service you have requested. • Legitimate interests (Article 6(1)(f)): Pseudonymised usage data is processed to improve the Service. • Consent (Article 6(1)(a)): Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. 4. How We Use Your Data We use the data we collect to: • Create and manage your account. • Provide the AI-assisted features of the Service. • Integrate with third-party platforms you have connected. • Improve and optimise the Service using usage statistics. • Comply with applicable legal obligations. We do not sell your personal data to third parties. We do not use your personal data for advertising purposes. 5. Data Sharing We share your data only in the following limited circumstances: • Anthropic (Claude API): Content you submit to AI features is processed by Anthropic’s API. Anthropic processes this data as a sub-processor under applicable data protection agreements. Please refer to Anthropic’s privacy policy for details. • Supabase: We use Supabase as our database and backend infrastructure provider. Your account information and uploaded documents are stored on Supabase infrastructure. • OAuth providers: Authentication is handled by Discord and/or Kanka and/or Supabase. We receive only the data described in Section 2.1. • Legal requirements: We may disclose data if required to do so by law or in response to valid legal process. 6. Data Retention We retain your account information and uploaded documents for as long as your account is active. If you delete your account: • Your account information (name, email, OAuth identifier) are permanently deleted. • Your uploaded documents are permanently deleted. • All references linking usage data to your account and game are permanently removed. The resulting data is fully anonymous and cannot be traced back to you by any means. At that point it falls outside the scope of GDPR data subject rights and is retained in aggregate form solely for service optimisation purposes. 7. Your Rights Under GDPR and UK GDPR, you have the following rights regarding your personal data: • Right of access: You may request a copy of the personal data we hold about you. • Right to rectification: You may request correction of inaccurate or incomplete data. • Right to erasure: You may request deletion of your personal data (“right to be forgotten”). Account deletion via the settings panel will erase your personal data as described in Section 6. • Right to restriction: You may request that we restrict processing of your data in certain circumstances. • Right to data portability: You may request your data in a structured, machine-readable format. • Right to object: You may object to processing based on legitimate interests. • Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time. To exercise any of these rights, please contact us at paolo.guccione@cloud-domains.eu. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (e.g. the CNIL, the ICO, or your local equivalent). 8. International Transfers Some of our service providers (including Anthropic and Supabase) may process data outside the European Economic Area (EEA) or the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or equivalent mechanisms, in accordance with GDPR requirements. 9. Security We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include access controls, encrypted data storage, and use of OAuth for authentication (meaning we never handle your third-party passwords). No system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law. 10. Cookies The Service does not set any cookies on your device. Authentication session data is managed using browser storage mechanisms that do not involve cookies set by our domain. Third-party services (such as Discord or Kanka) may set their own cookies during the OAuth authentication flow; these are governed by those services’ own privacy and cookie policies. 11. Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date at the top of this document. Where required by law, we will seek your consent before making material changes to how we process your personal data. 12. Contact and Data Controller The data controller for your personal data is: Cloud Domains srls Via Domenico Di Marco 15, 90144 PALERMO - ITALY paolo.guccione@cloud-domains.eu For any privacy-related questions or to exercise your rights, please contact us at the address above.