Privacy policy
Last updated: 09/04/2026
The Playground is published by The Spark SASU (SIRET 93482575300015), with registered offices at 10 rue de la Paix, 75002 Paris, France. We are committed to protecting the privacy of our users in accordance with the General Data Protection Regulation (GDPR). This policy describes the data we collect, the purposes of processing, your rights and how to exercise them.
Data controller
The data controller is The Spark SASU, represented by Dragos Dreptate.
For any questions regarding the protection of your personal data, you can contact us:
- By email: privacy@the-playground.fr
- By mail: The Spark SASU, 10 rue de la Paix, 75002 Paris, France
The Spark SASU has not appointed a Data Protection Officer (DPO) in accordance with Article 37 of the GDPR (fewer than 250 employees, no large-scale processing). The contact above fulfills this function.
Data collected
Identity and account data
- Email address (sign-in via magic link or OAuth)
- First and last name (provided during profile setup)
- Profile picture (imported from Google/GitHub or uploaded manually)
- Public profile identifier
Authentication data
- OAuth account identifier (Google, GitHub) — for authentication only
- Session tokens (session cookies)
Service usage data
- Communities created or joined
- Events created, registrations, attendance
- Comments posted
- Notification preferences
Payment data (paid events only)
- Payment details (card number, expiration date, CVV) are processed exclusively by Stripe and are never stored by The Playground
- We only retain the Stripe transaction reference and receipt URL
Browsing and analytics data
- Pages visited, visit duration, navigation events
- Technical identifier (pseudonymized for non-authenticated visitors, linked to account for signed-in users)
- Technical data: browser type, operating system
Data collected automatically in case of errors
- Technical error traces (stack traces) for bug diagnosis and resolution
Purposes and legal basis
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Authentication and account management | Email, name, OAuth identifier, profile picture | Performance of contract (Art. 6.1.b) |
| Service delivery (Communities, Events, registrations) | Account data, usage data | Performance of contract (Art. 6.1.b) |
| Sending transactional emails (confirmations, reminders, cancellations) | Email, first name | Performance of contract (Art. 6.1.b) |
| Sending community notifications (new Events, Host messages) | Email, first name, notification preferences | Legitimate interest (Art. 6.1.f) — you can unsubscribe at any time from your profile |
| Processing payments for paid Events | Stripe transaction reference | Performance of contract (Art. 6.1.b) |
| Usage analysis and service improvement | Pseudonymized browsing data | Legitimate interest (Art. 6.1.f) — continuous service improvement, data hosted in EU |
| Bug diagnosis and resolution | Technical error traces | Legitimate interest (Art. 6.1.f) — ensuring service stability |
Cookies
Strictly necessary cookies (set without consent)
| Cookie | Purpose | Data retention |
|---|---|---|
authjs.session-token | Maintaining your authentication session | 30 days |
auth-callback-url | Post-login redirect | 30 minutes |
These cookies are essential for the website to function. They cannot be disabled.
Analytics cookies
| Cookie | Purpose | Sub-processor | Data retention |
|---|---|---|---|
ph_* | Service usage analysis (pages visited, user journeys) | PostHog (EU servers) | 1 year |
These cookies help us understand how the service is used in order to improve it. Collected data is hosted in the European Union. You can disable these cookies through your browser settings.
No advertising cookies are used by The Playground.
Sub-processors and data recipients
The following sub-processors are involved in operating the platform. Depending on their role, they may receive personal data, technical data, or content you have entered:
| Sub-processor | Purpose | Data transmitted | Headquarters | Data hosting | Safeguards |
|---|---|---|---|---|---|
| Vercel Inc. | Application hosting | IP address, session cookies, HTTP requests (transit) | United States | European Union (Frankfurt) | Vercel DPA, data hosted in EU |
| Neon Inc. | Database hosting | All account data: email, name, profile picture, registrations, comments | United States | European Union (Frankfurt) | Neon DPA, data hosted in EU |
| PostHog Inc. | Service usage analytics | User identifier, email, name, pages visited | United States | European Union (eu.posthog.com) | PostHog DPA, data hosted in EU |
| Sentry | Technical error monitoring | Technical error traces (no personal data explicitly transmitted) | United States | European Union (Germany, de.sentry.io) | Sentry DPA, data hosted in EU |
| Resend Inc. | Transactional and notification emails | Recipient email address, name (in some emails) | United States | United States | Resend DPA, EU standard contractual clauses |
| Stripe Inc. | Payment processing (paid Events) | Email address, user identifier | United States | United States / European Union (global infrastructure) | PCI-DSS certified, Stripe DPA, EU standard contractual clauses |
| Anthropic PBC | AI features (description generation) | User-entered content (event titles and descriptions) — no personal data | United States | United States | Anthropic DPA, EU standard contractual clauses |
| Slack (Salesforce) | Internal administration notifications (new users, new communities) | User name and email (admin notifications only) | United States | United States | Slack/Salesforce DPA, EU standard contractual clauses |
Your data is never sold or shared with third parties for commercial or advertising purposes.
Transfers outside the European Union
Most of our sub-processors host your data in the European Union, even when their headquarters are in the United States:
- Data hosted in EU: Vercel (Frankfurt), Neon (Frankfurt), PostHog (EU), Sentry (Germany)
- Data hosted in United States: Resend (email delivery), Stripe (payment processing), Anthropic (AI features), Slack (internal notifications)
Transfers to the United States are governed by:
- Standard contractual clauses adopted by the European Commission (implementing decision 2021/914)
- Contractual commitments from each sub-processor (Data Processing Agreements)
Core data (user database, application hosting, analytics, monitoring) is stored in the European Union.
Your rights (GDPR)
Under the GDPR, you have the following rights:
- Right of access (Art. 15): obtain confirmation of data processing and receive a copy
- Right to rectification (Art. 16): correct inaccurate or incomplete data
- Right to erasure (Art. 17): request deletion of your data. You can delete your account directly from your profile (immediate and irreversible deletion)
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format
- Right to object (Art. 21): object to processing based on legitimate interest
- Right to withdraw consent (Art. 7.3): where processing is based on your consent, withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal
To exercise your rights:
- By email: privacy@the-playground.fr
- By mail: The Spark SASU, 10 rue de la Paix, 75002 Paris, France
We commit to responding to your request within one month of receipt (Art. 12.3 GDPR).
If you believe that the processing of your data constitutes a violation of the GDPR, you have the right to lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.
Data retention
- Account data (email, name, profile) — as long as the account is active
- Usage data (registrations, comments) — as long as the account is active
- Payment data (Stripe references) — 5 years after the transaction (legal accounting obligation)
- Analytics cookies (PostHog) — 1 year maximum
- Error traces (Sentry) — 90 days
When you delete your account, your personal data is erased immediately (irreversible deletion). Data related to legal obligations (payment references) is retained in accordance with applicable legal requirements.
Changes to this policy
We may update this policy to reflect changes in our practices or regulations. In the event of a substantial change, we will notify you by email or by notification on the platform. The date of the last update is indicated at the top of this page.