Draft: some details are still placeholders in [brackets]. Have this page reviewed by a lawyer before public launch.
Data processing (DPA)
Last updated October 9, 2026
Hatchnight is a consumer game, so Media Yard LLC is the controller of player data: we decide what's collected and why. The providers that process data for us are processors, bound by data processing agreements (DPAs) that meet Article 28 of the GDPR and UK GDPR.
Our processors' DPAs
| Provider | Agreement | Transfer safeguard |
|---|---|---|
| Cloudflare, Inc. | Cloudflare Customer DPA | Data Privacy Framework; Standard Contractual Clauses |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Stripe DPA | Data Privacy Framework; Standard Contractual Clauses |
| [Email provider, e.g. Google Workspace or Cloudflare Email Routing] | [Provider's DPA link] | [Safeguard] |
Stripe acts as a processor for payment processing and as an independent controller for some purposes, such as fraud prevention and meeting its own legal duties.
What every processor agreement includes
- Processing only on our documented instructions, for the purposes we set.
- Confidentiality for everyone with access.
- Appropriate technical and organizational security measures.
- Using sub-processors only with authorization and the same obligations passed down.
- Helping us respond to your rights requests and meet security, breach notification and impact assessment duties.
- Deleting or returning data at the end of the service.
- Making information available and allowing audits to show compliance.
Our own security measures
- Encryption in transit (HTTPS/TLS) everywhere; data encrypted at rest by our host.
- Signed session tokens; the game server checks every action and rolls all randomness itself.
- Minimal data: no names, no free-text chat, no card details, and emails stored only as one-way hashes in the game database.
- Access to production limited to the people who run the game. [Confirm two-factor authentication is on for the Cloudflare and Stripe accounts.]
- An append-only ledger of coin changes, so mistakes and abuse can be traced and fixed.
Need a DPA with us?
If you're a business working with Hatchnight (for example a partner running an event) and we'll process personal data on your behalf, we'll sign a DPA with you. Email legal@hatchnight.com.