Privacy policy

1. Who is responsible for your data

The data controller is Bocary Studios, CVR 44650797, EU VAT DK44650797, c/o Marco Frøkjær Wejse, Skelagervej 130C, 8200 Aarhus N, Denmark. You can reach us at info@bocarystudios.net or +45 22 25 80 03. We have not appointed a Data Protection Officer, because our processing does not meet the thresholds in GDPR Article 37 — privacy questions go to the address above and are answered by us directly.

2. What we collect, and why

2.1 Game pitch submissions

When you submit a pitch we store the studio name, your name, your email address, the country you gave, team size, the game title, genre, target platforms, development stage, your description of the game, the links you provided, your funding band, the support you asked for, and the readiness score the form calculated. Legal basis: Article 6(1)(b), steps taken at your request before entering into a contract. Retention: 24 months from submission, after which the record is deleted automatically by a scheduled database job.

We do not ask you to consent to this, and the form has no agreement box to tick. Reading and answering your pitch is the entire purpose of the submission, so Article 6(1)(b) already covers it; presenting a mandatory consent request on top would make consent look like a condition of something you asked us to do, and consent that cannot be refused is not valid consent. The form instead shows a short notice, at the point of submission, saying exactly what this section says.

2.2 Contact messages

Your name, email address, the company you named, the subject and the message body. Legal basis: Article 6(1)(f), our legitimate interest in answering enquiries addressed to us. Retention: 12 months.

As with the pitch form, there is no consent box: we rely on legitimate interest, and you can object to that processing at any time under Article 21 by writing to info@bocarystudios.net. We balanced our interest in replying against your rights and concluded that answering a message you chose to send us is what you expect; if you disagree, tell us and we will stop and delete it.

2.3 Abuse protection

Both forms store a salted SHA-256 hash of the sending IP address and a truncated user-agent string, and the API keeps a short-lived per-IP request counter on disk. We never store the address itself, and a hash cannot be reversed to recover it. It exists only to investigate spam and abuse. Legal basis: Article 6(1)(f), securing our own service. Retention: counters expire within 24 hours; the hash is deleted with its parent record.

2.4 Server logs

Our web server records request paths, status codes and timestamps for operational and security purposes. Application logs deliberately never contain form content. Logs are rotated and deleted within 30 days.

3. What we do not do

• No analytics, advertising, retargeting or profiling cookies. None.
• No third-party trackers, pixels, embedded players, chat widgets or social plugins.
• No fonts, scripts, stylesheets or images loaded from external hosts — everything is self-hosted.
• No automated decision-making or profiling within the meaning of GDPR Article 22.
• We never sell, rent or trade personal data. Ever.

4. Confidentiality of your pitch

A game pitch is commercially sensitive, and we treat it that way. Inside Bocary Studios, submissions are read only by the people who evaluate them and are not used to brief our own projects. We disclose them to nobody for their own purposes — not to other studios, not to other publishers, not to platform holders, and never in exchange for money.

To be precise rather than reassuring: the submission is stored by the hosting provider named in section 5, which processes it solely on our instructions under a data processing agreement and may not use it for anything of its own. That is a processor relationship, not a disclosure, and it is the only way anyone outside this company comes near your pitch.

We do not require an NDA in order to read a submission — no publisher receiving unsolicited pitches can honestly promise that — but we will sign a mutual NDA before a deep evaluation begins. If you would rather not send confidential material without one, write to publishing@bocarystudios.net first.

5. Who else processes your data, and where

We keep the chain as short as we can, and this is all of it. Two companies process personal data on our instructions, and both are named:

• Namecheap, Inc. — provides the virtual private server that runs this website, the API and the MySQL database in which pitch submissions and contact messages are stored. Acting as our processor under a data processing agreement (GDPR Article 28). The server is located in the United States.
• Namecheap Private Email — operates the mailboxes at our own domain (info@bocarystudios.net and publishing@bocarystudios.net), so it carries the replies we send you and any message you send us directly. Its mail servers are also in the United States.

Nobody else. There is no analytics provider, no CDN, no advertising network, no backup or monitoring service, no customer-support platform and no external anti-spam service. The rate-limiting counters described in section 2.3 are plain files on the same server. The forms currently send no automated email at all — submissions are written to the database and answered by a person from the mailboxes above.

Both are processors, not recipients: they hold the data to provide the service we buy from them, may act only on our documented instructions, and may not use it for their own purposes. Where this site says a submission is not shared or disclosed, that means exactly this — no third party gets your data for its own purposes. It does not mean no company but ours ever touches the bytes, because that would not be true of any hosted website.

5.1 Transfer outside the EU/EEA

Because the server is in the United States, storing your submission involves a transfer of personal data to a third country under Chapter V of the GDPR. We are telling you plainly rather than burying it: the data you type into a form on this site is stored on a machine in the United States, operated for us by Namecheap, Inc.

Is there an adequacy decision? No — we do not rely on one. The European Commission has adopted an adequacy decision for the EU–US Data Privacy Framework, but it covers only organisations that are certified under that framework, and we do not rely on our provider being certified. We therefore treat the United States as a third country without adequacy for this purpose, which is the more conservative position.

The safeguard we rely on is Article 46(2)(c): the Standard Contractual Clauses, Module Two (controller to processor), as adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. They are incorporated into our provider’s Data Processing Addendum, which is published in full at namecheap.com/legal/universal/data-processing-addendum — the Clauses are its Appendix 1. If you would rather we sent you a copy, or the relevant extract, write to info@bocarystudios.net and we will email it to you.

Alongside the contractual safeguard, the technical measures in section 8 apply: the database is not reachable from the internet, every database account is restricted to local connections, and the site is served only over HTTPS.

If we move the servers into the EU/EEA, or change provider, this section is updated before the change takes effect — not afterwards.

6. Your rights

Under the GDPR you may ask us to:

• confirm what we hold about you and give you a copy (Art. 15);
• correct anything inaccurate (Art. 16);
• delete it (Art. 17);
• restrict how we use it (Art. 18);
• send it to you or another controller in a portable format (Art. 20);
• stop processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting what was lawful beforehand (Art. 7(3)).

Write to info@bocarystudios.net. We answer within one month. There is no charge unless a request is manifestly excessive, and we will say so before doing anything.

7. Complaints

If you think we have handled your data badly, please tell us first — most problems are a misunderstanding we can fix the same week. You also have the right to complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk, or to the supervisory authority in your own EU country of residence.

8. Security

The site is served over HTTPS only, with HSTS. Form submissions are validated server-side and written with prepared statements, so a submission cannot alter a query. The database listens on the server’s loopback interface only — it is not reachable from the internet — and every database account is restricted to local connections. A host firewall allows inbound traffic on the web and administration ports only. Rate limiting and honeypot fields protect both forms. Application logs never contain form content. No payment data is processed on this site at all.

9. Children

This is a business-to-business site aimed at game developers and press. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, contact us and we will delete it.

10. Changes

If this policy changes materially we update the date at the top and, where the change affects data we already hold, we tell the people concerned directly.

See also the cookie policy and the terms of service.