Privacy policy

1. Who is responsible for your data

The data controller is Bocary Studios, CVR 44650797, EU VAT DK44650797, c/o Marco Frøkjær Wejse, Skelagervej 130C, 8200 Aarhus N, Denmark. You can reach us at info@bocarystudios.net or +45 87 12 34 56. We have not appointed a Data Protection Officer, because our processing does not meet the thresholds in GDPR Article 37 — privacy questions go to the address above and are answered by us directly.

2. What we collect, and why

2.1 Game pitch submissions

When you submit a pitch we store the studio name, your name, your email address, the country you gave, team size, the game title, genre, target platforms, development stage, your description of the game, the links you provided, your funding band, the support you asked for, and the readiness score the form calculated. Legal basis: Article 6(1)(b), steps taken at your request before entering into a contract. Retention: 24 months from submission, after which the record is deleted automatically by a scheduled database job.

2.2 Contact messages

Your name, email address, the company you named, the subject and the message body. Legal basis: Article 6(1)(f), our legitimate interest in answering enquiries addressed to us. Retention: 12 months.

2.3 Abuse protection

Both forms store a salted SHA-256 hash of the sending IP address and a truncated user-agent string, and the API keeps a short-lived per-IP request counter on disk. We never store the address itself, and a hash cannot be reversed to recover it. It exists only to investigate spam and abuse. Legal basis: Article 6(1)(f), securing our own service. Retention: counters expire within 24 hours; the hash is deleted with its parent record.

2.4 Server logs

Our web server records request paths, status codes and timestamps for operational and security purposes. Application logs deliberately never contain form content. Logs are rotated and deleted within 30 days.

3. What we do not do

• No analytics, advertising, retargeting or profiling cookies. None.
• No third-party trackers, pixels, embedded players, chat widgets or social plugins.
• No fonts, scripts, stylesheets or images loaded from external hosts — everything is self-hosted.
• No automated decision-making or profiling within the meaning of GDPR Article 22.
• We never sell, rent or trade personal data. Ever.

4. Confidentiality of your pitch

A game pitch is commercially sensitive, and we treat it that way. Submissions are readable only by the people at Bocary Studios who evaluate them, are not forwarded to other studios, publishers or platform holders, and are not used to brief internal projects. We do not require an NDA in order to read a submission — no publisher receiving unsolicited pitches can honestly promise that — but we will sign a mutual NDA before a deep evaluation begins. If you would rather not send confidential material without one, write to publishing@bocarystudios.net first.

5. Who else processes your data

We keep the chain as short as we can. Data processors acting on our instructions are:

• Our hosting provider — operates the servers holding the website and database, inside the EU/EEA. Bound by a data processing agreement under GDPR Article 28.
• Our email provider — delivers form notifications to our own mailbox and carries our replies to you.

We make no transfers of personal data outside the EU/EEA. If that ever changes, this policy will name the recipient and the Article 46 safeguard before the transfer starts.

6. Your rights

Under the GDPR you may ask us to:

• confirm what we hold about you and give you a copy (Art. 15);
• correct anything inaccurate (Art. 16);
• delete it (Art. 17);
• restrict how we use it (Art. 18);
• send it to you or another controller in a portable format (Art. 20);
• stop processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting what was lawful beforehand (Art. 7(3)).

Write to info@bocarystudios.net. We answer within one month. There is no charge unless a request is manifestly excessive, and we will say so before doing anything.

7. Complaints

If you think we have handled your data badly, please tell us first — most problems are a misunderstanding we can fix the same week. You also have the right to complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk, or to the supervisory authority in your own EU country of residence.

8. Security

The site is served over HTTPS only. Form submissions are validated server-side and written with prepared statements. Access to the database is restricted to the application account. Rate limiting and honeypot fields protect both forms. No payment data is processed on this site at all.

9. Children

This is a business-to-business site aimed at game developers and press. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, contact us and we will delete it.

10. Changes

If this policy changes materially we update the date at the top and, where the change affects data we already hold, we tell the people concerned directly.

See also the cookie policy and the terms of service.