Privacy Policy

Last Updated: January 15, 2025

Effective Date: January 15, 2025

Tavernus Game LLC ("Tavernus," "we," "us," or "our") operates the website tavernusgame.com and the Tavernus PDF Editor platform (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect information about users ("you" or "your") of the Service. This policy applies to all users, including those located in the United States (CCPA), the European Economic Area (GDPR), and all other jurisdictions.

1. Information We Collect

1.1 Information You Provide Directly

• Account Registration: Name, email address, and password when you create an account.
• Billing Information: Payment card details, billing address, and transaction history when you subscribe to a paid plan. Payment processing is handled by Stripe, Inc., a PCI DSS Level 1 certified processor. We do not store your full card number.
• Contact Form Submissions: Name, email, phone number, and message content when you reach out through our contact or support forms.
• Document Uploads: PDF files uploaded for editing, merging, splitting, form filling, or conversion. These files are processed in isolated, encrypted environments and automatically deleted within 60 minutes of processing completion.

1.2 Information Collected Automatically

• Log Data: IP address, browser type, operating system, referring URL, pages visited, and timestamps.
• Device Information: Screen resolution, device type (desktop, tablet, mobile), and preferred language.
• Cookies and Similar Technologies: We use essential cookies to ensure the proper functioning of the Service (session management, authentication). Optional analytics cookies are used only with your explicit consent.

2. How We Use Your Information

• To provide, maintain, and improve the Service.
• To process your subscriptions and billing.
• To respond to your inquiries and support requests.
• To send transactional emails (account creation, password resets, billing confirmations).
• To monitor and analyze usage patterns for performance and security improvements.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We do not use your uploaded documents for training machine learning models. We do not share your data with advertisers.

3. Document Security & Zero-Retention Policy

Tavernus operates under a strict zero-retention policy for user-uploaded documents. Specifically:

• All uploaded PDF files are processed in isolated, ephemeral container environments that are destroyed after each session.
• Files are encrypted in transit using TLS 1.3 and at rest using AES-256 encryption.
• All user-uploaded files and their processed outputs are automatically and permanently deleted within 60 minutes of processing completion.
• Our staff does not have access to the content of your uploaded documents at any time.
• Backup systems do not retain copies of user-uploaded documents.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contract Performance: Processing necessary to provide the Service you subscribed to (Article 6(1)(b) GDPR).
• Legitimate Interests: Processing for security monitoring, fraud prevention, and service improvement (Article 6(1)(f) GDPR).
• Consent: Processing based on your explicit consent, such as optional analytics cookies (Article 6(1)(a) GDPR). You may withdraw consent at any time.
• Legal Obligation: Processing required to comply with applicable laws (Article 6(1)(c) GDPR).

5. Your Rights Under GDPR

If you are a resident of the EEA, UK, or Switzerland, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we limit the processing of your data in certain circumstances.
• Portability: Request a machine-readable copy of your data.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw consent for optional data processing at any time.

To exercise any of these rights, please contact us at support@tavernusgame.com. We will respond within 30 days.

6. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following rights:

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: You can request the deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. If this practice changes, we will provide a "Do Not Sell My Personal Information" link.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a verifiable consumer request, email support@tavernusgame.com with the subject line "CCPA Request." We will verify your identity before processing.

7. Cookies and Tracking Technologies

We use the following types of cookies:

• Essential Cookies: Required for the Service to function (session tokens, authentication state, CSRF protection). These cannot be disabled.
• Analytics Cookies: Used only with your explicit consent to understand usage patterns and improve the Service. You can manage these preferences through the cookie banner displayed on your first visit.

We do not use third-party advertising trackers. We do not deploy Facebook Pixel, Google Ads remarketing tags, or any similar advertising technologies on the Service.

8. Third-Party Service Providers

We share limited information with trusted third-party providers who help us operate the Service:

• Stripe, Inc. — Payment processing (PCI DSS Level 1 certified).
• Amazon Web Services (AWS) — Cloud infrastructure and hosting (SOC 2 Type II certified).
• Cloudflare, Inc. — CDN, DDoS protection, and DNS management.

All third-party providers are contractually bound to process your data only as necessary to provide their services and in accordance with applicable data protection laws.

9. Data Retention

• Account Data: Retained for the duration of your account. Deleted within 30 days of account closure upon request.
• Billing Records: Retained for 7 years to comply with US tax regulations.
• Contact Form Submissions: Retained for 1 year, then deleted unless the inquiry resulted in an ongoing support case.
• Uploaded Documents: Automatically deleted within 60 minutes of processing. No exceptions.
• Log Data: Retained for 90 days for security monitoring, then anonymized or deleted.

10. International Data Transfers

Our servers are located in the United States. If you access the Service from outside the US, your data may be transferred to the US. For users in the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to provide adequate protection for international data transfers.

11. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and update the "Last Updated" date at the top of this page. Your continued use of the Service after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, contact us:

• Email: support@tavernusgame.com
• Phone: +1 (425) 555-0182
• Mail: Tavernus Game LLC, 700 Powell Ave SW, Renton, WA 98057, United States