Skip to main content

Last updated:

1. Who we are

RFP Gaming (“we”, “us”, “our”) is a B2B marketplace for the gamedev industry. We connect studios, publishers, and service companies through a structured deal-flow platform.

Data controller contact: contact@rfpgaming.com

2. Cookies and tracking

We use the minimum cookies necessary to operate the platform:

  • Session cookie (authjs.session-token) — keeps you signed in. Strictly necessary.
  • CSRF token (authjs.csrf-token) — prevents cross-site request forgery. Strictly necessary.
  • Stripe cookies — set by Stripe on their own domain during payment checkout only. Not accessible to RFP Gaming.

Analytics set no cookies. Views of company profiles and the company catalog are counted on our own servers. While you are signed out no analytics run in your browser at all — nothing is initialised, no identifier is stored on your device, and no data is sent to any analytics provider — so no consent is required. No tracking pixels or beacon images are used anywhere on the site.

Once you sign in, we load PostHog (EU-hosted) to understand how the product is used. While you are signed in this records the pages you visit, including public ones, and a sample of sessions is recorded for replay with all on-screen text masked. It is configured to keep its data in your browser's local storage rather than in cookies, so it does not set one. If your browser blocks local storage entirely, PostHog is disabled rather than falling back to a cookie.

Local storage.The first time you visit, we store a single record in your browser's local storage recording how you arrived: the campaign tags present in the link you followed (utm_source, utm_medium, utm_campaign, utm_content), the address of the site that referred you, and the time. This is not a cookie — it is never transmitted automatically with your requests. We record only the referring site's address, never the particular page you came from, and the record contains no name, email address, IP address or other identifier. It is written once and never updated. If you create an account or claim a company profile, the record is attached to that account so we can measure which outreach worked. You can remove it at any time by clearing this site's data in your browser.

3. Data we collect

  • Account data: name, email address, profile image (from Google OAuth or provided by you)
  • Organization data: company name, description, logo, website, location, team size, service categories
  • Transaction data: tickets posted, bids submitted, deal stage progressions, bid amounts (no payment card data — Stripe handles all card processing)
  • Billing data: Stripe customer and subscription IDs, subscription plan, billing period (no card numbers stored)
  • Usage data: for public pages, aggregate counts recorded on our own servers — cookieless, with no individual tracking. For signed-in users we additionally record product usage in PostHog (EU-hosted), linked to your account and your company, so we can see which features are actually used. A sample of signed-in sessions (about one in four) is recorded for replay; signed-out visitors are never recorded.
  • Communications: emails sent through Resend for authentication, notifications, and digest emails

4. Companies listed before they signed up

Some company profiles on RFP Gaming were created by us, not by the company. We call these pre-listings. If you have arrived here from a profile of your own company that you never created, this section is about you.

Where the information comes from

The initial listing (name, website, region) comes from public industry sources; profile details are compiled primarily from the company’s own website.

What we collect

Public business information only — no personal data beyond publicly published business contact details:

  • Company name, website, and region
  • A description of what the company does, its disciplines and services, and the locations it operates from
  • Notable projects the company publishes about itself
  • Publicly listed business contact details (for example a contact@ address or a contact form), used only to tell the company its listing exists. We never publish these on the site — they are not shown on your profile or anywhere else, and we do not sell or share them.

Why we do it

To build an open, public directory of the games industry, so buyers can find qualified studios beyond the ones already in their network — and to contact each company about its own listing, so it can claim, correct, or remove it.

Lawful basis

Legitimate interest (GDPR Article 6(1)(f)) — operating an industry directory of publicly available business information. You can object at any time, and the remedies below are how.

How long we keep it

  • Business contact details collected for outreach are deleted after 24 months without engagement.
  • If you opt out or ask to be removed, we keep a minimal suppression list permanently. That record exists only so we never contact you again or re-create the listing automatically; deleting it would defeat your own opt-out. If you later want the profile back, you can ask us to restore it — the suppression record stops us acting on our own, not you.

Your options

  • Claim it. Free, from the profile page. Claiming gives you full control of the content.
  • Correct it. Claim the profile and edit it directly, or write to us and we will correct it for you.
  • Remove it. Request removal from the profile page. If the email you use matches the company’s domain, we email you a confirmation link and removal takes effect immediately when you confirm. Otherwise the request goes to a person, and removal requests are processed within 5 business days.
  • Object. You can object to the processing described here at any time by writing to contact@rfpgaming.com.

A pre-listing carries a notice saying the company has not created, claimed, reviewed, or endorsed it, and that RFP Gaming is not affiliated with it.

5. Contact forms and the notify list

Two things on this site take your details without you having an account.

The contact form

When you write to us through the contact form, your name, email address, subject and message reach us as an email to our own inbox. We do not store it in a database. It stays in that inbox for as long as we need it to deal with what you wrote about.

The notify list

Before the request board opens, you can ask to be told when it does. From you we store two things: the email address and the company name you type in. If you also answer the optional question about what your company needs, those answers are kept on the same record. You can skip that question and nothing else changes.

That record also carries our own working notes about it: which page you used, whether we have followed up yet, and any short note a member of our team writes while dealing with it. Those are written by us, not by you.

We use the notify list for exactly one thing: to email you once, when the board opens. No newsletter, no updates, no other campaign, and we do not add you to any other mailing list on this site. That one email is written and sent by a person — there is no automated mailing attached to this list at all.

When an entry arrives, our own team is notified by email so that somebody sees it. That notification goes to us, never to you.

To come off the list before the board opens, write to contact@rfpgaming.com. A person reads it and deletes your entry by hand. There is no button for this and it is not instant, so allow us a few working days.

6. How we use your data

  • Providing and operating the RFP Gaming platform (legal basis: contract, GDPR Art. 6(1)(b))
  • Sending transactional emails (authentication magic links, bid notifications, stage change alerts) (legal basis: contract)
  • Processing subscription payments via Stripe (legal basis: contract)
  • Preventing fraud, abuse, and maintaining platform security (legal basis: legitimate interests, GDPR Art. 6(1)(f))
  • Measuring platform usage to improve the service (legal basis: legitimate interests — anonymized analytics only)
  • Complying with legal obligations (legal basis: legal obligation, GDPR Art. 6(1)(c))

7. Data retention

  • Account and organization data: retained for the duration of your account, plus 30 days after account deletion (to allow recovery)
  • Billing records: retained for 7 years from the transaction date as required by applicable tax and accounting law
  • Deal history (tickets, bids): retained indefinitely after a deal closes — deal records are part of the platform's public reputation data. User attribution is anonymized if a user account is deleted (the record remains, the name does not)
  • Capacity Board contact reveals: when you ask for a company's contact details from a capacity offer, we record that you did so — which offer, which company, and when. The record is retained indefinitely: it enforces the daily limit on contact requests, shows the offering company how many people have reached out, and lets us investigate abuse. The offering company is notified of the request and is shown your company's name. If you delete your account the record remains but is no longer linked to you (the count survives, your identity does not)
  • Authentication logs: retained for 90 days for security purposes, then deleted

8. Data residency

All data is stored and processed within the European Union:

  • Application hosting: Vercel EU region
  • Database: Supabase (PostgreSQL), EU region
  • File storage: Cloudflare R2, EU region
  • Email delivery: Resend (EU Data Processing Addendum available)
  • Error monitoring: Sentry (EU region)
  • Analytics: PostHog Cloud (EU region, cookieless)

No personal data is transferred outside the EU.

9. Your rights under GDPR

If you are located in the EU/EEA, you have the following rights:

  • Access: request a copy of the personal data we hold about you
  • Rectification: request correction of inaccurate data
  • Erasure (“right to be forgotten”): request deletion of your personal data where no legal obligation requires retention
  • Portability: receive your data in a machine-readable format (JSON or CSV)
  • Restriction: request that we limit processing of your data
  • Objection: object to processing based on legitimate interests

To exercise any right, email contact@rfpgaming.com. We respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

10. Third-party processors

We share data only with the processors needed to operate the platform:

  • Vercel — application hosting (EU region)
  • Supabase — database hosting (EU region)
  • Stripe — payment processing (DPA in place)
  • Cloudflare R2 — file storage (EU region)
  • Resend — transactional email delivery
  • Sentry — error monitoring (EU region, PII stripped before transmission)
  • PostHog — product analytics (EU region). Cookieless. Loaded only for signed-in users, and never while you are signed out. While you are signed in it records the pages you visit, public pages included.

We do not sell personal data to any third party.

11. Changes to this policy

We may update this Privacy Policy. Material changes will be communicated by email to registered users at least 14 days before taking effect. The “Last updated” date at the top of this page reflects the most recent revision.

12. Contact

Questions about this Privacy Policy or your data: contact@rfpgaming.com

We use cookies to keep you signed in and protect against request forgery. Our analytics are cookieless — public pages are measured on our own servers, and PostHog (EU-hosted) loads only after you sign in. We also store one small record in your browser's local storage to remember which campaign brought you here.