We collect only what the Platform needs. Atklāj controls account, payment and Platform data; the relevant organiser controls participant data for their event, including answers, photos and results. GPS is used only with device permission, we never see your card details, and marketing messages are sent only if you choose them. If the organiser switches on AI checking, we send the AI service only the answer or photo, without your name or contact details, and this data is not used to train AI models.
1. Who handles your data
Platform controller: Vladislavs Judins (.), Latvia, controls website, organiser-account, payment, invoice, withdrawal-request, email-delivery, security, support and Platform-feedback data.
Event controller: the relevant event organiser normally controls participant registration, team membership, answers, uploaded photos, results, hints, messages with the organiser, event-enabled location use, the content shown on the event screen and results emails. Their name and email appear on the event page. Atklāj processes this data on the organiser’s behalf as a processor under section 14 of the terms of use, except where it is required for Platform security, legal claims or Platform feedback. Contact us if you are unsure whom to approach.
2. Data we use
Website visitor
Session, language and cookie choice; IP address and server-generated device, browser, time and security logs; a short-lived per-IP request counter used to limit repeated login, sign-up and upload attempts; Google Analytics statistics only if you consent; and information you send in a help request or email.
Organiser
Email, username, organisation, securely hashed password and email-confirmation status; last-login IP and account administration details; plan, its end date, promo codes used and usage (events, participants, storage, translation); the chosen plan and orders, including invoice orders made at sign-up; invoicing details (name, registration and VAT number, address) and issued invoices; AI-check records for billing (time, event, checkpoint, AI decision, model and price, without the answer text or photo); password-reset requests (a one-time link with a short expiry and the requesting IP address); payment records (product, amount, status, SumUp transaction ID, buyer type and the confirmation to start the service during the withdrawal period with its time and IP address). Card numbers and other card details are entered in the SumUp payment window and are not passed to us. Also withdrawal requests with the calculated used share and refund; event content and settings, uploaded images and maps, checkpoints, event-screen settings and translations; support messages, a log of emails sent (recipient, type, time, status) and significant-action records.
Participant or team
A participant account for the specific event: public username, access code, email, team name and size; name or phone only if requested for that event. The same email can be used in different events, each with its own account. Team member names and roles where the organiser uses team roles; registration time, answers (choice, text or number), uploaded photos, review status, points, results, progress and hints; the AI decision and short reason for an answer or photo where the organiser uses AI checking, and a flag if a photo was found forbidden; location and device information where enabled and permitted; messages exchanged with the organiser in the event chat; a record of whether and when a results email was sent; event and Platform ratings, comments, language and, if chosen, consent to receive news.
Organisations we contact
To tell schools, institutions, companies and other organisations about the Platform, we may use their publicly available work email address, name and sector, and record messages sent, link clicks and unsubscribes. We do not use private individuals’ addresses for this.
3. Why and on what basis we use data
| Purpose | Data | Legal basis |
|---|---|---|
| Accounts, login and event tools | Account, organisation and event content | Taking steps to enter and performing a contract |
| Email confirmation and preventing abuse of the free plan | Email, confirmation status, IP address, usage | Legitimate interest of Atklāj in protecting the Platform |
| Selling plans, taking payments, invoicing and handling withdrawals | Invoicing details, payment records, invoices, withdrawal requests | Performing a contract and legal obligations (accounting, consumer law) |
| Registration, gameplay, answer review and results | Registration, code, team members, answers, photos, points and progress | Providing the requested service and the organiser’s legitimate interest in running the event |
| AI checking of text answers and photos, where the organiser switches it on | Task, organiser rules, answer or photo, AI decision | Organiser’s legitimate interest in running the event (Atklāj acts as processor); check records for billing: performing a contract |
| Checkpoint proximity or live map | Device location and accuracy | Your choice and device permission, which can be withdrawn |
| Showing photos, answers and results on the event screen or gallery | Username or team name, photos, answers, points | Organiser’s legitimate interest; participant consent where the organiser asks for it |
| Sending results to participants when the organiser chooses to | Email, username, result | Providing the service and the organiser’s legitimate interest |
| Security and abuse prevention | IP, session, request counts and technical logs | Legitimate interests of Atklāj and users |
| Support | Contact details and messages | Contract or legitimate interest in providing support |
| Quality improvement | Rating, comment and pseudonymous participant identifier | Legitimate interest; consent where requested |
| Website analytics | Google Analytics cookies and visit data | Consent, withdrawable at any time |
| News | Consent, withdrawable at any time | |
| Offering the Platform to organisations | Public work email, name, sector, sending history | Legitimate interest of Atklāj; every message has an unsubscribe link |
| Legal duties and claims | Only data necessary for the case | Legal obligation or legitimate interests |
Scores may be calculated automatically under rules set by the organiser, and some answers may be assessed by AI. An AI decision is a suggestion the organiser can change at any time, and you can ask the organiser to have a person review your answer. This is not profiling or automated decision-making with legal or similarly significant effects.
4. Event and location data
Registration data is linked to the event and available to its organiser in results, review and statistics. Answers and uploaded photos are stored with the event; the organiser can review them and award points, and photos may appear in the event gallery and, if enabled, on the event screen. Respect other people’s rights when photographing them.
Event screen: an organiser can create a screen for a TV or projector that opens through a secret link without login. Depending on the organiser’s choice it may show usernames or team names, photos, answers, results and statistics. Anyone with the link can see it, so the organiser chooses what to show, informs participants and can create a new link so the old one stops working.
For checkpoint proximity, the browser may request a one-time location reading; the coordinates and distance are saved with the answer. If live tracking is enabled, coordinates, accuracy, time, username and browser information may be sent regularly after permission and displayed to the organiser. Revoking browser or device permission stops further transmission, but some game features may then be unavailable.
AI checking: where the organiser switches on AI checking for a checkpoint, your text answer or photo (downscaled) is sent with the task and the organiser’s rules to an AI service, which returns “correct”, “wrong” or “unsure” with a short reason. Your name, email and other contact details are not sent. We use only a paid AI API whose terms say submitted data is not used to train models; the provider may keep it briefly for abuse monitoring. A photo found forbidden is blurred or hidden in the gallery, on the event screen and in results. Do not put your own or other people’s personal data in answers unless the task asks for it.
Reading a QR code from a photo: if the camera does not open and you read a QR code from a saved photo, the image is processed only in your browser and is not uploaded.
Playing without internet: if the connection drops or the server is busy, an answer is kept in your device’s browser and sent automatically once the connection returns. Until then it exists only on the device, and it is removed from the device once sent.
Results email and chat: after the event the organiser may email participants a personal link to their results; replies go to the organiser. Messages in the event chat are seen by the participant and that event’s organiser.
7. How long data is kept
- Organiser account and event content: while active and then as needed for closure, disputes and secure backup overwrite.
- Participant registration, answers, photos, hints and results: for the organiser-selected period (7, 14, 30, 90, 180 or 365 days). A plan may cap the longest period (for example 14 days on “Start” and 90 days on “Event”). If no automatic deletion is selected, until a justified organiser request or event-data deletion.
- Live location: only as needed to manage the event and no longer than its participant-data retention period.
- Event-screen link: works until the organiser creates a new link or deletes the event; the screen shows only data that is still kept.
- Answers saved offline: only on the device, until sent.
- Invoices, payment records and AI-check billing records: for the period required by accounting law (normally 5 years).
- AI decision and reason stored with an answer: together with the answer, i.e. for the event’s participant-data retention period.
- Password-reset links: valid briefly and once only; request records are kept briefly for security.
- Withdrawal requests and confirmations to start the service: together with the related purchase, while a dispute or claim is possible.
- Event and Platform feedback: separately and pseudonymously while useful for quality analysis or until a justified deletion/objection request.
- Marketing email: until consent is withdrawn.
- Organisation contacts for offers: while the offer is relevant. If an organisation unsubscribes, we keep only the address on a suppression list so we do not write again.
- Support messages, email log and security records: as needed to resolve the matter, investigate delivery problems, protect security and legal rights, then deleted or anonymised.
- Per-IP request counters: a few minutes to a few hours.
- Session data: until session end or technical expiry.
Data may be kept longer where law, a dispute or legal claims require it. Data no longer needed is deleted or anonymised.
8. Security
We use encrypted connections only (HTTPS), password hashing, session and request security checks, protection against forged requests, limits on repeated attempts, protected database queries, access separation and backups. Access keys are kept outside the program code. Organisers can access only data linked to their profile and events, and Atklāj administrators only the sections assigned to them. Card details are processed by SumUp and never reach our server. No system is risk-free. If a personal data breach occurs, we act under the GDPR: we contain it, inform affected organisers and, where required, the Data State Inspectorate and the people concerned. Please report suspected unauthorised access immediately.
9. Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction, portability, object to processing and withdraw consent at any time. Withdrawal does not affect earlier lawful processing. You can stop offer emails with the link at the end of each message.
Contact the event organiser first about registration, answer, photo and result data. Contact Atklāj about organiser accounts, payments, Platform security or Platform feedback. We may verify identity before responding. You may also complain to the Latvian Data State Inspectorate.
10. Children
The Platform may be used for school, youth and family events. Before collecting children’s data, the organiser must assess age, provide age-appropriate information, obtain guardian permission where required (especially for photos and content shown on the event screen) and collect only what the event genuinely needs. Contact the organiser or Atklāj if you believe a child’s data was submitted without a proper basis.
11. Transfers outside the EEA
Core data is processed in the European Economic Area where practicable. Google (Analytics, Fonts and Gemini), OpenAI and Cloudflare may also process information in the USA, and opening an external map or third-party function may send technical information to another country. Where personal data is transferred outside the EEA, we rely on an applicable legal mechanism, such as the EU-US Data Privacy Framework or standard contractual clauses.
12. Contact and changes
When making a request, say whether it concerns an organiser account or a specific event and include the event name or link. We update this policy when Platform functions or data use change; the current effective date is always shown here.