Privacy policy
Who is responsible
Organisation: Genlabs Group SL
Registration identifier: B21641469
Address: Gran Via 1, 48001 Bilbao, Biscay, Spain
Contact: legal@saiki.lol
Brand: Saiki LoL
Scope of this notice
Self-report questionnaire and experimental League gameplay indicators.
Domains: https://saiki.lol, https://app.saiki.lol
Surfaces: website, application
This notice covers the currently operating scope described above.
Calculate self-report results, retrieve optional League match data and display experimental indicators; generate paid narrative and available longitudinal history.
Our role in this activity: controller
Role and responsibilities: We determine how the requested product functions process the profile, submissions and results described here.
Personal data: Account identity, names, birth date, sex, 100 questionnaire responses/scores, Riot ID/tag/region, summoner/mastery/match data, derived gameplay metrics, snapshots and paid AI narrative.
People concerned: Account users, restricted to adults aged 18 or older, and the Riot player profile selected by the user.
Source of the data: User-entered demographics/questionnaire and Riot ID; Riot developer APIs; calculated indicators and AI-generated narrative.
Consequences of not providing the data: Using these functions is optional. The information needed for a selected profile, document, analysis or submission must be supplied to produce that requested result.
Lawful basis: Contract or requested precontractual steps (Article 6.1.b GDPR).
Provision of data: Optional
Recipients for this activity: Google Cloud / Firebase, Riot Games
Authenticate users, maintain account/session and send access links; optional Google sign-in when configured.
Our role in this activity: controller
Role and responsibilities: We manage access, authentication and administration of this service account.
Personal data: Account name/email and identifier, verification token, session data and optional OAuth account identifiers.
People concerned: Account users.
Source of the data: User entry, email sign-in and optional configured OAuth provider;
Consequences of not providing the data: The minimum sign-in and verification information is required for authenticated account access. Without it, you cannot sign in to the account; public pages remain available.
Lawful basis: Contract or requested precontractual steps (Article 6.1.b GDPR).
Provision of data: Required for this purpose
Recipients for this activity: Google Cloud / Firebase, Transactional email delivery and mailbox provider
Process one-time Deep Report purchase and record access entitlement/payment status.
Our role in this activity: controller
Role and responsibilities: We administer purchases, subscription access and payment status for our service.
Personal data: Authenticated account user ID/email, one-time Deep Report price, billing address collected by Stripe, checkout/customer/payment-intent identifiers, paid status, purchase timestamp and Deep Report entitlement.
People concerned: Purchasers and billing contacts.
Source of the data: Your checkout information and Stripe payment events.
Consequences of not providing the data: Buying a paid service is optional. The checkout information needed for the selected purchase must be supplied to complete it.
Lawful basis: Contract or requested precontractual steps (Article 6.1.b GDPR).
Provision of data: Optional
Recipients for this activity: Stripe, Stripe
Understand how the website and service are used by measuring visits and selected interactions.
Our role in this activity: controller
Role and responsibilities: We decide which website visits and bounded interactions to measure to understand and improve this website.
Personal data: Page URL, referral and campaign information, event name and any configured event properties; IP address and browser information are processed in the request path. Configured conversion paths can store a signup marker or checkout-session identifier locally to reduce repeat counts. The shared conversion wrapper does not send these deduplication identifiers to the analytics providers.
People concerned: Website visitors.
Source of the data: Your browser sends page and event information through our analytics relay. The relay processes technical request information, including IP address and browser information, and forwards the permitted event fields to our self-hosted analytics service.
Consequences of not providing the data: Analytics information is not a prerequisite for opening the public website.
Lawful basis: Legitimate interests (Article 6.1.f GDPR).
Legitimate interests: Our legitimate interest is to understand use of our informational website and improve its pages using limited visit and interaction information. This is not permission for terminal storage that separately requires consent.
Provision of data: Optional
Recipients for this activity: Google Cloud / Firebase
Answer the support questions you submit using an automated assistant and, if you request it, make the conversation available to a human support reviewer.
Our role in this activity: controller
Role and responsibilities: We determine how to answer enquiries and provide the requested support or follow-up.
Personal data: Your submitted messages, automated replies, product and language, conversation reference/status and technical timestamps. An email address is collected when you request human follow-up. Do not send passwords, payment details, health information or confidential documents.
People concerned: Visitors and users who choose to ask for product support.
Source of the data: Information you enter into the support chat and responses generated by the assistant. The conversation is stored before the assistant replies; a refusal to repeat sensitive information does not prevent its storage.
Consequences of not providing the data: Using chat is optional. A question is needed to answer it, and an email is needed only if you request human follow-up.
Lawful basis: Legitimate interests (Article 6.1.f GDPR).
Legitimate interests: Our legitimate interest is to answer the enquiry you choose to submit and organise the support or commercial follow-up you request. This does not authorise unrelated promotional messages.
Provision of data: Optional
Recipients for this activity: Google Cloud
Retention and deletion
Retention period or criteria: Our policy is to retain these records until deletion is requested. We assess deletion requests through the privacy contact, taking account of any applicable obligation to retain particular records. This does not mean that every record is automatically erased as soon as a request is made.
Applies to: Calculate self-report results, retrieve optional League match data and display experimental indicators; generate paid narrative and available longitudinal history.; Process one-time Deep Report purchase and record access entitlement/payment status.
Retention period or criteria: We keep your account information until you request deletion. Email sign-in links expire after 24 hours.
Applies to: Authenticate users, maintain account/session and send access links; optional Google sign-in when configured.
Retention period or criteria: Our policy is to retain website-measurement records until deletion is requested. These records do not have an automatic expiry. We assess requests using information we can reasonably link to the requester.
Applies to: Understand how the website and service are used by measuring visits and selected interactions.
Retention period or criteria: Conversations are scheduled to expire 30 days after the last conversation message or status change, and internal notification records 30 days after creation. Automatic deletion is asynchronous. Provider or separate email copies are not covered by this timer.
Applies to: Answer the support questions you submit using an automated assistant and, if you request it, make the conversation available to a human support reviewer.
Deletion: You may use the available account-deletion controls or contact the privacy address to request erasure. Separate third-party records, downloaded copies and records that must lawfully be retained are not necessarily erased by deleting the account.
Applies to: Calculate self-report results, retrieve optional League match data and display experimental indicators; generate paid narrative and available longitudinal history.
Deletion: You may request erasure through the privacy contact. Closing the chat or marking a question resolved does not itself delete the stored conversation.
Applies to: Answer the support questions you submit using an automated assistant and, if you request it, make the conversation available to a human support reviewer.
Who receives the data
- Google Cloud / Firebase (processor; eur3 (Firestore / Storage); global): We use Firestore for account/questionnaire/gameplay records and snapshots, and Google Gemini through the shared AI client for a narrative from derived self-report scores, gameplay indicators, gaps and strategic-play metrics. Google may process service data globally under its applicable published data-processing and transfer terms: https://cloud.google.com/terms/data-processing-addendum .
- Riot Games (controller; Riot regional game services and global operations, including the United States): Receive the entered Riot identifier and API account/match queries, and return account, mastery and gameplay information. Riot controls its own game/account service; it does not analyse our questionnaires.
- Stripe (processor; Ireland / United States; international payment and service infrastructure): Process the account-linked one-time Deep Report purchase and provide paid-session identifiers used to grant report access. Stripe acts on our payment instructions for this function.
- Google Cloud (processor; Google Cloud (global)): Host the requested support conversation, store messages and responses, and generate automated help through Vertex AI. Google may process service data globally under its applicable published data-processing and transfer terms: https://cloud.google.com/terms/data-processing-addendum .
- Transactional email delivery and mailbox provider (processor; DE / US): Deliver requested sign-in links using recipient addresses, email content and delivery information.
- Stripe (controller; Ireland / United States; global operations): Stripe separately controls payment security, fraud prevention, legal compliance and its own service operations under its privacy notice.
International transfers
Stripe (United States (where the applicable Stripe recipient processes data)): Adequacy decision. Stripe publishes reliance on the EU-US Data Privacy Framework for covered US transfers, with standard clauses where applicable. Scope depends on the recipient and service.
Published terms and information about safeguards: https://stripe.com/legal/data-transfers-addendum
Riot Games (Non-EEA service locations, including the United States): Standard contractual clauses. The provider describes standard contractual clauses for covered restricted transfers; an applicable adequacy framework may also cover particular recipients. Processing depends on the service and destination.
Published terms and information about safeguards: https://www.riotgames.com/en/privacy-notice
Transactional email delivery and mailbox provider (US): No transfer safeguard identified; transfer legality remains unresolved. Email delivery may involve processing in the United States. We have not identified an applicable adequacy decision or other GDPR transfer safeguard covering this email service.
No identified transfer-safeguard copy is available for this email service. Contact legal@saiki.lol for current information.
Automated decisions
We do not make solely automated decisions that produce legal or similarly significant effects in this scope.
Your data protection rights
Depending on the applicable conditions, you can request access, rectification, erasure, restriction and portability, and object to processing (Articles 15–21 GDPR).
To request access, correction, erasure, restriction or portability, or to object where applicable, contact the privacy address and describe your request. You may also use the available account controls. We may need information to verify your identity.
Rights contact: legal@saiki.lol
You can lodge a complaint with a competent supervisory authority, including in the Member State of your habitual residence, workplace or the alleged infringement (Article 77 GDPR).