Privacy Policy

Burlis Management GmbH, Philippstraße 27, 52349 Düren, Germany

Contact: legalnotice@paraspeech.com

GAMESLIKE processes request data to deliver the website, protect the service, operate accounts, support Steam sign-in, show recommendations, and answer messages sent to the contact address.

Account and authentication data is handled with Supabase Auth. Steam sign-in uses Steam-provided identifiers and profile data needed to connect the account; GAMESLIKE never asks for a Steam password.

Game catalog, price, review, recommendation, and metadata pages rely on Steam and other public game data. Recommendation interactions may be processed to operate the account and improve the product.

For eligible games, GAMESLIKE obtains recent public English user reviews from Steam's documented review endpoint and classifies source-local wording into fixed game aspects. The purpose is to provide a deterministic aggregate discovery signal. Public output is limited to aspect names, aggregate mention and sentiment counts, a fixed-template summary, sample size, review-window date, last-updated date, and applied filters. GAMESLIKE does not publish copied review text, recommendation IDs, Steam IDs, reviewer names, profiles, playtime, avatars, or individual review links.

The dedicated aggregate capture projects only the review text and the recommendation ID, game ID, language, review timestamps, and observation/capture timestamps needed for classification, deduplication, retention, and rights-request suppression. It does not persist Steam endpoint author, playtime, vote, engagement, purchase, or developer-response fields for aggregate analysis, and no profile or persona lookup is performed. Separately, GAMESLIKE's legacy general review ingestion for existing whole-review signals privately retains broader public Steam review fields, including review and author identifiers, review text, playtime, vote and engagement values, purchase/context flags, developer responses, and timestamps. Those legacy fields do not enter aspect sentiment or its public output.

This processing relies on GAMESLIKE's legitimate interest under GDPR Article 6(1)(f) in providing useful, auditable game-discovery information. The internal balancing assessment concluded that aggregate-only analysis is necessary for that purpose and has limited impact because the source reviews are public, the output cannot be traced to a reviewer, uncertain or unsafe material is excluded, source data is private and time-limited, and reviewers can object or request removal. Affiliate relationships do not affect review selection, classification, or sentiment.

Steam is the source. Direct Article 14 notice to each of millions of pseudonymous reviewers is not provided because identifying and contacting each person would require disproportionate effort and GAMESLIKE does not collect contact details for this purpose. Under the dated Article 14(5)(b) assessment, this public notice is the compensating measure and explains the source, purpose, safeguards, retention, recipients, and rights.

Private source data is available only to authorized GAMESLIKE operations and its database/hosting infrastructure providers, including Supabase and Hetzner-hosted systems. The aggregate result is available to website visitors, search engines, and normal website-delivery providers such as Cloudflare, including where those providers process data outside the EEA under the safeguards described above. Private review-source data is not shared with affiliate partners or optional analytics providers.

A review that remains observed can remain in the private rolling source set. It is deleted within 35 days after it is no longer observed; review-specific raw responses and stale source memberships follow the same limit. Public aggregate summaries expire after 35 days. A minimal suppression record containing the recommendation ID, game ID, bounded reason, and date can be retained while review ingestion or analysis remains active, then is deleted within 35 days after that processing path is permanently disabled.

Sensitive, allegation, contact, directed-abuse, and third-party personal text is excluded from analysis and promptly deleted from review-analysis source data. The current aggregate output is not used for decisions with legal or similarly significant effects. This screening must be revisited before any reviewer attribution, copied quotation, profile enrichment, or materially broader use.

To request access, correction, objection, or removal of a Steam review from this analysis, send the public Steam review URL to legalnotice@paraspeech.com. GAMESLIKE uses its game and public profile identifiers transiently to locate exactly one private source record; ambiguous or unmatched requests stop without a change. The review URL and profile identifier are not retained in the suppression record or logs.

GAMESLIKE currently uses Cloudflare for edge delivery/security, Hetzner-hosted infrastructure for application hosting, Supabase for authentication and database services, Typesense for search, and Steam/Valve data for Steam sign-in and catalog data.

Cloudflare Web Analytics and Ahrefs Web Analytics are optional processors for site-use, interaction, and performance measurement. They load only after analytics consent.

PostHog provides optional, EU-hosted product analytics. Its browser code loads only after analytics consent and is configured without person profiles, account linkage, session replay, or automatic interaction capture.

Cloudflare processing can involve the United States. Its customer DPA uses the EU-US Data Privacy Framework where applicable and Standard Contractual Clauses as a fallback.

Ahrefs Pte. Ltd. processes analytics data in Singapore and through its published subprocessors under an executed data-processing agreement and Standard Contractual Clauses. Singapore does not have an EU adequacy decision.

Operational logs are kept only as long as needed for security, debugging, and service reliability. Account data is kept while the account exists and is removed or anonymized after a valid deletion request unless legal retention duties require otherwise.

Contact messages are kept while needed to handle the request and related follow-up. Backups and security logs may retain limited data for a short operational period.

Cloudflare keeps unsampled Web Analytics data for seven days, then retains aggregated data for up to six months in the dashboard.

Ahrefs discards raw IP addresses and deletes the salt used for its daily IP-and-user-agent visitor hash every 24 hours. Customer analytics history can remain for the agreement term, operational logs for servers handling customer data are limited to one month, and customer personal data is deleted or returned after service termination. Ahrefs publishes no fixed deletion period for non-personal, de-identified, or aggregated derivative outputs used under its Terms.

PostHog product-analytics events are retained for 12 months. GAMESLIKE does not create PostHog person profiles or store an account identifier in PostHog.

Cloudflare Web Analytics, Ahrefs Web Analytics, and PostHog load only after you select Accept analytics. Device access relies on consent under section 25(1) TDDDG; subsequent personal-data processing relies on consent under GDPR Article 6(1)(a). Refusing analytics does not limit the site.

Cloudflare measures page views, page and referrer information, country, browser, operating system, device, navigation timing, and Core Web Vitals. Cloudflare documents that Web Analytics does not use analytics cookies, local storage, or fingerprinting.

Ahrefs receives page and origin-only referrer data, browser and device data, approximate location, interaction data, and diagnostics. GAMESLIKE sends pageview locations without query strings or fragments. Automatic interaction events can include complete clicked-link destinations and submitted-form actions, including parameters already present in those targets.

The deployed Ahrefs configuration does not send form controls or values, custom properties, account IDs, or GAMESLIKE user IDs. Ahrefs uses a daily salted IP-and-user-agent hash and may use non-personal, de-identified, or aggregated outputs under its Terms.

PostHog receives anonymous pageview and pageleave events, scroll depth, browser and device properties, and Core Web Vitals (CLS, FCP, LCP, and INP). URL properties are stripped to origin and pathname. It uses memory-only persistence with no person profiles, account linkage, session replay, heatmaps, general interaction autocapture, or feature flags.

Use Cookie settings to reject analytics or withdraw consent at any time. Withdrawal stops future optional analytics after the page reloads. It does not affect processing that occurred before withdrawal. Contact GAMESLIKE for an access or deletion request where provider data can be associated with you.

Because these analytics designs do not keep a stable visitor identifier for GAMESLIKE, the providers may be unable to identify a particular visitor record for individual deletion.

Simple Analytics, Google Analytics, advertising tags, affiliate pixels, and affiliate attribution cookies are not loaded by the application.

Future affiliate click tracking, price alerts, paid accounts, newsletters, Mac apps, customer uploads, or other non-essential analytics must be added to this policy before those features launch.

You can request access, correction, deletion, restriction, portability, or objection where these rights apply. You can also withdraw consent for consent-based processing without affecting earlier lawful processing.

Send requests to legalnotice@paraspeech.com. You may also complain to a competent data protection supervisory authority. For North Rhine-Westphalia, this is the Landesbeauftragte fuer Datenschutz und Informationsfreiheit Nordrhein-Westfalen, poststelle@ldi.nrw.de.