| Version | 1.0 |
| Effective date | 23 September 2026 |
| Last reviewed | 23 September 2026 |
| Controller | Game Caster Ltd, company number 16913352 (England and Wales) |
| Contact | info@game-caster.com |
At a glance
| Question | Short answer |
|---|---|
| Who is responsible for my data? | Game Caster Ltd, a UK company. |
| What do you collect? | Your Google account email, name and avatar; the game content, files and prompts you put into the service; billing status from Stripe; usage and technical logs. |
| Why? | To run the service you signed up for, keep it secure, bill you, and improve it. |
| Do you use my content to train AI? | No. We send your content to AI providers only to produce the outputs you ask for, under contracts that prohibit training on it. |
| Where is my data stored? | In the EU (Google Cloud, Belgium). Some AI providers are in the US; we use UK-approved transfer safeguards. |
| Who can see my data? | You, and Game Caster staff who need access to operate or support the service. Other studios cannot see your projects. |
| How long do you keep it? | While you have an account, then deleted within 30 days. Billing records are kept for 6 years by law. See section 9. |
| Can I get my data deleted? | Yes. Email info@game-caster.com or use the delete-account control in Settings. |
| Cookies? | In the application, only the cookies needed to keep you signed in. On the marketing website, analytics cookies only if you accept them in the banner. No advertising cookies anywhere. |
| Complaints? | Contact us first. You can also complain to the ICO at any time. |
1. Who we are
Game Caster Ltd ("Game Caster", "we", "us") is the data controller for the personal data described in this policy.
- Registered in England and Wales, company number 16913352
- Registered office: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom
- Privacy contact: info@game-caster.com (put "Privacy" in the subject line)
- ICO registration number: ZC157749 (registered 27 May 2026, expires 26 May 2027, renewed annually; certificate on file)
We are not required to appoint a Data Protection Officer. Privacy questions and requests are handled by Can Gunaslan, Director, through the contact above; he owns the one-month response clock in section 9.
2. What this policy covers
This policy applies to:
- the Game Caster web application at app.gamecaster.ai and its API (access with
gc_API keys) - public Steam-page previews we host at
app.gamecaster.ai/p/<link>when you choose to share one - our marketing website at game-caster.com
- emails and support conversations with us
It does not cover the third-party platforms (Steam, X, Bluesky, Discord, Google) you connect to Game Caster. Those platforms are independent controllers of what happens on their services.
Game Caster is a business tool for game studios. You must be 18 or over to use it. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.
3. The data we collect and where it comes from
3.1 Data you give us
| Category | What | Source |
|---|---|---|
| Account | Email address, display name, profile picture URL, whether Google has verified your email | Your Google account, when you sign in with Google. We store these three fields. We do not store your Google password, access token or refresh token. |
| API keys | A cryptographic hash of each key you create, the first characters of the key, a label, when it was last used | Generated when you create a key in Settings |
| Game and project content | Project names and descriptions, Steam store URLs, uploaded files (game design documents, screenshots, logos, key art, reference images, audio and video), text extracted from uploaded documents, voice notes and their transcripts, prompts and instructions you type, plan cards, Steam page drafts, feed posts, creator outreach drafts | You, as you use the service |
| Generated content | Text, images and other media the service produces for you, and the prompts used to produce them | Created by the service on your instruction |
| Publishing connections | If you connect a channel so Game Caster can post for you: your X account handle and OAuth tokens; your Bluesky handle and app password; your Discord webhook URL | You, when you connect a channel. Stored encrypted at rest. |
| Billing | Your Stripe customer ID, subscription ID, price and plan, subscription status, billing period end, and a ledger of credits granted and spent | Created when you subscribe or buy credits. Card numbers and billing addresses are collected by Stripe on Stripe's pages and never reach our servers. |
| Feedback and support | Anything you send to info@game-caster.com or include in a support conversation | You |
Please do not upload special category data (health, ethnicity, religion, sexual orientation, political opinions, biometrics) or anyone else's personal data unless you have the right to share it. Game Caster is designed to process information about games, not people.
3.2 Data we generate while you use the service
| Category | What | Why |
|---|---|---|
| Product events | Which features you used and when, counts of items produced (for example "plan built, 26 weeks, 14 creators"), the genre and art style detected for your game | To understand what is used and fix what breaks |
| Model usage logs | For each AI call made on your behalf: which model, tokens in and out, cost, latency, a quality score, and a short note from an automated quality check | To control cost and monitor output quality. These logs are linked to your account ID, not your name or email. |
| Publish records | Each attempt to post to a connected channel, whether it succeeded, and the channel's response | So you can see what was published and so we can debug failures |
| Credit ledger | Every credit grant, spend and refund with the operation that caused it | Billing and dispute resolution |
3.3 Technical data collected automatically
When you use the service, our hosting provider's infrastructure records standard server logs: IP address, browser and device type, request URL, timestamps, and response status. We use these for security, fault diagnosis and capacity planning. They are held for 30 days (section 9).
We do not use analytics scripts, tracking pixels, session recording, fingerprinting or advertising technology on the application. See section 11 for cookies. Your browser makes no requests to third parties other than Google sign-in and Stripe checkout.
3.4 Data about people who are not our users
Some data we hold is about people who have never signed up, and under UK GDPR Article 14 we owe them an explanation too.
Content creators and communities. To help studios plan outreach, we maintain a registry of video creators, streamers, curators and communities relevant to game genres. Each entry holds a name or channel name, channel URL, audience size and engagement figures, genre focus, and a contact route where the creator has published one. This is compiled from publicly available platform data (the YouTube Data API, Twitch API, Steam Curator pages and the creators' own public profiles). We use it to draft outreach messages for studios; we do not send those messages. The studio decides whether to send, using its own email, and becomes the controller of that correspondence. Our lawful basis is legitimate interests (section 4). If you are a creator and would rather not be listed, email info@game-caster.com and we will remove you and suppress future re-listing. The full notice for creators is at Appendix C.
Developers and publishers. Steam store pages name a game's developer and publisher. For solo developers that is a personal name. We store it as part of the public game profile we build for market research.
Visitors to shared previews. If a studio shares a Steam-page preview link, anyone opening it is subject to section 3.3 (server logs) and nothing else. No account is needed and no cookie is set.
4. Why we use your data and our lawful basis
UK GDPR requires a lawful basis for every use. Ours are:
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Creating and administering your account, signing you in | Account, API keys | Contract (6(1)(b)) — necessary to provide the service you asked for |
| Building plans, generating content, drafting posts and emails, hosting your files | Game and project content, generated content | Contract (6(1)(b)) |
| Posting to channels you have connected | Publishing connections, feed posts | Contract (6(1)(b)) — you instruct each post |
| Charging you, managing subscriptions and credits, handling refunds | Billing, credit ledger | Contract (6(1)(b)) and legal obligation (6(1)(c)) for tax and accounting records |
| Keeping the service secure, preventing abuse, investigating incidents | Technical data, product events, API key usage | Legitimate interests (6(1)(f)) — ours and our users' interest in a secure service |
| Fixing bugs, measuring which features work, deciding what to build | Product events, model usage logs (aggregated wherever possible) | Legitimate interests (6(1)(f)) — running a viable product. We do not profile individuals for this. |
| Controlling AI cost and checking AI output quality | Model usage logs | Legitimate interests (6(1)(f)) |
| Maintaining the creator and community registry | Creator registry (section 3.4) | Legitimate interests (6(1)(f)) of studios in reaching relevant audiences, balanced against creators' expectations given the data is public and professional. A balancing test is on file. |
| Replying to you when you contact us | Feedback and support | Legitimate interests (6(1)(f)) |
| Responding to legal requests, defending claims | Any relevant data | Legal obligation (6(1)(c)) or legitimate interests (6(1)(f)) |
| Analytics cookies on the marketing website (section 11); marketing emails, if we introduce them | Website usage data, email | Consent (6(1)(a)) — asked for in the cookie banner or separately, withdrawable at any time. We send no marketing emails today. |
Where we rely on legitimate interests you have the right to object (section 10). Where we rely on consent you can withdraw it at any time without affecting what was done before.
5. How we use AI
Game Caster produces plans, text and images using large language and image models operated by third-party providers (listed in Appendix A). To do that, we send them the content needed for the task: your game description, extracted design-document text, the prompt you typed, reference images, and the relevant parts of your existing plan.
What you should know:
- Your content is not used to train models. Our providers act as our processors under contract terms that prohibit using your content to train their models. (fal.ai may use de-identified data that cannot be linked to you or your game to improve its service.)
- Providers do not keep your content beyond what is needed to respond, other than short-term retention for abuse and safety monitoring where their terms provide for it (typically up to 30 days).
- Where the providers are. We choose EU regions where the provider offers them. Providers in the US are covered by the transfer safeguards in section 8. We do not send your content to providers outside the UK, EEA or US.
- No automated decisions with legal effect. Nothing the AI produces decides anything about you as a person, your rights, or your access to the service (UK GDPR Article 22 does not apply). Outputs are drafts for you to accept, edit or discard.
- Outreach stays human. The service drafts creator emails; you read and send them yourself.
6. Who we share data with
We do not sell personal data and we do not share it with advertisers.
Service providers (processors). Companies that process data on our instructions to run the service: cloud hosting, AI model providers, payment processing, and our engineering contractor. Each is bound by a written data processing agreement meeting UK GDPR Article 28. The current list, with locations and the data each receives, is Appendix A. We update Appendix A when a provider changes and will notify account holders by email of any change that materially affects where or how your data is processed.
Platforms you connect. When you connect X, Bluesky or Discord and instruct a post, we send the post content and your credentials to that platform. From that point the platform's own privacy policy governs. They are independent controllers, not our processors.
Google. Signing in with Google means Google knows you use Game Caster. Google's privacy policy governs Google's own processing.
Stripe. Handles payments as an independent controller for its own regulatory obligations (fraud prevention, financial regulation) and as our processor for the rest. Stripe emails receipts directly.
People at Game Caster. Directors and staff can access production data when needed to operate, support or debug the service. Access is limited to what the task requires, under confidentiality obligations. A user-management panel showing email, plan, credit balance and activity is restricted to the company's owners.
Legal and corporate. We will disclose data where the law requires it, to enforce our terms, or to protect the rights and safety of users or the public. If Game Caster is acquired or merges, your data may transfer to the successor, who must honour this policy.
7. Where your data is stored
Our application, database and file storage run on Google Cloud in the europe-west1 region (Belgium), inside the EEA. Backups stay in the same region. The UK government recognises the EEA as providing adequate protection, so no additional transfer safeguard is needed for this hosting.
8. International transfers
Some providers in Appendix A are in the United States. When data goes to them we rely on one of the safeguards approved under UK law:
- the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), for providers certified under it; or
- the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
We do not transfer personal data to any country outside the UK, EEA or US. You can ask us for a copy of the relevant safeguard at info@game-caster.com.
9. How long we keep your data
| Data | Retention |
|---|---|
| Account details | For as long as you hold an account, then deleted within 30 days of account closure |
| Game and project content, uploaded files, generated content | Until you delete the item, the project, or your account; then deleted within 30 days, including earlier versions of files |
| Publishing connections | Until you remove the connection (email us and we will remove it) or close your account |
| API keys | Active keys until you revoke them; revoked keys are kept as inactive records until your account is deleted |
| Product events | For the life of your account, then deleted with it. We intend to shorten this to 24 months. |
| Model usage logs | For the life of your account, then deleted with it. We intend to shorten this to 12 months. |
| Publish records | Life of the project |
| Credit ledger, subscription records, Stripe identifiers | 6 years after the transaction, as required by UK tax and company law |
| Server logs (IP address, user agent) | 30 days |
| Support correspondence | 2 years after the last message |
| Creator and community registry | Reviewed at least annually; an entry is removed on request or when it is no longer accurate |
When we delete data we remove it from live systems and it drops out of backups on the backup rotation, within 30 days. Where we are obliged to keep something for longer (for example accounting records) we keep only what the obligation requires.
10. Your rights
Under UK GDPR you have the right to:
| Right | What it means |
|---|---|
| Access | Get a copy of the personal data we hold about you and information about how we use it |
| Rectification | Have inaccurate data corrected. Your name and picture come from Google; change them there and sign in again. |
| Erasure | Have your data deleted. Use the delete-account control in Settings or email us. We will keep only what the law obliges us to (section 9). |
| Restriction | Ask us to stop using your data while a dispute about it is resolved |
| Portability | Receive your content and account data in a machine-readable format. Email us and we will send you an export. |
| Object | Object to any use based on legitimate interests. We will stop unless we can show compelling grounds. Creators can object to being in the registry at any time (Appendix C). |
| Withdraw consent | Where we rely on consent, withdraw it at any time |
To exercise a right, email info@game-caster.com with "Privacy" in the subject line. We will respond within one month, extendable by two further months for complex requests (we will tell you if so). We may ask you to confirm your identity, usually by writing from the email address on your account. There is no fee unless a request is manifestly unfounded or excessive.
If you are unhappy with how we handle your data or your request, please tell us first so we can put it right. You also have the right to complain to the UK regulator at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF · ico.org.uk/make-a-complaint · 0303 123 1113
If you are in the EEA you may also complain to your local supervisory authority.
11. Cookies
We use only cookies that are strictly necessary to operate the service, which the Privacy and Electronic Communications Regulations (PECR) allow without consent. We set no analytics, advertising or third-party cookies, and no consent banner is shown because nothing requires one. If we ever add optional cookies we will ask first.
The full list is in Appendix B. Blocking the session cookie will prevent you from signing in.
Marketing website (game-caster.com). The website uses Google Analytics to count visits and see which pages are read. It is loaded, and its cookies are set, only after you choose “Accept analytics” in the cookie banner shown on your first visit; if you reject, nothing from Google is loaded and the site sets only the cookies needed to serve it. You can change your choice from the banner at any time. The website also uses Framer's built-in page-view counter, which sets no cookies and creates no persistent identifier. The website never sees anything you do inside the application.
12. Security
Game Caster holds unreleased game design documents, so we treat every studio's data as confidential and keep it separate from every other studio's. We protect your data with:
- Sign-in without passwords. Sign-in is Google OAuth only, so there is no Game Caster password to leak. Programmatic access uses per-user API keys that can be revoked instantly.
- Isolation between studios. Every read and write is scoped to the signed-in account. Asking for another studio's project, file or generation returns "not found"; we do not even confirm it exists. Automated tests check this on every change.
- Encryption in transit. All traffic to the application uses HTTPS (TLS 1.2 or later).
- Encryption at rest. The database, file storage and backups are encrypted at rest using Google-managed keys.
- Private file storage. Your uploaded and generated files live in private storage buckets with public access blocked. Files are served only through the application after an ownership check, or through links that expire within hours. Share links for store-page previews use unguessable tokens you can revoke.
- Encrypted credentials. Tokens and passwords for channels you connect are encrypted with AES-256-GCM under a key held separately from the application secrets.
- Hashed API keys. We store a SHA-256 hash of each API key, not the key. If you lose a key, it cannot be recovered; you create a new one.
- Secrets management and keyless deployment. Production secrets are held in Google Secret Manager and injected at deploy time; none are in the codebase. Deployments authenticate without long-lived credentials.
- No third-party scripts. The application loads no analytics, tracking pixels, third-party fonts or advertising technology. Your browser talks to us, Google sign-in and Stripe checkout, nothing else.
- Restricted access. Production access is limited to named people with an operational need, under confidentiality obligations. The owner-only administration panel is the only interface that lists users.
Reporting a vulnerability. Email info@game-caster.com with "Security" in the subject line, what you found and how to reproduce it. We will acknowledge within two working days and keep you informed. We will not take action against good-faith research that avoids privacy violations, data destruction and service disruption; please give us reasonable time to fix before disclosing.
If something goes wrong. No system is perfectly secure. If we discover a personal-data breach that is likely to put you at risk, we will tell you without undue delay and report it to the ICO within 72 hours where required.
13. Shared previews and public links
If you create a share link for a Steam page preview, anyone with the link can view that preview without signing in. The link is unguessable, but it is not private: treat it like any other public URL. You can revoke the link at any time from the Steam page editor, after which it stops working immediately.
14. Changes to this policy
We will post any changes here with a new version number and effective date. For material changes, such as a new category of data, a new purpose, or a processor in a new country, we will email account holders at least 14 days before the change takes effect. The version history is kept at the end of this document.
15. Contact
Game Caster Ltd, 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom · info@game-caster.com
Appendix A — Sub-processors
Entities that process personal data on our behalf. "Data" is what the provider receives; none receives more than listed. Transfer mechanism applies where the provider is outside the UK/EEA.
| Provider | Entity and location | Purpose | Data received | Transfer safeguard |
|---|---|---|---|---|
| Google Cloud Platform | Google Cloud EMEA Ltd, Ireland; data in europe-west1, Belgium |
Application hosting, database, file storage, secrets, server logs | All data in this policy | Not needed (EEA) |
| Google (Sign in with Google) | Google Ireland Ltd / Google LLC, USA | Authentication | Email, name, profile picture | UK-US data bridge |
| Anthropic | Anthropic, PBC, USA | Text generation (plans, posts, outreach drafts, store copy, visual-style briefs) and image understanding | Prompts, game content, reference images | UK Addendum to the EU Standard Contractual Clauses, in Anthropic's Data Processing Addendum |
| fal.ai | Features and Labels Inc., USA | Image, video, music and 3D generation | Prompts, reference images | EU Standard Contractual Clauses with the UK Addendum, in fal's Data Processing Addendum |
| Stripe | Stripe Payments UK Ltd, UK / Stripe Inc., USA | Payments, subscriptions, invoices | Email, name, account ID; card details collected by Stripe directly | UK-US data bridge |
| Jina AI | Jina AI GmbH, Germany | Fetching and rendering the public website URL you provide when building a plan | The URL you supply and the public page content; no account or personal data | Not applicable: no personal data is sent |
Not sub-processors, but data sources: Steam (Valve), SteamSpy and Games-Popularity supply public game and market data; we send them only game identifiers, never personal data.
Independent controllers you connect at your option: X Corp., Bluesky Social PBC, Discord Inc.
Appendix B — Cookies
All cookies are first-party and strictly necessary unless stated. Names shown are the production names.
| Cookie | Purpose | Lifetime | Type |
|---|---|---|---|
__Secure-authjs.session-token |
Keeps you signed in. Contains an encrypted token with your account ID and email. | 30 days | Strictly necessary |
__Host-authjs.csrf-token |
Protects sign-in forms against cross-site request forgery | Session | Strictly necessary |
__Secure-authjs.callback-url |
Returns you to the page you wanted after signing in | Session | Strictly necessary |
__Secure-authjs.pkce.code_verifier, __Secure-authjs.state |
Secure the Google sign-in handshake | Minutes, deleted after sign-in | Strictly necessary |
gc_x_oauth |
Secures the X account connection handshake and returns you to the right project | 10 minutes | Strictly necessary |
sidebar_state |
Remembers whether you collapsed the sidebar | 7 days | Functional (no personal data) |
Appendix C — Notice for content creators and communities
This is the notice we provide under UK GDPR Article 14 to people listed in the Game Caster creator and community registry.
Who we are. Game Caster Ltd (company 16913352, London). Contact: info@game-caster.com.
What we hold about you. Your public name or channel name, channel URL, public audience and engagement figures, the game genres you cover, and a contact route only where you have published one on your channel or website.
Where it came from. Public platform data: the YouTube Data API, the Twitch API, Steam Curator pages, and your own public profile pages.
Why. Game studios use Game Caster to plan how to reach audiences for their games. We use the registry to suggest relevant creators and to draft an outreach message the studio may choose to send. We do not send messages ourselves and we do not share the registry as a list.
Lawful basis. Legitimate interests (UK GDPR Article 6(1)(f)): studios have a legitimate interest in finding relevant creators, and the data is professional and already public. We have documented a balancing test and concluded the impact on you is minimal.
How long. Reviewed at least annually; removed when no longer accurate, or on request.
Your rights. You can ask what we hold, have it corrected or deleted, or object to being listed at all. Email info@game-caster.com. If you object we will remove you and add you to a suppression list so you are not re-listed. You can also complain to the ICO (ico.org.uk).