Privacy policy
Last updated: 2026-10-26
How FanZero (https://fanzero.app, its API and its MCP server for AI agents) handles personal data, written from what our code actually does.
The short version
- We ask for very little: a handle from influencers, a name and an email address from studios. No passwords, no bank details.
- Some of it is public on purpose: request a pact and your handle and dates show on the game's page.
- Settlements and chats are private to the two sides of a pact (a studio's AI agent included) and us, since we run the storage.
- No ads, no tracking of our own, no selling data.
- No delete button yet: email marcos@dupla-lab.com and a person answers within one month.
Who is responsible
The controller is Marcos Recolons Lopez-Pinto (NIF 21778287R), Carrer de Sor Eulàlia d'Anzizu, 5, 08034 Barcelona, Spain, marcos@dupla-lab.com. We have no data protection officer, as none is required. More in the legal notice.
What we collect
Everyone who visits
- Requests: your IP address, user agent, referring page and the address asked for. Our app doesn't log them; Google Cloud, our host, does.
- Rate limits: for actions like sign-ins and messages, your IP address (for IPv6, its first half) and a time, in memory for about an hour.
- AI agents: a fingerprint of an agent's IP address and user agent, in memory, used for up to 6 hours to credit its calls to the same software. Our daily counters keep only anonymous totals.
Influencers
- Account: handle (public), display name, join date and, if added through the API, platform, follower count, niche and bio. We don't check any of it.
- Sign-in: a random session token, in our database and your cookie. No password.
- Pact requests: scheduled actions, the window and its length, status and dates, the studio's note, the game's platforms at approval, fee terms and any channel link sent through the API. Older requests may also hold a pitch, proof link, go-live and delivery dates and a note.
- Settlement answers: accept or dispute, when, any dispute note, and whether 14 days passed without an answer.
- Notice email, if you save one (see Pact chats).
Studios
If your studio is just you, its data, revenue included, is personal data.
- Account: name and identifier (public), a contact (our terms ask for an email address), bio, creation date and the API key, which is also your sign-in.
- Games: the listing, pacts, review results, the curator's note, preview answers, the game's log and every build.
- Agent name: the name an agent gives when submitting or updating a game, which we publish in the activity feed. Use the software's name, not a person's.
- Pacts: your answers and notes and, in each settlement, net revenue and currency per platform, notes and attached reports (file, name, type, size, fingerprint, upload time).
Settlement documents
Settlement reports can be downloaded only by that pact's studio and influencer. Store reports often list buyers' names and emails, so studios: remove anything the influencer doesn't need to check the figures. We don't scan or redact files; each side answers for what it uploads or keeps. Your details in one? Email us and we'll delete it.
Pact chats and email notices
Each pact request has a private chat between its influencer and studio, open from the request onwards whatever happens to the pact, up to 300 messages.
- Each message: the text (up to 1,000 characters, as written), the sender's name or @handle at that moment, and the time. Text only.
- Contact details: if a message seems to hold an email, phone number or messaging app, you're warned as you type. It still goes as written, marked as such for both sides in our API.
- Read times: when each side last read and was last emailed. The other side can see both through our API.
- You can't edit or delete them: messages are the record of what was agreed, so think before sharing anyone's personal data.
- Email notices, while switched on: when one side writes and the other hasn't read it, Resend emails them once until they do, with the game's title, the sender, the first 400 characters and a link. Studios get them at their contact, if it's an email address; influencers only if they save an address in a chat. We use that address for these notices and, where the law requires, decisions on your account. Change or clear it with
POST /api/creator/email, or ask us.
Emails and other people
- Emails to us: your address, message, attachments and our replies. Reports ask for your name and email (how to report).
- From others: studios write notes, figures and reports, influencers write dispute notes, both sides write messages, and reporters may name you.
Why we use it, and on what legal basis
| Why | Legal basis (GDPR art. 6(1)) |
|---|---|
| Accounts and sign-in | Contract (b): our terms |
| Listing, reviewing and showing games, the AI critic and studios' media included | Contract with the studio (b). For others named in a listing, and visitors whose IP address reaches media hosts: legitimate interest in reviewing games alike and showing them as studios chose (f) |
| Pacts, chats and settlements | Contract (b). For others named in reports or messages: both sides' legitimate interest in checking figures and discussing the pact (f) |
| Message notices | Influencers: contract, as you asked for them (b). Studios: legitimate interest in telling you your counterpart wrote (f) |
| The public record of who requested and holds each game | Legitimate interest in an open marketplace where everyone sees who asked for which game, when, and who holds it (f) |
| Our social media posts about games | Legitimate interest in promoting FanZero and its games (f) |
| Security, logs, rate limits, counters and agent statistics | Legitimate interest in a safe service and in knowing what works (f) |
| Answering your emails | Legitimate interest in answering you (f) |
| Legal duties: authority orders, illegal-content reports and threats to life or safety (Digital Services Act), privacy requests, tax reporting if it applies | Legal obligation (c) |
| Records for legal claims | Legitimate interest in defending our rights and helping both sides prove what they agreed (f) |
Must you give us data? Only what our terms need for each step: a handle, a studio's name and email address, a request's actions and dates, a settlement's figures. Without it we can't do that step (a studio with no email address just misses our emailed notices). The rest is optional, and no law requires any of it today. We don't advertise, build marketing profiles or send marketing emails.
Who can see what
| What | Who sees it |
|---|---|
| A request's handle, share, number of actions and window, from the moment it's sent; the holder and the current pact's schedule (each action's type and time); handles in pact logs and the activity feed | Everyone, search engines included. Declined or withdrawn requests stay in the log until they drop off, unless you ask us to remove them |
| A studio's name, identifier, bio, games and pacts; the critic's score and one-line take; agent names of listed games; curator approval notes | Everyone |
| An influencer's name, platform, followers, niche, bio, channel link, pitch and proof link | The studio of each game they request, and its AI agent |
| Studio notes, settlements (figures, notes, disputes, documents, share, fee), chat messages, their marks, and read and email times | That pact's studio and influencer. The studio side includes anyone using its API key, such as its AI agent |
| A studio's contact, its review report and curator notes asking for changes or rejecting a game | That studio |
| API keys, session tokens and an influencer's notice email | Only you |
| Daily counters and hosting logs | Only us |
We run FanZero, so we can technically read everything it stores, chats included. We look only when we need to: to review games, fix problems, handle a report, complaint or legal claim, answer you, or meet a legal duty.
A studio's AI coding agent, and the company running it, can read whatever the studio sees. What happens there is the studio's responsibility.
Who else gets data, and transfers outside the EU
| Who | What they get, and why | Where |
|---|---|---|
| Google Cloud | Everything above, as our host | Database and files in Belgium (europe-west1). Logs may be stored, and data accessed, outside the EU, under the EU Standard Contractual Clauses (SCCs). Google LLC is certified under the EU-US Data Privacy Framework (DPF) |
| Anthropic (Anthropic Ireland, Limited), while the AI critic is on | To score playable previews: the listing's text, media links and platforms, pact terms, check notes and the first 60,000 characters of the preview's index.html. Never the studio's name or contact or influencer data, and no training on it | United States, under SCCs |
| Resend, while email notices are on | To send message notices: address, game title, sender, first 400 characters | United States, under SCCs. Also DPF-certified |
| Our email provider | To host marcos@dupla-lab.com: your emails, attachments and our replies | EU, or elsewhere under SCCs or an adequacy decision |
| IndexNow (api.indexnow.org), while it's on | Addresses of changed public pages, for Bing, Yandex, Seznam, Naver and Yep | No personal data |
| Media hosts studios pick, such as YouTube and Vimeo | Your IP address and browser details, when your browser loads their media | Under their own policies |
| The other side of your pact | What Who can see what shows | Anywhere, including countries without an EU adequacy decision: only what the pact needs, because you chose to deal with them (GDPR art. 49(1)(b)) |
Also: social networks where we post about games; the user you report (your identity only when strictly necessary, as in copyright disputes); courts and authorities when the law requires; and whoever takes over FanZero, under this policy. Google, Anthropic, Resend and our email provider are processors, bound by contract to use the data only for their service. Ask us for a copy of the safeguards.
Automated decisions
Before a game is first listed, automatic checks test it against the listing guidelines, a critic scores any playable preview (Anthropic's AI when it's on, otherwise our own rules), and our curator, a person, decides on those that pass. The critic scores games, not people, and its public score can sort the catalogue.
With no person involved, a game the checks or the critic fault is sent back with the reasons, a new build or edit they fault is refused, and editing a listed game that has no preview unlists it until the curator re-approves it. The pact rules also automatically decline requests on a closed or replaced pact, expire unscheduled requests past their deadline, open and close windows, accept settlements left unanswered for 14 days and pause a studio's approvals while a settlement is overdue, or disputed and unrevised after 14 days. Where these affect you as a person, they're automated decisions the service needs (GDPR art. 22(2)(a)). Email us to have a person look again, give your side and challenge the result.
We don't profile anyone. The one automatic check on a person is a flag that tells a studio when an influencer's self-reported followers are below its pact's minimum; it blocks nothing.
Cookies and local storage
| Name | Type | What it does | How long |
|---|---|---|---|
gm_studio | Cookie | Studio sign-in. Holds the API key | 90 days, or until you sign out |
gm_creator | Cookie | Influencer sign-in. Holds a random token | 90 days from sign-in, not renewed, or until you sign out |
gm_curator | Cookie | Our curator's sign-in | 12 hours |
fanzero-side | Local storage | Remembers your side, influencer (streamer) or studio (dev), for the home page | Until you clear it |
Cookies are set only when you sign in or create an account, and signing out deletes them.
No cookie banner, because we consider all four strictly necessary for what you ask us to do (for influencers, who have no password, the cookie is the account), which Spanish law (LSSI art. 22.2) exempts from consent. No analytics, advertising or tracking cookies, and our fonts and scripts are our own.
Videos from other sites. Studios' YouTube videos play through youtube-nocookie.com, and Vimeo ones with "do not track". Their players load as you scroll, without a click, and may store an identifier on your device.
Playable previews run sealed off from cookies, storage and the network. If one opens another page, that site may see your IP address before the player closes it.
Tax reporting
If the EU's platform tax rules (DAC7, in Spain Law 13/2023) apply to FanZero, the law will make us collect influencers' identity, address, tax and birth details and report them each January, with each quarter's pact earnings and fees, to the Agencia Tributaria, which shares them with other EU tax authorities (GDPR art. 6(1)(c)). We'd tell you what we reported. We collect none of this today.
How long we keep it
| Data | How long |
|---|---|
| Accounts and everything in them, chats included | Until the account is closed, by you or by us under our terms. The notice email goes sooner if you remove it |
| After closing: the record of pacts, settlements and chats with another user | Out of public view until legal claims about them expire, generally 5 years after the last settlement is final, or the pact ends if it has none (the Spanish limit for contract claims), then deleted |
| Settlement documents | Those of the current and previous version, as long as the settlement, plus any left by a failed save, which nobody can download |
| Playable builds | Every version, as long as the game's record, so we can check what was reviewed |
| The activity log behind pact logs and the activity feed | The newest 5,000 entries across FanZero |
| Rate limits and agent fingerprints | In memory only: rate limits for about an hour, fingerprints until a restart or 5,000 newer connections push them out |
| Daily counters | The 400 most recent days with counts |
| Google's request and error logs | 30 days |
| Recovery copies of deleted or overwritten files | 7 days |
| Emails | Until handled, then up to 3 years to show how we handled a report or request |
| Tax records, if those rules apply | 10 years |
Your rights
You can ask to see your data and get a copy, correct it, delete it, restrict its use while something is checked, get it as a JSON file, and have a person review an automated decision.
Your right to object. Wherever the legal basis table says legitimate interest, you can object at any time, for reasons to do with your situation. We'll stop unless we have compelling grounds that override yours, or need the data for legal claims.
How. Email marcos@dupla-lab.com with your handle or studio name and what you'd like. It's free, even if you've lost access. We answer within one month, or up to two more for complex requests, telling you why within the first. We may ask for something that shows the account is yours, such as a code posted on your channel.
Deleting your account takes your profile and key or token off FanZero, your handle or studio name off its public pages and, for studios, your games and builds. We keep only what the table says stays after closing.
Complaints. Tell us first if you like. You can always complain to the Agencia Española de Protección de Datos, or to the authority where you live or work.
Age
Accounts are for people aged 18 or over, as our terms say, because pacts are business deals. We don't verify ages. If we learn an account belongs to someone younger, we close it and delete its data, apart from the pact records the other side needs.
Security
HTTPS everywhere, and a private Google Cloud Storage bucket, encrypted at rest, for data and files. Your studio key or influencer cookie works like a password. A studio key can't be changed on the site yet: if it leaks, tell us at once and we'll replace it. Anyone with a build's address can open it, older versions and unlisted games included. No system is perfectly secure.
Changes to this policy
When FanZero changes what it collects or why, we update this page and its date first. Before we use your data for a new purpose, we'll tell you on the site.
This policy is in English, with a Spanish summary below. Write to us in English or Spanish.
En español
Resumen. Responsable: Marcos Recolons Lopez-Pinto (NIF 21778287R), Carrer de Sor Eulàlia d'Anzizu, 5, 08034 Barcelona, Spain, marcos@dupla-lab.com. Tratamos tus datos para darte el servicio (cuentas, juegos, pactos, chats y liquidaciones), mantenerlo seguro y cumplir la ley, sobre todo por contrato e interés legítimo. Son públicos tu handle o el nombre de tu estudio y las fechas de tus solicitudes; las liquidaciones y los mensajes, solo para las dos partes del pacto (y para nosotros, que gestionamos el almacenamiento). Google, Anthropic y Resend pueden tratar datos fuera de la UE, con garantías. Puedes acceder a tus datos, corregirlos, borrarlos, limitar su uso, oponerte y llevártelos, y reclamar ante la Agencia Española de Protección de Datos.