Privacy Notice

Data Controller & DPO Contact

The data controller responsible for your personal information on merlinplayhub.com is Merlin Play Hub Observatory Ltd, registered at 100 Bishopsgate, London, EC2N 4AG, United Kingdom.

For any privacy-related requests, subject access inquiries, or data erasure notices, contact our Data Protection Officer directly at dpo@merlinplayhub.com or by telephone on +44 7873 234567.

Categories of Data We Collect

Because Merlin Play Hub operates strictly with fictional Play Credits and never processes financial payments, we collect only the minimum data required to run your scholar profile and verify adult eligibility:

• Account Identity Data: Your email address, chosen Screen Name (`2–30` characters), and date of birth (used to verify 18+ age eligibility).
• Security Credentials: A cryptographic one-way hash of your password generated via PHP's password_hash(PASSWORD_DEFAULT). We never store plain-text passwords.
• Observatory Preferences & Ledger Records: Your selected lighting scene (observatory, vellum, or crucible), session reminder interval (`15–60` minutes), active Account Break timestamp (if any), and your server-side Play Credit Ledger history.
• Support Correspondence: Your name, reply email, topic, message body, and generated Reference ID when you submit a form on our Support page.

Lawful Bases & Purposes of Processing

Under Article 6(1) of the UK GDPR, we rely on the following lawful bases:

• Performance of a Contract (Art. 6(1)(b)): To register and authenticate your scholar account, maintain your 100,000 Play Credit Ledger, and deliver the browser simulations you request.
• Legitimate Interests & Age Governance (Art. 6(1)(f)): To verify that users are aged 18 or older, enforce self-imposed Account Breaks, and protect our server archives against automated abuse.
• Explicit Consent (Art. 6(1)(a)): For optional analytics telemetry controlled via Google Consent Mode v2, which defaults to denied until you actively opt in.

Storage Security & Retention Periods

Account and support records are stored in access-restricted server archives protected by exclusive file locking (flock(LOCK_EX)) and HTTP directory denial rules.

We retain active scholar account records for the duration of your membership. If you request account deletion—and provided your account is not currently mid-way through a self-imposed Account Break—we erase your account record within 14 days. Support inquiry dispatches are retained for 12 months to resolve follow-up questions.

Third-Party Game Streams & Consent Mode v2

When an authenticated scholar opens a simulation chamber on play.php, your browser loads an embedded <iframe> directly from the game studio's demonstration server. As part of standard HTTPS delivery, the studio server receives your browser's IP address and user-agent string to stream the game assets.

On our own domain, Google Consent Mode v2 is initialized in every page header with analytics_storage, ad_storage, ad_user_data, and ad_personalization set to denied by default. You can change your analytics preference at any time on our Cookie Preferences page.

Your UK GDPR Rights & How to Exercise Them

Under UK data protection law, you have the right to:

• Request a copy of the personal data and Credit Ledger entries we hold about you (Right of Access).
• Request correction of inaccurate account details (Right to Rectification).
• Request erasure of your scholar profile (Right to Erasure).
• Withdraw optional analytics consent at any moment without affecting your access to the platform.

To exercise any of these rights, email dpo@merlinplayhub.com or submit a UK GDPR request through our Support Centre. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).