Version dated 18 September 2026. This English version is provided for information only — the binding version is Polish, see § 13.
This is an English translation of the Polish Privacy Policy (/prywatnosc) provided for convenience. In case of any discrepancy, the Polish version prevails.
The controller of personal data processed in the BannerlordDB service is Bartosz Woźnica, e-mail: contact@bannerlorddb.com. The controller has not appointed a Data Protection Officer — this is not required under Article 37 GDPR.
a) Account data. Username (which may be a pseudonym), password hash, account creation date. We do not collect an e-mail address, name, or any contact details. Passwords are stored only as a PBKDF2-HMAC-SHA256 hash with 120,000 iterations and a per-account random salt — never in plain text.
b) Session. A random session token (32 bytes of
entropy), creation and expiry timestamps. The token is stored in the
browser's local storage (localStorage), not in a cookie,
and sent to the server in a request header.
c) Daily query counter. A subject key, a date, and a count of queries used. For logged-in Users the key is the Account identifier. For Guests it is a browser-generated identifier, plus — for the additional per-IP limit (cf. Terms § 6) — the Guest's IP address.
d) Content saved by the User. Logged-in Users only: chat history, saved character builds, policy sets and smithing sets — entirely generated by the User while using the Service.
e) Web server logs. IP address, timestamp, request path, HTTP status code and User-Agent header — standard access logs produced by the server software.
| Purpose | Legal basis |
|---|---|
| Creating and running the Account, providing the Service | Art. 6(1)(b) GDPR — performance of a contract (the Terms) |
| Enforcing daily query limits, abuse prevention, Service security, server logs | Art. 6(1)(f) GDPR — legitimate interest (protecting the infrastructure and the cost of AI services from abuse) |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) GDPR |
To generate chat answers, the Service uses a language model provided by DeepSeek (by default, model "deepseek-v4-flash") — a provider based in the People's Republic of China, outside the European Economic Area. The European Commission has not issued an adequacy decision for China. The transfer is based on: Article 49(1)(b) GDPR — the transfer is necessary to perform the contract concluded with the User at their own request: without sending the question to the model provider, no answer can be produced. The transfer is occasional and limited to what the User types into the chat.
Only the content of chat messages, the fixed system prompt, and the tool definitions used to query the game's knowledge base are sent to the model provider. We do not send your username, Account identifier, or IP address — no model call includes a User identifier. For this reason, please do not enter personal data or confidential information into the chat (see Terms § 8). The Service may optionally use an OpenAI model (United States) instead of DeepSeek — the same principles apply in that case.
The Service is hosted by: Oracle Cloud Infrastructure (Oracle Corporation), on a server in the Frankfurt am Main region in Germany — that is, within the European Economic Area.
If a user connects their Account with Patreon (Patreon, Inc., United States), the Service receives the patron's account identifier from Patreon together with information about the payment (amount, charge status and date). For the payment itself Patreon is a separate data controller with its own privacy policy. The Service does not send Patreon the username, chat content or IP address.
We do not use analytics tools, advertising services, social media plugins, or third-party CDNs. The typefaces used in the interface are served from our own server rather than Google's — your browser makes no connection to a third party for this purpose.
The Service does not use cookies. Accordingly, we do not display a cookie-consent banner — one is not required where no cookies are used.
We do use browser local storage (localStorage) to hold:
the session token, a Guest identifier, the chosen language and game
database profile, chat history, and draft character/policy plans.
This storage is necessary to provide features the User explicitly
requests (e.g. staying logged in), so it does not require separate
consent. You can clear it at any time by logging out, deleting your
Account (§ 7), or clearing site data in your browser settings.
Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interest (Art. 21).
How to exercise the right to erasure — self-service, no need to contact us:
Other requests (access, rectification, restriction, portability, objection) can be sent to contact@bannerlorddb.com. We respond within one month of receiving the request.
Identity verification. Since we do not collect an e-mail address or other contact details, the only reliable way to verify identity is to log into the Account and use the buttons in the "Account" panel. E-mail requests concerning a specific Account can only be fulfilled to the extent we can reliably verify they come from the entitled person.
You have the right to lodge a complaint with the Polish Data Protection Authority (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl), or with the supervisory authority of your own EU member state.
Providing a username and password is voluntary but necessary to create an Account. The Service can also be used without an Account, as a Guest — except for the chat, which requires logging in (Terms § 6).
We do not carry out profiling or automated decision-making that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).
The Service is not directed at persons under 16 years of age.
We reserve the right to amend this Privacy Policy. The current version is always available at this address, with the date of the last update. The Polish version (/prywatnosc) is the binding version. This English version (/privacy) is provided for information only.