Skip to content
00Legal

Privacy & Cookie Policy

Last updated: 18 September 2026

This policy explains which personal data www.kalos451.com (the “site”) processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Italian law.

1. Who is responsible

The data controller is Gabriele Caloggero, 3D character artist operating as Kalos451, Italy. Contact: the contact form.

2. What data is processed and why

Contact form (“Send the brief”). Name, email address, type of work and the text of your brief. They are used only to answer your request and, if you ask for it, to prepare a quote. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). The message is delivered by email to the controller’s mailbox.

“Are you human?” check. To keep spam out, the contact form asks you to pass a check before the brief can be sent. When it runs on Cloudflare Turnstile (Cloudflare, Inc.), the Turnstile script loads on the contact page and Cloudflare receives technical data such as your IP address and browser and device characteristics, used only to tell people from automated traffic. It does not set advertising or tracking cookies. While Turnstile is not configured, the check is a simple sum verified on this server and nothing is sent to Cloudflare. Legal basis: legitimate interest in protecting the site from abuse (Art. 6(1)(f) GDPR).

Althera playtest. The playtest is protected by a password. When you play, the site stores anonymous game data only: the moves the AI learns from, match results and aggregate counters (matches played, number of playtesters). Your browser keeps a random identifier, your access token and your language choice in local storage so that you do not have to log in again and so that playtesters can be counted once. None of this identifies you by name. Legal basis: legitimate interest in testing and improving the game (Art. 6(1)(f) GDPR).

Feedback form. The “Leave feedback” button opens a Google Form on Google’s website. Anything you type there is collected by Google Forms under Google’s own privacy policy.

Security and technical logs. To keep the site safe, the server and the hosting provider process technical data such as IP address, browser type and time of request. The IP address is also used, in a pseudonymised form and for at most one hour, to limit repeated password attempts and form submissions. Legal basis: legitimate interest in the security of the site (Art. 6(1)(f) GDPR).

3. Cookies and local storage

The site uses only technical storage that is necessary for it to work. There are no analytics, advertising or profiling cookies, so no consent banner is needed.

  • WordPress login cookies — only for the site administrator.
  • Shop cookies (cart and session) — only on shop, cart and checkout pages, and only when you use them.
  • Local storage for the Althera playtest — access token (valid 60 days), random player identifier, language choice. You can delete them at any time by clearing your browser’s site data.

Fonts and scripts are served from this site’s own server, so visiting a page does not send your IP address to third-party font or script providers. The one exception is the Cloudflare Turnstile script on the contact page, described above.

4. Who receives the data

  • Aruba S.p.A. (Italy) — web hosting provider, acting as data processor.
  • Google — the controller’s email service (Gmail) receives contact form messages; Google Forms receives the feedback you choose to send. Google may process data outside the European Economic Area under the safeguards provided by the GDPR (EU–US Data Privacy Framework and standard contractual clauses).
  • Cloudflare, Inc. — runs the “Are you human?” check on the contact form when Turnstile is active. Cloudflare may process data outside the European Economic Area under the safeguards provided by the GDPR (EU–US Data Privacy Framework and standard contractual clauses).

Data is never sold or shared for marketing purposes.

5. How long data is kept

  • Contact messages: for as long as the conversation or the resulting work requires, and in any case no longer than 24 months after the last contact, unless a longer period is required by law (for example tax records).
  • Security counters linked to IP addresses: at most 1 hour.
  • Playtest statistics: anonymous, kept for the duration of the game’s development.
  • Playtest data in your browser: until you clear it; the access token expires after 60 days.

6. Your rights

You can ask at any time to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format (Articles 15–22 GDPR). Write to the contact form. You also have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali.

7. Changes

This policy may be updated when the site changes. The date at the top shows the latest version.

Brief received Reply within 48 hours.