Slot Creator by Code Creations
GDPR statement and data removal requests
The short version
- Eight Galaxies, trading as Code Creations, is the controller of the personal data we hold about Slot Creator users.
- If you are in the European Economic Area, the United Kingdom or Switzerland, you have rights over that data, including the right to have it erased.
- The quickest way to delete your whole account is in Studio: sign in, open Account and use Delete account. It deletes your account and everything in it immediately.
- To remove only some of your data, to ask for a copy, or if you cannot sign in, email legal@8galaxies.com from the email address on your account with the subject "Data removal request". There is no form to fill in.
- We confirm an emailed request came from you, then act within one month. Backups are purged within 14 days of deletion.
- Making a request is free.
This statement supplements our Privacy Policy, which gives the full detail.
1. Who is responsible for your data
1.1 The controller of your personal data is Eight Galaxies, trading as Code Creations ("Eight Galaxies", "we", "us" or "our"), 254 Chapman Road, Newark, Delaware, USA.
1.2 Contact: legal@8galaxies.com.
1.3 Eight Galaxies has not appointed a representative in the European Union or the United Kingdom.
2. Who this statement covers
2.1 This statement applies to you if you are in the European Economic Area (EEA), the United Kingdom or Switzerland and we process your personal data because you visit Slot Creator, create or use an account, or contact us. It reflects the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection.
2.2 It supplements the Privacy Policy, which describes in full what we collect, why, who processes it for us, how long we keep it and how we protect it. If this statement and the Privacy Policy appear to conflict, the one that gives you more protection applies. Capitalised terms not defined here have the meanings given in the Terms & Conditions.
2.3 The data removal process in section 5 is open to every Slot Creator user, wherever you live.
2.4 This statement does not cover data held on your own device, such as creator drafts and artwork cached in your browser or data stored by the Desktop App, which we cannot access. It also does not cover games that creators publish on other platforms, or data that an AI Provider holds under your own agreement with it.
3. Your personal data and our legal bases
| Personal data | Why we use it | Legal basis |
|---|---|---|
| Account data: email address, display name and password (stored only as a salted hash) | Creating and running your account and signing you in | Performance of our contract with you |
| Projects, project settings and uploaded artwork | Storing, saving, duplicating and exporting your work | Performance of our contract with you |
| AI studio settings, your encrypted AI Provider key, AI job briefs and generated items | Running the AI jobs you ask for with your own key | Performance of our contract with you |
| Session records and, once password reset is available, password-reset tokens | Keeping you signed in and keeping your account secure | Performance of our contract with you; our legitimate interests in security |
| IP address (or IPv6 /64 network), failed sign-in counters keyed by a hash of the email entered, and technical logs | Rate limiting, sign-in lockouts, abuse prevention, security and debugging | Our legitimate interests in keeping the Service and its users secure |
| Your messages to us, including rights requests | Answering you and keeping a record of how we handled your request | Our legitimate interests; compliance with legal obligations |
| Billing records, only if paid plans are ever launched | Billing, invoicing and tax records | Performance of our contract with you; compliance with legal obligations |
We use only essential cookies and do not use your data for advertising, profiling or training AI models. See sections 3, 4 and 9 of the Privacy Policy for detail.
4. Your rights
Subject to the conditions and exceptions set out in the law, you have the right to:
- Access: ask whether we process your personal data and receive a copy of it, with information about how we use it.
- Rectification: have inaccurate data corrected and incomplete data completed.
- Erasure: have your data deleted, for example when it is no longer needed or you object and we have no overriding grounds to keep it. Section 5 explains how.
- Restriction: ask us to limit how we use your data, for example while we check its accuracy.
- Portability: receive the data you gave us, which we process by automated means under our contract with you, in a structured, commonly used and machine-readable format, and have it sent to another controller where that is technically feasible.
- Objection: object to processing based on our legitimate interests, on grounds relating to your particular situation.
- Withdrawing consent: withdraw any consent you have given, at any time, without affecting processing that took place before. We do not currently rely on consent to provide the Service.
- Automated decisions: not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you. We make no such decisions. Rate limits and sign-in lockouts are temporary automated security measures that do not have those effects; if you think one has affected you in error, contact us.
- Complaint: complain to a data protection supervisory authority (see section 13).
5. How to ask us to remove your data
5.1 Delete your account yourself. The quickest way to remove your whole account is in Studio: sign in, open Account, go to Delete account, enter your password, type DELETE and confirm. Your account and everything listed in section 8.1 are deleted immediately, and you are signed out on every device. This cannot be undone.
5.2 Email us. Email us instead if you want only some of your data removed, want a copy of your data before it is deleted, or cannot sign in. To make a data removal (erasure) request by email:
- Email legal@8galaxies.com from the email address on your Slot Creator account.
- Use the subject line Data removal request.
- Include your account email address, your display name, and what you want removed: your whole account, or the names of specific projects or artwork.
5.3 This link opens a pre-filled email in your email app:
5.4 If the link does not work on your device, copy this template into a new email:
To: legal@8galaxies.com Subject: Data removal request Account email address: Display name: What I want removed (my whole account, or the names of specific projects or artwork): I am sending this request from the email address on my Slot Creator account.
5.5 There is no form to fill in, and you do not need to give a reason for an erasure request.
5.6 If you no longer have access to your account email address, email us from another address and explain. We will ask for other information to confirm the account is yours and use it only for that purpose.
6. Confirming it is you
6.1 Before we act on an emailed request to delete or disclose anything, we confirm that the request came from the email address on the account. If a request arrives from a different address, we reply to the account email address and ask you to confirm the request from there.
6.2 We do not act on a request until it is confirmed. If we cannot confirm that a request came from the account holder, we will tell you and explain why we cannot act on it.
6.3 We use any information you give us to confirm your identity only for that purpose, and we do not ask for more than we need.
6.4 When you delete your account yourself in Studio, signing in and entering your password confirms that it is you, so no further check is needed.
7. How long we take
7.1 We respond to an emailed request without undue delay and within one month of receiving it.
7.2 If a request is complex, or you have made several requests, we may extend that period by up to two further months. If we do, we will tell you within the first month and explain why.
7.3 If we decide not to act on a request, in whole or in part, we will tell you why within one month and explain your right to complain to a supervisory authority and to seek a judicial remedy.
7.4 Deleting your account yourself in Studio takes effect immediately.
8. What we delete
8.1 When you delete your account yourself in Studio, or we act on a request to delete your whole account, we delete:
- your account, including your email address, display name and password hash;
- all of your sessions, which signs you out everywhere;
- any password-reset tokens;
- your projects and all project data;
- the artwork you uploaded and its metadata, which are removed from private storage;
- your AI studio settings and your encrypted AI Provider key, together with your AI job records and generated items, and we stop any AI job that is still running;
- the plan and invoice records on your account. Paid plans have not launched, so these records never involve a payment to us (see section 9).
8.2 If you ask us to remove specific projects or artwork, we delete only those items and keep the rest of your account.
8.3 Deleted data can remain in our providers' backups until the backups are overwritten or purged, which happens within 14 days of deletion. We do not restore deleted data from backups except to recover from a failure, and if that ever happens we delete your data again.
8.4 Rate-limit and failed sign-in counters expire automatically within 30 minutes. The counters kept for your account are also removed when you delete your account yourself; failed sign-in counters are kept under a keyed hash of the email address entered, are not linked to any account, and simply expire.
8.5 We cannot delete data outside our systems. To remove creator drafts and cached artwork from your browser, clear this site's data in your browser settings; on the hosted site, signing out or deleting your account in Studio also removes them. To remove Desktop App data, delete it from your device. For data an AI Provider holds under your own key, or games you have published elsewhere, contact that provider or platform.
9. What we may keep, and why
9.1 We may keep some information after a removal request, but only where the law allows, only for the following purposes, and only for as long as needed:
- Records required by law: information we must keep to comply with a legal obligation, such as a lawful request from a public authority.
- Billing records: if paid plans are ever launched and you have paid us, invoices and payment records for as long as tax and accounting laws require.
- Security and technical logs: request logs held for the limited period set by our hosting provider's log retention, as described in section 7 of the Privacy Policy. They are designed to omit email addresses, cookies and request bodies.
- Legal claims: information needed to establish, exercise or defend legal claims.
- A record of your request: your request and our reply, so that we can show that we handled it properly.
9.2 We will tell you in our reply if we keep anything, and why.
10. Our processors and international transfers
10.1 Service providers process personal data for us: Vercel for hosting and private artwork storage, Neon for our database, Resend for transactional email once that feature is enabled, and payment processors if paid plans are ever launched. They process that data on our instructions, and when we delete your data we instruct them to delete it too.
10.2 These providers store and process personal data in the United States. For transfers of personal data from the EEA, the United Kingdom or Switzerland, we rely on appropriate safeguards recognised by the GDPR, the UK GDPR and Swiss law, as described in section 6 of the Privacy Policy. You can ask us for more information about these safeguards at legal@8galaxies.com.
10.3 AI Providers such as Anthropic and OpenAI receive a project brief only when you run an AI job with your own key, and they process it under your own agreement with them. We cannot delete data they hold, so contact them directly.
11. Access, copies and other requests
11.1 To ask for access to your data or a copy of it, use the same route: email legal@8galaxies.com from the email address on your account with the subject Data access request, and include your account email address and display name.
11.2 For any other right, such as rectification, restriction, portability or objection, email the same address from your account email address and say which right you want to exercise and what it concerns.
11.3 The identity check in section 6 and the timescales in section 7 apply to every request.
12. No fee
We do not charge for requests. We may charge a reasonable fee based on our administrative costs, or refuse to act, only where a request is manifestly unfounded or excessive, for example because it is repetitive, and we will explain why.
13. Complaints
13.1 We would like the chance to resolve your concern first, so please contact us at legal@8galaxies.com.
13.2 You also have the right to complain to a supervisory authority, in particular where you live or work or where you believe an infringement took place:
- in the EEA, your national data protection authority, listed by the European Data Protection Board;
- in the United Kingdom, the Information Commissioner's Office; and
- in Switzerland, the Federal Data Protection and Information Commissioner.
14. Changes and contact
14.1 We may update this statement from time to time. We will publish the updated version with a new "last updated" date and give notice of material changes as described in section 14 of the Privacy Policy.
14.2 Eight Galaxies, 254 Chapman Road, Newark, Delaware, USA. Email: legal@8galaxies.com.