Privacy Policy

This Privacy Policy explains how personal data is processed in connection with the public legal portal at https://legal.hopelab.eu (“HopeLab Legal”) and how we point you to service-specific information for HopeLab services listed as active on HopeLab Legal (each a “Service”).

This document is an informational draft intended to describe practices clearly. It is not legal advice and does not guarantee complete compliance with the GDPR or any other law. The operator must confirm factual details marked as TODO or placeholders before relying on this Policy in production.

The data controller for HopeLab Legal is:

• Name / legal designation: [Operator Name]
• Contact: [Contact Email]

HopeLab Legal is a static informational site. It does not provide user accounts, and it does not use analytics, advertising, or marketing trackers by default.

When you visit HopeLab Legal, standard technical data may be processed by the hosting infrastructure as part of delivering the website. Depending on the host’s configuration, this can include IP address, timestamps, requested URL, user agent, and similar connection metadata in server or edge logs.

• Purpose: operate and secure the website, diagnose faults, and prevent abuse.
• Legal basis (GDPR Art. 6(1)(f)): legitimate interests in delivering a secure public website.
• Processors: hosting provider for HopeLab Legal — Railway, if and when HopeLab Legal is deployed on Railway as intended.
• Retention: [Hosting Log Retention TODO — confirm Railway / edge log retention actually used].

Active HopeLab Services may process additional personal data (for example account identifiers after Discord OAuth2, user-generated content, or role-based access metadata). Those practices are described on each Service’s page under /services and are not automatically identical across projects.

If no Service is listed as active, only the practices in this Policy for HopeLab Legal itself should be assumed. Draft or unreleased projects are not included in the public service list and should not be treated as live processing activities until activated.

See the Services index for currently active Services and their individual data summaries.

We process personal data only for specified purposes. Legal bases are tied to those purposes:

• Providing HopeLab Legal pages and keeping the site secure — Art. 6(1)(f) legitimate interests.
• Responding to privacy or legal contact requests you send to the configured contact address — Art. 6(1)(b) or (f), depending on the nature of the request; Art. 6(1)(c) where we must respond to exercise of GDPR rights.
• Operating an authenticated Service you choose to use (when active) — Art. 6(1)(b) performance of a contract / requested service, and Art. 6(1)(f) where needed for security and abuse prevention.
• Complying with legal obligations — Art. 6(1)(c).

Depending on configuration, the following categories of providers may process data on our behalf or as independent controllers of their own platforms:

• Hosting for HopeLab Legal: Railway (when used for deployment of this portal).
• Identity providers for specific Services: Discord, when a Service uses Discord OAuth2. Discord processes data under its own terms and privacy policy when you authenticate with Discord.
• Other processors listed on an active Service’s page (for example that Service’s host or storage provider).

Discord’s privacy documentation is available from Discord (see discord.com/privacy). Review Discord’s policies when you use Discord login on a Service.

• Hosting and infrastructure providers acting as processors for HopeLab Legal or a Service.
• Identity providers (for example Discord) when you choose to authenticate through them.
• Authorized operators, administrators, or role holders within a Service as described on that Service’s page (for example GMs where implemented).
• Competent authorities when disclosure is required by law.

Retention periods depend on the system and purpose:

• HopeLab Legal hosting / access logs: [Hosting Log Retention TODO].
• Correspondence sent to the contact email: retained as long as needed to handle the request and for related legitimate record-keeping — [Contact Record Retention TODO].
• Each active Service: see that Service’s page for storage, deletion, export, and backup practices. Backup retention must be confirmed against the real implementation — [Backup Retention TODO].

If personal data is transferred outside the European Economic Area, appropriate safeguards required by applicable law must be in place (for example an adequacy decision or standard contractual clauses), depending on the provider and region.

We apply technical and organisational measures appropriate to the risk, such as HTTPS transport for the public site and access controls on systems we operate. No method of transmission or storage is completely secure. We do not claim absolute security.

HopeLab Legal does not use analytics, advertising, or social-media tracking cookies. The site may rely on strictly technical behaviour provided by the browser or host that is necessary to deliver pages over HTTPS.

Individual Services may use cookies or similar technologies required for authentication sessions. Those will be described on the relevant Service page when the Service is active. This Policy does not add a cookie banner for HopeLab Legal itself.

If the GDPR applies to the processing, you may have the right to request access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. You may also have the right to lodge a complaint with a supervisory authority.

To exercise rights related to HopeLab Legal or an active Service we control, contact [Contact Email]. We may need to verify your identity before fulfilling a request. Where Discord is the source of account data, some requests may also need to be directed to Discord for data it controls independently.

Until age-related rules are confirmed by the operator, do not assume special children’s terms beyond mandatory law.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the date of the latest substantive revision. Material changes should be reviewed before continued use of the Services.

For privacy questions or requests: [Contact Email]

Controller: [Operator Name]