Privacy Notice — MahjCovers

This notice explains how Meneghin Consulting ("MahjCovers", "we", "us"), a sole proprietorship based in British Columbia, Canada, collects and uses personal information when you use the MahjCovers website and tools (the "Service"). We are the data controller for the information we collect about you directly.

1. Information we collect

a) You provide it

Account: name, email, password (hashed by Supabase Auth), and profile information.
Designs: the names, logos, dates, tournament details, and other content you add to your covers.
Club profile (optional): club name, city, contact email, social links, logo.
Support requests: messages and any attachments you send us.

b) Collected automatically

Usage analytics: page views, feature events, IP address, browser, and device. We use this to monitor performance and detect issues.
Cookies and similar tech: a session cookie for authentication; no third-party advertising cookies.

c) From our payment processor

Paddle: when you buy a plan or top-up, Paddle collects and processes your payment details and shares with us a transaction ID, plan, country, tax status, and the email you used. We do not see or store your full card number.

2. How we use your information

To provide and operate the Service (rendering designs, saving them, exporting files).
To manage your account, plan, and quota.
To process payments, renewals, and refunds (via Paddle).
To respond to support requests.
To monitor and improve performance, security, and reliability.
To send transactional emails (receipts, security notices, important Service updates).
To comply with legal obligations (tax, accounting, lawful requests).

3. Legal bases (for users in the EEA/UK)

Contract: to deliver the Service you signed up for.
Legitimate interests: to secure the Service, prevent abuse, and improve features.
Legal obligation: for tax, accounting, and other statutory duties.
Consent: where required (e.g. optional marketing communications, which you can withdraw at any time).

4. Who we share with

We share personal information only with the service providers we need to run MahjCovers:

Supabase — database, authentication, and file storage hosting.
Paddle — payment processing and tax compliance (Merchant of Record).
Hosting / CDN providers — to deliver the Service.
Image generation providers — to render decorative badge artwork from your text prompts (we send the prompt only; we do not send personal account details).
Authorities or successors — where required by law, or in connection with a sale or reorganisation of the business.

We do not sell your personal information and we do not share it with advertising networks.

5. International transfers

Our service providers may process data outside your country (including in the United States and the EU). Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. Retention

Account and design data: kept while your account is active and for a reasonable period after closure to allow reactivation and to meet our records obligations.
Payment and tax records: retained as required by applicable tax law (typically up to 7 years).
Analytics logs: retained for up to 24 months in aggregated form.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal information, and to object to certain processing. To exercise these rights, contact us through our feedback chat. We respond within the timeframes required by applicable law (usually within 30 days). You may also lodge a complaint with your local data protection authority — in Canada, the Office of the Privacy Commissioner.

8. Security

We use industry-standard safeguards including encryption in transit (HTTPS), encryption at rest at our hosting provider, role-based access controls, and row-level security in our database. No system is perfectly secure; please use a strong, unique password and notify us of any suspected unauthorised access.

9. Children

The Service is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. Contact us if you believe a child has provided us with personal information and we will delete it.

10. Changes to this notice

We may update this notice from time to time. Material changes will be communicated by updating the "Last updated" date above and, where appropriate, by email.

11. Contact

Meneghin Consulting (operating as MahjCovers), British Columbia, Canada. For privacy enquiries and general support, please use our feedback chat — it reaches us directly and we'll respond by email.