Data controller
PHABDEV di Fabrizio Ferrante — Italian VAT No. 14076150961
Contact: phabdev@gmail.com
Waiting list closed
As of 6 October 2026 this site no longer collects email addresses: the waiting list form has been removed and subscribing is no longer possible. To follow the project you can wishlist Superpower Sandbox on Steam or request Playtest access from the game's Steam page. Steam is a Valve service, which processes data under its own privacy policy.
Data previously collected through the form continues to be handled as described below.
Purpose of processing
Data collected in the past through the subscription form is processed exclusively to manage the Superpower Sandbox waiting list subscription and to send updates about the project's development.
Legal basis
Processing is based on the data subject's explicit consent (Article 6(1)(a) of Regulation (EU) 2016/679 — GDPR), given at subscription time through the site form, since removed. The consent text shown at subscription time is version 2026-09-17; each subscription records the exact text the user consented to and its version.
Data processed
- Email address
- Preferred site language at subscription time
- Date and time of consent, and the consent text version
- Truncated IP address (last octet zeroed for IPv4, last 80 bits zeroed for IPv6), used only for anti-abuse rate limiting
- Confirmation and unsubscribe tokens: never stored in clear text, only as a non-reversible cryptographic hash
Providers and data processors
To manage the data already collected we rely on the following third-party providers, appointed as data processors where applicable:
- Vercel Inc. — hosting, infrastructure and execution of the site's server functions
- Neon Inc. — database where subscriber data is stored
- Resend — delivery of transactional emails (subscription confirmation, unsubscribe)
Some of these providers are located or have infrastructure outside the European Economic Area. In such cases, data transfers rely on the safeguards required by the GDPR (for example the European Commission's Standard Contractual Clauses or equivalent adequacy mechanisms).
Data retention
- Confirmed subscribers' data is kept until the data subject explicitly unsubscribes.
- Unconfirmed ("pending") subscriptions are automatically deleted if not confirmed within 7 days of the request.
- Technical events used for anti-abuse rate limiting are automatically deleted once the relevant time window has elapsed.
Data subject rights
At any time you can:
- access your data and request a copy;
- request correction if it is inaccurate;
- request deletion;
- withdraw consent, with effect for the future, by unsubscribing via the link in every email or by writing to the contact above;
- lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or your local supervisory authority, if you believe the processing violates the GDPR.
No profiling or transfer to third parties
Collected data is not used for automated profiling and is not sold, transferred or disclosed to third parties for third-party marketing purposes.