Privacy Policy

1. Who is responsible for your data

The data controller is Berihime Studio, Enkeltmandsvirksomhed (ENK) — Danish sole proprietorship, registered in the Danish Central Business Register (CVR) under number 46254244, EU VAT DK46254244, with its registered office at Jenny Kammersgaards Vej 17, 2. th, 8700 Horsens, Denmark. You can reach us at info@berihimestudio.com.

We have not appointed a Data Protection Officer, because our processing does not meet the criteria in Article 37 GDPR. Data protection questions go to the address above and are answered by the company.

2. What we collect, why, and on what legal basis

2.1 Developer pitch form

Required fields: studio or company name, contact person, email address, game title, genre, target platforms and your message. We use them to read your submission and reply to it. Legal basis: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract.

Optional fields: development stage, estimated budget band and a link to your deck or build. They help us assess a project properly. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in evaluating submissions on the basis of adequate information. Leaving them empty does not affect whether we read your pitch.

Optional tick-box: if you tick it, we may keep your details to contact you about future publishing opportunities. Legal basis: Article 6(1)(a) GDPR — consent. It is never required to submit, it is never pre-ticked, and you can withdraw it at any time by writing to us; withdrawal does not affect processing carried out before it.

We store the legal basis that applied to each submission, and the version of the privacy notice you were shown, on the record itself.

2.2 Contact form

Name, email address, subject and message. Legal basis: Article 6(1)(b) GDPR where you are asking about a possible publishing relationship, and otherwise Article 6(1)(f) GDPR — our legitimate interest in answering business correspondence addressed to us.

2.3 Anti-abuse and security

To stop automated abuse of the forms, we store a salted one-way hash of your IP address together with a timestamp. The hash cannot be reversed to an address, and the address itself is never written to the database or to our application log. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in keeping the service available and free of abuse. These records expire automatically within a rolling window of minutes.

2.4 What we do not do

We do not sell personal data. We do not share it for anyone else’s advertising. We do not build profiles, and we carry out no automated decision-making within the meaning of Article 22 GDPR. We do not use any third-party analytics service, CRM, chat widget, social plug-in, content delivery network or externally hosted font on this website.

3. Cookies and Microsoft Consent Mode v2

This site sets no advertising or analytics cookie before you consent. Microsoft Consent Mode v2 is initialised with ad_storage denied by default, before any tag could load, and only your acceptance changes that signal. The full inventory of every cookie and storage item is in the Cookie Policy.

4. Who else sees your data

Your data is handled by Berihime Studio and by the hosting provider that operates the server on our instruction, under a data processing agreement meeting Article 28 GDPR. We use no other processor for the data you submit here. If you consent to advertising measurement, Microsoft Ireland Operations Limited acts as an independent controller for the measurement data collected by its UET tag; that is described in the Cookie Policy.

5. Hosting and international transfers

This website and its API run on a virtual server operated by Namecheap, Inc., located in Los Angeles, California, United States. The location was measured on the server itself on 2026-09-23, not taken from a provider brochure. Everything you submit through a form on this site is stored in a database on that same machine.

The United States is outside the European Economic Area, so sending your data there is a transfer to a third country under Chapter V of the GDPR. Namecheap, Inc. is not certified under the EU-U.S. Data Privacy Framework as far as we could establish, so we do not rely on that adequacy decision. The transfer rests on Article 46(2)(c) GDPR: the Standard Contractual Clauses adopted by the European Commission, which are incorporated in the hosting provider’s Data Processing Addendum. Your data is stored on a server we administer ourselves; the provider supplies the machine and the network, not access to the database. You may ask us for a copy of the safeguards at the address in section 1.

We do not describe this website as EU-hosted, EEA-hosted or subject to EU data residency, because the machine serving it is in the United States. The company itself, Berihime Studio, is registered and established in Denmark.

6. How long we keep it

• Pitch submissions: 12 months from receipt.
• Pitch submissions where you ticked the future-contact box: 36 months, or until you withdraw consent, whichever comes first.
• Contact messages: 12 months after the exchange ends.
• Rate-limiting hashes: a rolling window measured in minutes.
• Your cookie-consent record: stored in your own browser until you clear it or change your choice.

Each stored record carries the date on which it must be deleted, and a scheduled job on the server removes expired records. Retention is enforced by that job, not by anyone remembering to run it. Records needed to comply with Danish bookkeeping law, or to establish or defend a legal claim, are kept for the period that law requires and for no other purpose.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Article 15);
• have inaccurate data corrected (Article 16);
• have data erased (Article 17);
• restrict processing (Article 18);
• receive your data in a portable format (Article 20);
• object at any time to processing based on our legitimate interests, including for the anti-abuse measures described above (Article 21);
• withdraw consent you have given, at any time, without affecting processing already carried out.

Write to info@berihimestudio.com. We answer within one month, as Article 12(3) GDPR requires, and we tell you if we need the extension that article allows. If you are not satisfied you may complain to Datatilsynet, the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark.

8. Security

The site is served over HTTPS with HSTS. Form submissions are protected by a double-submit CSRF token and rate limiting. The database is reachable only from the application server. Access to submitted data is limited to the people at Berihime Studio who need it to answer you. Our application log records that a submission happened and where it was stored — never its contents.

9. Children

This is a business-to-business website addressed to game developers and studios. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us data, write to us and we will delete it.

10. Changes

If this policy changes materially, the revised version is published here with a new review date, and the just-in-time notice beside each form carries its own version identifier so you can tell which text applied when you submitted.