Privacy Policy

Last updated: 26 April 2026

This policy explains what personal data Real-Life Talent Tree collects, why, and what rights you have over it. The data controller is Evangelos Karatzas, an individual based in the United Kingdom, operating this service as a personal project. Contact: [email protected]

What we collect and why

Data	Purpose	Legal basis
Email address	Account creation and transactional emails (password reset, account notices)	Contract performance
Username	Public profile URL and display name	Contract performance
Password	Stored as a one-way hash — never in plain text	Contract performance
Talent trees, paths & talents	Core content you create and optionally share publicly	Contract performance
Session token	Keeps you logged in across page loads; stored in a secure cookie	Legitimate interest
API keys	Hashed — allows programmatic access to your trees	Contract performance
Embed view counts	Anonymous counter per embedded tree — no personal data linked	Legitimate interest

This site sets one cookie: a session cookie that keeps you logged in. It is strictly necessary for the service to function and does not track you across other websites. No analytics, advertising, or third-party tracking cookies are used.

Who we share data with

Your data is not sold or shared with third parties for marketing. The following sub-processors handle infrastructure:

Vercel — hosts the web application (USA; EU SCCs in place)
Railway — hosts the API and database (USA; EU SCCs in place)
Cloudflare — CDN and DDoS protection; proxies traffic (USA; EU SCCs in place)
Resend — transactional email delivery (USA; EU SCCs in place)

Each provider operates under a Data Processing Agreement and Standard Contractual Clauses where applicable under UK GDPR.

How long we keep your data

Account data (email, username, trees) is kept until you delete your account. Session tokens expire automatically. If you delete your account, all associated data — trees, paths, talents, sessions, and API keys — is permanently removed.

Your rights under UK GDPR

Access — request a copy of your personal data
Erasure — delete your account and all associated data at any time from your account settings
Portability — export your talent trees as JSON at any time from the builder
Rectification — correct inaccurate data by updating your profile
Restriction & objection — contact us to restrict processing or object to legitimate-interest processing

To exercise any right, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the ICO (Information Commissioner's Office).

Changes to this policy

If this policy changes materially, registered users will be notified by email. The “last updated” date at the top of this page always reflects the current version.

Contact

Questions or requests: [email protected]