Privacy notice
What Egameno collects, and what happens to it
Draft — not yet legally reviewed
This document describes how the system works today and has been checked against the code. It has not been reviewed by a lawyer, and it must be before Egameno is offered commercially. What is still outstanding is listed at the end.
The short version
Egameno is not open for business yet. The only personal data this site collects is what you type into the request-access form, and the only thing we do with it is decide whether to talk to you about being a design partner. It is not sold, not shared, and not used for advertising or analytics.
What the form collects
- Your name, so a reply is addressed to a person.
- Your work email, which is how we reply.
- Your company and what you run — a port, a mine, a yard — because the product is being shaped around a small number of operations and the mix matters.
- Anything you write in the message box. It is a free-text field and we read it; please do not put anything sensitive in it, because there is no reason to and we would rather you did not.
- A one-way hash of the network address you sent it from. Not the address itself — it is salted and hashed, which makes it useful for spotting one source flooding the form and useless for identifying you. We mention it because it is still information about you, and a notice that quietly omitted it would be the kind of document this one is trying not to be.
Where it goes
The record is stored in a PostgreSQL database hosted by Supabase in the eu-west-1 region (Ireland). A notification is emailed to a founder inbox at the same time, through Resend, so that a person actually sees it rather than it sitting in a table nobody opens.
The application that writes the form cannot read the table back — it holds insert permission and nothing else. That is not a policy, it is a database grant, and it means a fault in the website cannot be turned into a list of everyone who applied.
How long we keep it
Twelve months, then it is deleted — unless a commercial relationship has begun by then, in which case it becomes part of that relationship’s records and is covered by the agreement we sign with you.
If you would rather we did not keep it that long, say so and we will delete it. That is a one-line email, not a process.
What we do not do
- We do not sell it, and we do not share it with anyone outside the processors named above.
- There is no advertising, no analytics, and no tracking of any kind on this site.
- We do not use it to build a marketing list. If you asked about a product and we replied about that product, that is the whole of it.
Your rights
You can ask for a copy of what we hold, ask for it to be corrected, or ask for it to be deleted. For a single form submission all three are straightforward and we will do them.
Who to ask
Egameno (Pty) Ltd is the contracting entity. Its registration number and registered address are not published here yet — they are being confirmed and will be added rather than approximated. Write to hello@egameno.com and a founder will answer.
What this notice deliberately does not cover
Egameno is designed to hold incident records, and an incident report can describe an injury — which is special category data under UK and EU law and carries a materially higher bar. None of that is running yet. There are no self-serve accounts; signup is closed and reopens deliberately. Design-partner workspaces are set up by hand, one at a time, under a written agreement.
When that changes, this notice gains the sections it needs — controller and processor roles, the lawful basis for health data, the appropriate policy document, retention inside a workspace — and it gains them after legal review, not before. A notice that described those things today would be describing something that does not exist, which is exactly what the previous version of this page did.
Outstanding before launch
- The registration number and registered address of Egameno (Pty) Ltd, and a named data protection contact. The entity is settled; these three are not, and they are the details a reader would need to escalate beyond an email.
- Legal review of this notice and of the terms. Both remain drafts until that happens.
- Signed data processing agreements with Supabase and Resend, and the standard contractual clauses covering any transfer outside the UK/EEA.
- A supervisory authority to register with, which depends on where the entity is established.
- Everything in the section above, before any workspace holds a real incident: the lawful basis for injury data, the appropriate policy document, a DPIA — which for special category data at scale is very likely required — and retention periods inside a workspace.