Privacy policy

Last updated: June 2026

1. Data controller

Playium is operated by Limbo SLU, an Andorran company with Tax ID (NRT) L718107N and registered office at Ctra de la Rabassa, Edifici Terres de Cibós, B, 1, 1. Sant Julià de Lòria AD600, Andorra. For any matter related to your personal data, write to hola@limbo.ad.

2. What data we process

We distinguish two contexts: • Public and commercial site. When you request a demo or subscribe to the newsletter, we process your name, email, venue name, city and number of venues you operate. Legal basis: consent and legitimate interest in maintaining commercial contact. • Playium product (operator and family app). When a venue subscribes to Playium, we process the data of venue employees, parents/guardians, and registered minors. Children's data is handled with specific care: see section 5. • WhatsApp messaging (optional). If the venue enables the WhatsApp bot, we process — on the venue's behalf — the phone number and the content of the messages exchanged with its customers. See section 8.

3. What we use the data for

Commercial data: contact you to demo the product, send emails related to your request and, if you authorize it, occasional updates about new features. Product data: deliver the service (sessions, time passes, events, payments), billing, technical support and legal obligations (tax, fraud prevention).

4. Payments via Paddle (Merchant of Record)

When you subscribe to Playium, payments are processed through Paddle, which acts as our Merchant of Record: Paddle is the official seller to you, issues the invoice and handles collection and remittance of taxes in your country. Your bank statement will show 'PADDLE.COM' as the descriptor. The entity responsible for customers outside the US and Canada is Paddle.com Market Limited (Company No. 8172165, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom). Paddle is an independent data controller for payment data — card number (which Playium never receives), billing address, email, country and IP — for the purposes of charging, tax calculation and fraud prevention. We receive from Paddle the transaction ID, amount, last 4 digits of the payment method and the status, enough to reconcile the subscription. Paddle's privacy policy is available at paddle.com/legal/privacy.

5. Children's data

The family app handles children's data (name, date of birth, allergies or special needs if the operator requests them). The safeguards we apply: • The data controller is the venue contracting Playium; we are the data processor. • Parental consent is required to create the child's profile — the app flow demands explicit confirmation from the parent/guardian before saving any child data. • We do not use children's data for profiling, marketing or personalized advertising. • Data is only visible to the responsible venue and to the child's own parents/guardians. • Children have access, rectification and erasure rights through their parents/guardians. Deleting the family account erases the child's data within 30 days at most. • If the venue enables the WhatsApp assistant, any child data provided in the conversation (e.g. the birthday child's name and age) is handled the same way; the resulting booking remains pending human validation by the venue.

6. How long we keep the data

Commercial data (leads, newsletter subscriptions) is kept while the relationship lasts or until you request its deletion. Product data is kept while the venue's contract is active, plus up to 5 years for accounting and tax retention obligations applicable to Limbo SLU. Payment data is retained by Paddle under its own retention policy.

7. Your rights

You can exercise access, rectification, erasure, objection, restriction and portability rights at any time by writing to hola@limbo.ad from the email associated with your account. We respond within 30 calendar days. If you believe we don't respect your rights, you can file a complaint with the Andorran Data Protection Agency (APDA), apda.ad, the supervisory authority of your operator. EU residents may, alternatively, contact their national data protection authority.

8. WhatsApp and AI assistant

If the venue enables the WhatsApp module, the service runs on Meta's WhatsApp Business Platform and we process — as data processor, on the venue's behalf — the phone number and the content of the messages exchanged between the venue and its customers, in order to handle the conversation and manage bookings. When the venue enables the AI assistant, the conversation content is processed with Anthropic (Claude) to draft replies. Bookings generated by the assistant remain pending human validation by the venue; they are not confirmed in a fully automated way. Sub-processors involved, under a data processing agreement: Meta Platforms Ireland (WhatsApp messaging), Anthropic (AI processing) and Supabase (hosting of product data, including these messages, on EU servers). It is the venue's responsibility to inform its customers, before the conversation starts, that WhatsApp support may be automated.

9. Changes to this policy

If we change this policy substantially, we'll notify you by email at the address associated with your account and post a prominent notice on the homepage before it takes effect.