Privacy notice and technical storage

Updated 27 October 2026 · Version 2

Controller and contact

Stefano Pierbattista is the controller for Prisonhead. Contact: pierbattista.stefano@gmail.com. Prisonhead is a fan information project for Prison Legacy, without advertising or marketing.

Data, purposes, legal bases and retention

We process usernames, password hashes, roles, account status and character/language preferences to provide requested accounts and personalised services (GDPR Article 6(1)(b)). No real name or email is required from users. Accounts are created by an administrator on request or invitation; an inviting administrator may supply the username. Account data remains until closure, with an annual manual review of inactive accounts.

Failed login IPs/usernames (15-minute control window, deleted within 75 minutes), sessions (up to 8 hours) and editorial audit history (90 days) support our legitimate interest in security, abuse prevention and database integrity (Article 6(1)(f)). Cleanup runs at startup and at least hourly while the service runs. Guides and corrections remain as shared game information; author fields are anonymised on account deletion. Personal information in free text is reviewed on request. Authors are visible to readers authorised to access their contributions.

Messages voluntarily sent to our contact are used to handle your request, meet legal obligations or protect legitimate interests as applicable; ordinarily deleted within 12 months after closure, unless a dispute or legal obligation requires longer retention. Login details are required for private features; public pages remain available without an account. Game recommendations do not make automated decisions with legal or similarly significant effects.

Recipients, hosting and transfers

The controller and authorised administrators access data as needed. Editors cannot manage accounts. Technical hosting and email providers may process data to deliver their services. This contact uses Gmail; messages sent to it are also processed by the email service under its terms. Google privacy policy.

Aruba S.p.A. - Aruba Cloud VPS IT3, Ponte San Pietro (Bergamo), Italia / Italy. Account requests: info@prisonhead.com (Aruba email).

VPS: dati conservati in Italia / data stored in Italy. Eventuali trasferimenti dei fornitori richiedono le garanzie GDPR applicabili / provider transfers require applicable GDPR safeguards. Privacy contact: Gmail; see Google privacy policy.

Problem reports

Guests can flag quests and recipes. We retain the page, optional message and dates without linking them to an account. Do not include personal information. Editors and administrators manage reports; open reports remain until reviewed and resolved reports are deleted after 90 days. An IP-derived identifier, keyed with a secret and rotated daily, is retained for up to 24 hours to limit abuse (legitimate interest in security and content quality).

Cookies and browser storage

pl_review protects report submissions for one hour without requiring sign-in. It is a technical HttpOnly, SameSite Strict cookie, Secure in production.

pl_session keeps you signed in for up to 8 hours; pl_login protects the login form and pl_setup protects local first-admin setup (15 minutes). These technical cookies are HttpOnly, SameSite Strict and Secure in production. No advertising, analytics or third-party trackers are included. Local storage retains requested language, character, equipment, comparison weights and equipment history. Clear it through Privacy controls or your browser settings.

Backups and rights

Managed backups expire after 30 days. Structured account references are scrubbed from managed backups on deletion. Operator-created external copies must follow the same limits. Avoid personal data in published text. Server permissions protect access.

You may request access, rectification, erasure, restriction, portability where applicable and object to legitimate-interest processing. Contact us above; we respond within one month, with a reasoned extension where GDPR permits it. Account Privacy controls provide a principal-data export and account deletion; use email for other data or requests. You may complain to the Italian data protection authority. No advertising consent is required.