Privacy
Last updated 31 July 2026.
This explains what Monterosa does with personal data on Gamestage, and how to ask us about it. It is written under UK data protection law: the UK GDPR and the Data Protection Act 2018.
Two different people read this page and the answers differ, so it is split. Players are people who played a game someone built on Gamestage. Creators are people with a Gamestage account.
Who to contact
Email dpo@monterosa.co with any question about your data, or to make any of the requests below.
Tell us what you are asking for and enough to find you: the game you played, or the email address on your Gamestage account. We reply within one month. If a request is complicated we may take up to two further months, and we will tell you inside the first month if that happens.
We do not run a form for this. A form would collect your details in order to process a request about your details, and an email address you can see does the same job with less of your data in it.
Who we are
Monterosa Productions Ltd, company number 04716325, registered in England and Wales at 3B The Plaza, Floor 3, 100 Old Hall Street, Liverpool L3 9QJ, is the controller for the data described below. Gamestage is a Monterosa product.
We are registered with the Information Commissioner's Office under reference Z9899012.
For a game built on Gamestage, responsibility is shared and the split matters:
- The creator of the game controls the game's own data. Their answers, their scores, their content. We host and process it for them, on their instructions. Questions about a specific game go to whoever made it.
- Monterosa controls the engagement analytics. Where a game runs our Signal collector, we decide what it collects and we use the results ourselves. That makes us responsible for it, and it is why this page exists.
If you played a game
What Signal collects
Signal only runs where a game has it switched on, which is paid plans, and it only runs if you have given consent. Without consent it records nothing at all. It does not record a reduced version, it records nothing.
With consent, it records:
- A random identifier stored in your browser, so repeat visits can be counted as one person rather than several. It is not linked to your name.
- The pages of the game you opened, their titles, and the page that sent you there.
- That you activated something, and enough to say what: the kind of element, its role, its label, and a stable name the game gave it.
- That a form was submitted, and when.
- When a session started and ended.
- Where a game already signs you in with a Monterosa account, the account identifier, so activity can be joined up across sessions.
What it never collects
- What you typed. Field values are never captured, in any form, ever.
- The text on the page. Only structural labels, never content.
- Keystrokes, mouse movement, scrolling, or screen recording.
- Any device fingerprint.
Why we are allowed to
Your consent, and nothing else. You can withdraw it at any time in the game's own privacy or cookie controls, and the collector stops immediately. Withdrawing it does not affect anything collected before you did.
We keep a record of your IP address at our servers for a short period, to stop one machine flooding the service. That is our legitimate interest in keeping the platform working, and it is not joined to the analytics above.
What we store on your device
Signal uses your browser's local storage, not cookies. It keeps a random identifier and, if the network fails, a short queue of unsent events so they are not lost. Clearing your browser's site data removes both.
If you have a Gamestage account
To give you an account and run your games we hold:
- Your email address and name, from however you signed in. Sign-in is handled by WorkOS, and by Google if you chose that route.
- Your GitHub username, once you link GitHub. We need it before your first deploy because your game lives in a repository, and because it is how issues find their way back to you.
- Your workspace: your games, what you deployed and when, and your usage against your plan's limits.
- A record of the actions you took: deploys, links, changes to limits, games suspended or woken. We keep this so that if something is disputed there is an account of what actually happened, and so we can spot one person running many accounts to get around a plan's limits. It includes the network address the action came from.
Our lawful basis is our contract with you for the account itself, and our legitimate interest in security, abuse prevention and keeping an accurate record for the rest.
Your Gamestage sign-in token is held in your own operating system's keychain. It is never stored in your project and never given to the agent working in your repository.
How long we keep things
| What | How long |
|---|---|
| Signal analytics events | 25 months from collection |
| Account and workspace data | While the account is open, then 30 days |
| Action records and audit trail | 6 years, so a dispute can still be answered |
| Network addresses held for abuse prevention | 90 days |
If you delete your account, the games you deployed come down and the account data goes within 30 days. Records that something happened, and payment records where they exist, survive that deletion with your identifying details removed.
Who else sees it
We use other companies to run the service. They act on our instructions and may not use your data for their own purposes.
This list is built from what the code sends and to whom, not from memory. Each row is a service the Gamestage code calls with something that can identify a person.
| Who | What for | What it receives |
|---|---|---|
| WorkOS | Creator sign-in and accounts | Name, email, sign-in events |
| Sign-in, where a creator chooses it | What Google sign-in shares | |
| Clerk | Fan sign-in on a Hub | A fan's sign-in details, where they create a Hub account |
| GitHub | Linking a game to its repository, and issues | GitHub username, repository |
| Vercel | Hosting the Gamestage website | Every request to gamestage.ai, including network address |
| Amazon Web Services | Running games, storing their data, and the email and secrets services behind them | Game plays, player identifiers, account records |
| Monterosa Interaction Cloud | The content and live updates of every game | A fan's connection to a game, and a player identifier |
| Monterosa Analytics, run on Amazon Web Services and Databricks | Engagement analytics, only after consent | The events described above |
| Databricks | Processing analytics, and the points ledger | Analytics events and player identifiers |
| Resend | Sending account emails | Email address and the email's content |
| Slack | Telling the Gamestage team about new applications, quote requests and faults | Name, email, company and role you gave us |
| Attio | Keeping track of quote requests | Name, email, company and what you asked |
| Plane | Keeping track of bug reports and suggestions | What you wrote, and a name only if you chose to add one |
| Cal.com | Booking a call | Whatever you enter on the booking form |
| Snitcher | Identifying which company a visit to our public pages came from, only after you say yes | Network address and the pages visited |
| PostHog, Google Analytics | Only where a game's creator switches them on, and only after consent | The same events as Signal |
Services that give us data but receive nothing personal from us are not listed: the sports data suppliers Sportmonks and Fantasy Premier League receive only our own requests for fixtures and statistics.
We do not sell personal data, and we do not share it for advertising.
Where it goes
Some of the companies above operate outside the United Kingdom, mostly in the United States. Where data leaves the UK we rely on the safeguards UK law provides for that, including the UK addendum to the standard contractual clauses and, where it applies, the UK extension to the EU-US Data Privacy Framework.
Your rights
Under UK law you can ask us to:
- Show you what we hold about you.
- Correct anything that is wrong.
- Delete it.
- Stop or limit what we do with it.
- Hand it over in a portable form, or send it to someone else.
- Object to processing we do on the basis of legitimate interests.
- Withdraw consent at any time, where consent is what we relied on.
Email dpo@monterosa.co. We do not charge for this and we will not ask you why.
If you are asking about a specific game rather than about Gamestage itself, tell us anyway. Where the creator is the one responsible we will say so and point you at them rather than leaving you to work it out.
Children
Gamestage accounts are for adults: we ask a creator to confirm they are 18 or older before we keep their application, and before we open a quote request or show the booking calendar.
A fan must confirm they are 13 or older before they can create a Hub account, and before we keep a name they type into a feedback form. Under 13, the account is never created and nothing from the attempt is kept.
Playing a game needs no account. A player is given a random identifier and may pick a name and a picture from our own lists; they cannot type a name, give an email or upload a photo. Where a game needs a stricter age restriction it is the creator's job to declare one, which our platform then enforces. If you believe we hold data about a child and should not, email us and we will remove it.
Complaints
Tell us first, at dpo@monterosa.co. We would rather fix it.
You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. We are on their register under reference Z9899012. Complaining to us does not affect your right to go to them.
Changes
If we change how any of this works we will update this page and change the date at the top. Where a change matters to you we will do more than that.