This policy describes which personal data is processed when you visit and use GameNavigator.ai. We wrote it to be understandable without prior knowledge; the legal references are there so you can look things up. The German version of this policy is the legally binding one.

Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Provimedia GmbH
Weidenweg 12, 74321 Bietigheim-Bissingen, Germany
Email: info@provimedia.de
Phone: +49 7142 9170511

Data protection officer: Patrick Rempfer, email rempfer@provimedia-team.de

The essentials

  • Without your consent we only set the cookies the site needs to work (session, form protection, your consent choice).
  • Google ads and the cookies that come with them are only loaded once you have agreed in the consent dialog. Supporters see no ads.
  • The navigator (AI chat) sends your question to Anthropic and OpenAI. Names, email addresses or account data are not sent along.
  • The navigator only keeps a memory if you switch it on in your account; you can export and delete it at any time.
  • Payments are handled by Stripe. We do not store card data.
  • The newsletter uses double opt-in; every mail contains an unsubscribe link.

Hosting and server log files

GameNavigator runs on servers of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, in a data centre in Germany. A data processing agreement under Art. 28 GDPR is in place with netcup. Our search (Meilisearch) and the database run on these servers as well.

On every request the web server writes to a log file: the IP address of your device, date and time, the address requested, the page visited before (referrer), browser type and operating system, and the status code of the response. We only use this data to keep the service running, to find faults and to fend off attacks.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, stable operation). Retention: 14 days, in the event of a security incident until it has been resolved.

Cookies and access to your device

Which cookies and storage technologies we use, when they require consent and how you withdraw it is described on the page Cookies & Consent. In short: strictly necessary cookies (session, form protection, consent storage) are set without consent under Section 25 (2) no. 2 of the German TDDDG; advertising cookies only after your consent under Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

Newsletter "Forever Briefing"

When you subscribe to the newsletter, we store your email address, the language you chose, the game you signed up for, and the time of sign-up and confirmation. Of the IP address you signed up from we store only a hash value (SHA-256) to detect abuse of the form; the address itself is not stored.

We first send you an email with a confirmation link (double opt-in). Only when you open that link is the address subscribed; without confirmation nothing is sent. Mails are sent through our own mail server; no external newsletter service is involved.

Legal basis: Art. 6 (1) (a) GDPR (consent), in addition Section 7 (2) no. 2 of the German Unfair Competition Act (UWG). You can withdraw your consent at any time: via the unsubscribe link in every email or by emailing us. After withdrawal we send no further mails; the address remains stored together with the unsubscribe date so that we can prove the withdrawal, and is deleted after 3 years. Unconfirmed sign-ups are deleted after 30 days.

The navigator is an AI system: your questions are answered by a language model that searches our game database and the wiki and cites its sources. We say so here and in the chat itself (Art. 50 of Regulation (EU) 2024/1689). Answers can contain errors; for decisions that matter to you, check the cited sources.

What we process. The text of your questions, the answers, the database tools and sources used along the way, the chosen language and mode, timestamps, the number of tokens processed and the game build the answer is based on. If you paste a character export string from our companion addon, we process the character data it contains (character name, level, race, class, talents, gear, professions, quests) to tailor the answer; it becomes part of the conversation history. This data comes from your game client, not from a Blizzard API.

Guests and daily quota. The navigator can be used without an account. To count the daily quota per person and to limit abuse, we derive a hash value (SHA-256) from your IP address and browser identification. We store this hash with the conversation and the usage counters; the IP address itself is not stored for this purpose. We set no cookies for the quota and read no device characteristics beyond the normal browser request.

Recipient: Anthropic. We send the questions together with the conversation history and the game data returned by our tools to Anthropic Ireland, Limited, Ireland, which processes them through its parent company Anthropic, PBC in the USA. Anthropic acts as our processor under Art. 28 GDPR on the basis of its Data Processing Addendum (effective 24 February 2025), which incorporates the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR) for the transfer to the USA. Under Anthropic's Commercial Terms (effective 17 June 2025), customer content is not used to train models. Names, email addresses, account data or the guest hash are not transmitted.

Recipient: OpenAI. So that our search can find matching wiki passages, the text of your question is converted into a numeric vector (embedding). This is done by OpenAI Ireland Ltd, Ireland, using the model text-embedding-3-small; processing takes place partly in the USA, safeguarded by the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR). According to its data controls, OpenAI does not use data sent through the API for training and keeps abuse-monitoring logs for at most 30 days.

Conversation history. We store your conversations in our database so that you can continue them and so that we can account for cost and quota. Guest conversations are deleted 30 days after the last message; conversations of signed-in users remain until you delete them or your account. Usage counters (tokens, cost, day) are kept without reference to the conversation for cost control.

Memory (only with consent). Signed-in users can switch on a memory. The navigator then remembers details such as your characters, your goals and your language as short entries and includes them with new questions. Without this consent nothing is remembered. You can view all entries at any time, export them as a file and delete them; if you switch the memory off, all entries are deleted. Legal basis: Art. 6 (1) (a) GDPR.

Legal bases. For answering your questions Art. 6 (1) (b) GDPR (provision of the service you requested); for quota, cost control and abuse prevention Art. 6 (1) (f) GDPR (legitimate interest in an affordable, fair operation).

User account

For the Supporter subscription and the navigator memory you need an account. For it we store your email address, a name of your choice, a hashed password, the time of registration and confirmation, and the status of your subscription. Legal basis: Art. 6 (1) (b) GDPR. You can delete the account at any time; account data, memory and conversations are then deleted unless the retention periods for invoices stated below prevent this.

Supporter subscription and payment via Stripe

You pay for the Supporter subscription (EUR 4.99 per month) through Stripe. The contracting party for payment processing in the European Economic Area is Stripe Payments Europe, Limited, Dublin, Ireland. On Stripe's payment page you enter your payment details (for example the card number) directly with Stripe; we neither see nor store them. Stripe also receives your email address, the amount and the subscription reference. We store your Stripe customer ID, the status and term of your subscription and the invoice data.

Stripe processes payment data partly as our processor and partly under its own responsibility (for example for fraud prevention and because of legal obligations), as described in Stripe's privacy policy (last updated 16 January 2026). For transfers to the USA Stripe relies on the EU-US Data Privacy Framework and on the European Commission's standard contractual clauses.

Legal basis: Art. 6 (1) (b) GDPR (contract) and, for keeping invoices and accounting records, Art. 6 (1) (c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). Retention: invoices and accounting records 8 years, commercial letters 6 years, each from the end of the calendar year.

Measuring reach (Matomo, self-hosted)

We measure which pages get read, using Matomo. Matomo runs on our own server at www.provimedia.de/analytics/, operated by us. There is no processor here, nothing is passed to a third party, and nothing is transferred to a third country.

Only with consent, and truly nothing before it. On your first visit a banner asks whether we may measure. Only after you click "Allow" is the Matomo code loaded; until then no request goes to the measurement server, not even the one fetching the counting script. If you decline, nothing is loaded, nothing is stored, and you are not asked again.

What is processed. After your consent: IP address, the page visited, the referrer, time and duration of the visit, browser and device characteristics, and the identifiers from the Matomo cookies (_pk_id, _pk_ses, _pk_ref, _pk_cvar; names and lifetimes are on the cookie page). The purpose is measuring reach and nothing else: seeing which content gets read and where the site stumbles. We build no advertising profiles from it and do not combine it with any other data.

Legal basis and withdrawal. § 25 (1) TDDDG and Art. 6 (1) (a) GDPR (consent). You can withdraw at any time with effect for the future: via the link "Change your choice on measurement" in the footer of every page, or by deleting the cookies in your browser. On withdrawal we delete the Matomo cookies immediately.

We show ads through Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data also flows to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (Commission adequacy decision (EU) 2023/1795 of 10 July 2023), and the standard contractual clauses apply in addition.

Only with consent. On your first visit a consent dialog (Google "Privacy & Messaging", certified under the IAB Transparency & Consent Framework 2.2) asks whether Google and its advertising partners may set cookies and process data for personalised or non-personalised advertising. Until you agree, consent for advertising cookies, advertising data and personalisation is set to "denied" (Google Consent Mode v2, default "denied"); advertising cookies are then not set and personalised ads are not shown. We store your choice in your browser so that we do not have to ask on every visit.

What Google processes. After your consent: IP address, cookie identifiers, the page visited, device characteristics and interactions with ads, in order to deliver, measure and personalise ads and to detect fraud. Details are in Google's notice How Google uses information from sites or apps that use our services and in Google's privacy policy.

Legal basis and withdrawal. Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR (consent). You can withdraw or change your consent at any time with effect for the future: via the link "Privacy settings" in the footer of every page or by deleting the cookies in your browser. Supporters see no ads; no advertising code is loaded for them.

Some links to retailers (for example for game time, game keys or accessories) are partner links and are marked with the "sponsored" attribute and a visible notice. Merely viewing the page transmits no data to the partner. Only when you click such a link are you forwarded to the partner's site; the partner then learns that you came from GameNavigator and may set a cookie on its site to attribute the commission. The partner's privacy policy applies to that. Current partner programmes: Instant Gaming, Eneba, Amazon Associates, Displate. Legal basis for the forwarding link: Art. 6 (1) (f) GDPR (funding of the service).

Images and video (Google Gemini)

We create the paintings and the video on this site with Google's Gemini API. We send only editorial image descriptions and our own reference images; no data of visitors or users is processed for this. Under the Gemini API terms (last updated 28 April 2026), Google does not use inputs from paid services to improve its products. More under How our images are made.

Contact by email

If you email us, we process your address, the content and the time of the message in order to answer your request. Legal basis: Art. 6 (1) (b) GDPR where a contract is concerned, otherwise Art. 6 (1) (f) GDPR (answering enquiries). We delete the correspondence once the matter is settled and no retention obligation applies, at the latest after 3 years.

Planned feature: sign-in with Battle.net

We plan to offer sign-in with your Battle.net account as soon as Blizzard provides the necessary interface for World of Warcraft: Forever. This feature is not yet available. Before it launches, we will add the data then processed (expectedly the Battle.net identifier and character data with a retention of at most 30 days) and the legal basis to this policy.

Recipients and processors

Apart from the recipients named above, we only pass on data where we are legally obliged to. Our processors under Art. 28 GDPR are currently: netcup GmbH (hosting), Anthropic Ireland, Limited (language model), OpenAI Ireland Ltd (embeddings), Stripe Payments Europe, Limited (payment processing, insofar as acting as a processor) and Google Ireland Limited (ads and consent management, insofar as acting as a processor).

Transfers to third countries

Data is only processed outside the European Economic Area when you use the navigator (Anthropic, OpenAI: USA), pay via Stripe (Stripe: USA) or have consented to advertising (Google: USA). The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework ((EU) 2023/1795 of 10 July 2023) for certified companies (Google LLC, Stripe) and the European Commission's standard contractual clauses under Art. 46 (2) (c) GDPR (Anthropic, OpenAI, additionally Stripe and Google). We provide a copy of the respective safeguards on request.

Retention

Where no period is stated above: we keep personal data only as long as necessary for the respective purpose, and afterwards only while a statutory retention period runs (invoices and accounting records 8 years, commercial letters 6 years, Sections 147 AO and 257 HGB) or until claims are time-barred.

Your rights

You have the following rights under the GDPR towards us:

  • access to the data stored about you (Art. 15),
  • rectification of inaccurate data (Art. 16),
  • erasure (Art. 17) and restriction of processing (Art. 18),
  • data portability (Art. 20),
  • withdrawal of consent with effect for the future (Art. 7 (3)), for example for the newsletter, advertising and memory,
  • objection to processing we base on a legitimate interest (Art. 21). You may object to processing for direct marketing purposes at any time without giving reasons.

To exercise them, write to the email address above. For the navigator memory, export and deletion are also available directly in your account.

Providing your data is neither required by law nor by contract; without an email address, however, we can provide neither newsletter nor account nor subscription, and without the text of your question no answer.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart, Germany
Phone +49 711 615541-0, email poststelle@lfdi.bwl.de

You may also contact the supervisory authority of your place of residence.

No automated decision-making

We make no decisions based solely on automated processing that produce legal effects for you (Art. 22 GDPR). The navigator's daily quota is a usage limit, not an assessment of you as a person.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the current version. We announce material changes affecting your account by email.