ShinobiKage is operated by Studio Grafix. We respect your privacy and are committed to being transparent about how we collect, use, and protect your personal data. This Privacy Policy applies to visitors and registered users of https://www.shinobikage.com and complies with Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR) and Czech Act No. 110/2019 Coll., on personal data processing.
1. Data Controller
Controller (responsible for data processing):
Studio Grafix
Miriam Česáková
Janáčkova 267/5
277 11 Neratovice
Czech Republic
Company ID (IČO): 05312361
VAT ID (DIČ): CZ8855241032 — we are VAT payers.
Contact for privacy matters: info@shinobikage.com
2. What data we process
We keep data collection to the minimum necessary for running the magazine and protecting it from spam and abuse. We never sell personal data.
| Category | What it is | Example | Purpose |
|---|---|---|---|
| Account data | Username, hashed password, email, registration IP | narutofan_88, user@example.com |
Let you log in, post comments, manage your account |
| Comment content | Nickname, optional email, comment text, IP address | "Great chapter breakdown!" | Run the discussion under articles and videos |
| Newsletter subscription | Email address | fan@example.com |
Send new-chapter and event updates (double opt-in) |
| Traffic & analytics | Anonymised or pseudonymised usage data, aggregated | Visitor from 1.2.3.x | Understand what content readers enjoy (loaded after consent) |
| Embedded third-party content data | IP, device data sent to YouTube/Instagram | YouTube video ID | Play embedded videos and posts (loaded after you click the placeholder) |
| Server logs | IP, timestamp, requested URL, user agent | 203.0.113.5 |
Security, fraud and spam protection, troubleshooting |
We do not process special categories of personal data under Article 9 GDPR (no health, race, political opinion, religious beliefs, etc.) and we do not profile readers in an automated way that produces legal or similarly significant effects.
3. Legal basis for processing
| Activity | Legal basis (GDPR Art. 6) |
|---|---|
| User accounts and comments | (b) Necessary for the performance of a contract / provision of a service you request |
| Newsletter | (a) Consent (revocable anytime via unsubscribe link) |
| Traffic analytics | (a) Consent (only after you accept in the cookie banner) |
| Embedded YouTube/Instagram content | (a) Consent (only after you click "Load video") |
| Server logs and spam protection | (f) Legitimate interest — site security and abuse prevention |
| Legal retention of invoices | (c) Legal obligation (Czech accounting/tax laws) |
4. How long we keep your data
| Data | Retention | What happens after |
|---|---|---|
| Account | Until you delete your account | Erased on request |
| Comment author nickname & body | Site lifetime | Anonymised when no longer needed |
| Comment author email (optional) | 2 years after last comment | Anonymised |
| Comment IP address | 30 days, then truncated to /24 | Pseudonymised |
| Newsletter subscriber | Until unsubscribe | Erased within 30 days of unsubscribe |
| Server logs (access / error) | 30 days | Deleted, IP truncated first |
| Invoice / accounting data | 10 years (Czech law) | Legal minimum, then destroyed |
5. Cookies
We use as few cookies as possible. See the Cookie Policy for the full list, the categories, and how to withdraw consent. No non-essential cookies are set before you accept them in the banner or click a YouTube/Instagram placeholder.
6. Embedded third-party content (YouTube, Instagram)
Some pages embed YouTube videos and Instagram posts. These are served from third-party servers and may set cookies on your device when you load them. We never load such embeds automatically — they appear behind a privacy placeholder and only activate after you click "Load video" / "Load post". You can revoke that consent any time by clearing your local storage in your browser.
7. Your rights under GDPR
Under Articles 15–22 GDPR you have the right to:
- Access — receive a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure ("right to be forgotten") — request deletion of your data
- Restriction — ask us to limit processing while a request is reviewed
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest or for direct marketing
- Withdraw consent at any time, without affecting prior processing
- Lodge a complaint with a supervisory authority
To exercise any of these rights, email info@shinobikage.com with "GDPR request" in the subject line. We will respond within 30 days (Article 12 GDPR). We may ask you to verify your identity before acting on a request.
8. Subject access / deletion request
You can submit a request by email using the contact above. Please include:
- Your email address (required)
- Your username on the site, if you have one (optional)
- What you want to do — access, export, rectify, restrict, object, or delete your data
- A short statement that you are the data subject
Your IP address is logged at the moment of the request for fraud prevention only and is truncated to /24 after 30 days.
9. Recipients of your data
We share your data only with processors who help us operate the site, under written agreements (Article 28 GDPR):
- Hosting provider — Dutch/Polish cloud servers hosting shinobikage.com infrastructure
- Email service — generally used for newsletter delivery (processor GDPR-bound)
- Anti-spam tools — for comment and form protection
We do not sell personal data. We may disclose data to public authorities when legally required. Third-country transfers (outside the EU/EEA), where applicable, rely on Standard Contractual Clauses or an adequacy decision.
10. Data security
We protect your data with industry practices: TLS encryption in transit, hashed passwords (Phpass/PHP password_hash), restricted access on a need-to-know basis, regular backups, and security updates for Drupal and PHP. In the event of a personal data breach affecting you, we will notify the Czech Data Protection Authority and affected users within 72 hours where required by Article 33/34 GDPR.
11. Children
ShinobiKage is a general-audience anime magazine and is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have collected data from a minor, please contact us and we will promptly delete it.
12. Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you (Article 22 GDPR). Spam filters and aggregate traffic counts do not produce decisions about you individually.
13. International transfers
Our servers are located in the European Union. Some processors (such as YouTube, Instagram) may transfer data outside the EU/EEA; these transfers are covered by Standard Contractual Clauses adopted by the European Commission, and YouTube/Instagram embeds only load after your explicit consent.
14. Changes to this Policy
We may update this Privacy Policy when law, technology, or services change. Material changes will be announced on the homepage and via newsletter. The "last updated" date below always reflects the current version.
Last updated: 27 July 2026