Privacy policy

This is a translation of our German privacy policy. In case of doubt, the German version applies.

1. Controller

Mordsteam e.U., owner Martin Kriegler, Sportplatzgasse 16, 7152 Pamhagen, Austria (FN 689638z, Landesgericht Eisenstadt)
Email: [email protected]

2. Visiting the website

The website is delivered via Cloudflare (Cloudflare, Inc., USA, and affiliated companies). Technically necessary connection data such as IP address, time, page requested and browser identifier are processed to deliver the site securely and quickly (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.

To see how often which pages are visited, we use Cloudflare Web Analytics. It works without cookies and without storing anything in your browser and does not build profiles of individual visitors; we only see aggregated figures (e.g. page views, country, device type). The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). For operations, we also count server requests and emails sent only as numbers per day – without IP addresses, recipients or content.

We use no cookies and do not track individual visitors. Fonts are hosted locally; no data is sent to Google. Without cookies, your browser only stores what the site needs: the chosen currency, a draft of the order form and your game progress (the browser’s local storage). To show your local currency, Cloudflare determines the country from your IP address; we do not store the IP address.

3. Feedback after the game

The day after the game ends, we send the person who ordered a single email with a link to a feedback form (Art. 6(1)(f) GDPR – we want to improve our cases; for early bird orders part of the discount conditions, Art. 6(1)(b) GDPR). You can opt out of this email when ordering. We store your answers without reference to the people in the case. We only publish a review if you expressly agree in the form – anonymously or under the name you provide for it. You can withdraw your consent at any time by email; we will then remove the review from the website.

After a Teams round ends, we ask on every game device – voluntarily and without names – how the game was (stars, difficulty, optionally comments and a few words for the website). This is stored with the team name and round, without further personal data. The words are only published with express consent – anonymously or with the first name you enter – and only after we approve them (Art. 6(1)(a) GDPR).

For Mordsteam Friends, we ask every player right in the browser after the joint reveal for feedback (stars, difficulty, optionally comments and a few words for the website). This is voluntary. It is stored with the first name from the round; the words are only published with express consent – anonymously or with the first name – and only after we approve them (Art. 6(1)(a) GDPR).

For Mordsteam Solo, we ask for your feedback right in the browser at the end of the game (stars, difficulty, optionally a sentence and suggestions for improvement). This is voluntary. It is stored with your player name; your words are only published if you expressly agree – anonymously, with your first name or with your first name and the initial of your surname – and only after we approve them. After a replay we briefly ask once how it went; we never publish these answers.

4. Order and payment

For an order we process the chosen game with package or variant, the number of teams or players, the game language, your name, your email address, whether you order as a company or private individual, optionally phone and invoice company, and the details for personalising the case where the game provides for it (e.g. company or group name, place, rooms, names, title, role or quirks of the people who appear in the case, optionally your logo). The purpose is performance of the contract (Art. 6(1)(b) GDPR). If you choose a fictional cast, you don't provide any personal data for the personalisation.

Payment and invoicing are handled by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Stripe receives your payment and billing data for this – for orders as a company, club or organisation also your VAT number – and processes it under its own responsibility; we never see card details. If you provide a VAT ID as a business from an EU member state, we check it before payment via the European Commission's VAT Information Exchange System (VIES) (Art. 6(1)(c) GDPR). For purchases by private individuals in the United Kingdom, Link (Stripe group) is the seller; Link receives your payment and billing data as well as the order number and product and processes them under its own responsibility (Link privacy notice: link.com). If you withdraw from a contract, we process the order number, name, email address, time and any note to handle and document the withdrawal (Art. 6(1)(b) and (c) GDPR). We send the order confirmation and the feedback email via the email service Resend (Resend, Inc., USA; sent via servers in the EU, safeguarded by EU standard contractual clauses). News by email to customers: see section 7. We keep invoice and payment data for as long as tax retention obligations require (in Austria usually seven years).

5. Game round

For the game round we store the personalisation details, the names of the teams or players, times, answer attempts and hints used in a database at Cloudflare. On the players' devices only a login key is stored in the browser's local storage (no cookie, no tracking). 30 days after the game ends we delete the game round including game progress, answer attempts, chat histories and, where applicable, logo – if a case is never played, 13 months after the order at the latest; the personal data of the personalisation is then removed from the order. To develop our cases further, we keep anonymous statistics (e.g. playing times, number of wrong attempts and hints) without names.

Mordsteam Friends: The person ordering enters the first names of the players and one quirk each from a fixed list, and confirms that everyone agrees. We only use this information to set up the fictional case for the group (Art. 6(1)(b) GDPR). Whoever picks their name via the invitation link gets their own game progress; the others in the group only see who has joined or finished, and only see the ranking and times at the joint reveal. The names are stored only in the game round, not in the order. 30 days after the reveal we delete the round including names and game progress, a round that is never revealed 13 months after the order at the latest.

6. AI characters in the game

In some games or variants you can chat with an AI-controlled character (stated in the game description). What you write in the chat is sent together with the invented case data to our AI provider Anthropic so that the character can reply (Art. 6(1)(b) GDPR). We replace the real names from the personalisation (e.g. company, people, rooms) with placeholders before sending and only reinsert them in the reply – even if they are typed into the chat. The players' devices only connect to mordsteam.com, not directly to the AI provider. Anthropic processes the data as a processor, does not use it to train its models and deletes inputs and outputs after 30 days by default. The transfer to the USA is based on certification under the EU-US Data Privacy Framework or on EU standard contractual clauses.

In Mordsteam Friends Mystery Night Plus, the AI plays the players' doubles. For this we transmit no names, only placeholders, the chosen quirk from the list, the invented case data and the questions asked in the interrogation room; names someone types into a question are also replaced with placeholders first. Interrogation histories are stored with the game round and deleted with it.

In Mordsteam Solo Plus, the AI plays invented suspects. For this we only transmit the invented case data and your questions in the interrogation room – not your name. Please do not type personal data into your questions. We delete the conversations together with your playthroughs, 30 days after your last game ended.

In Mordsteam Teams Premium Plus, the AI plays ARIA, the assistant on the case intranet, and – in the special assignment for fast teams – a character being interrogated. We replace real names (company, boss, suspects, rooms) with placeholders before transmission; only these placeholders, the invented case data and the chat messages are transmitted. We delete the conversations with the game round, 30 days after the game ended.

Please don't enter real personal data in the chat – the AI character doesn't need it and only knows the world of the game. The number of messages per game round is limited. We store the chat history with the game round and delete it 30 days after the game ends. AI characters are labelled as AI; their answers may contain errors.

Signing up on the website: If you sign up for the newsletter, we store your email address, the language, the text of your consent and the time of sign-up and confirmation. You are only signed up once you click the link in our confirmation email (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR, § 174(3) Austrian Telecommunications Act 2021); you can withdraw it at any time via the unsubscribe link in every email. To prevent abuse we store a hashed short value of your IP address for 24 hours.

Customers: We occasionally send news about new Mordsteam cases to the email address from a paid order (§ 174(4) Austrian Telecommunications Act 2021, Art. 6(1)(f) GDPR) – unless you opted out when ordering. Beforehand we check the address against the ECG list of the Austrian regulator RTR; if it is listed, you won't receive a newsletter. You can unsubscribe in every email with one click.

Sending: For sending we transfer your email address, first name and language to our email service Resend (Resend, Inc., USA; safeguarded by EU standard contractual clauses). After you unsubscribe we keep the address marked as “unsubscribed” so that it is not added to the list again.

Analysis: Links in our newsletters contain a short tag (e.g. ?nl=2026-12). It is not stored in your browser, only passed on to the next page, so that we can count how many visits and orders a newsletter brought; visits are counted without personal data. We also analyse whether and how often customers order again and whether a Solo voucher was redeemed (Art. 6(1)(f) GDPR – we want to know which games and newsletters are worthwhile). Only we use this analysis; it does not lead to any automated decisions.

8. Contact form and email

If you write to us using the contact form or by email, we process your name, email address and message to answer your enquiry (Art. 6(1)(b) or (f) GDPR). Messages from the form are delivered to our mailbox via our email service Resend (Resend, Inc., USA; sent via servers in the EU) and stored there. To prevent abuse, we also store a hashed short value of your IP address with the time and delete it after 24 hours. Our emails are processed via Apple iCloud.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Write to [email protected]. You can also lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at.

Last updated: October 2026