Privacy Policy

• Waitlist signups — your email address, the faction you selected (if any), a source tag identifying the signup campaign, and a timestamp.
• Founders’ Pass orders — when you buy through Lemon Squeezy, their webhook sends us the order id and number, your email address, your chosen faction, the order status, amount, currency, and product name, which we store together with the webhook payload. Your card details go to Lemon Squeezy and their payment processors only — we never see them.
• Anti-bot verification — the waitlist form uses Cloudflare Turnstile, which analyses browser signals to tell humans from bots. We only receive a pass/fail token, not the signals themselves.
• Technical logs — the Site is served by Cloudflare Pages, and Cloudflare processes IP addresses and request metadata to deliver and protect the Site, as any host does.

The Site sets no analytics or advertising cookies, and fonts are self-hosted — your visit triggers no requests to font or analytics networks.

• Waitlist — with your consent (Art. 6(1)(a) GDPR), to send you Early Access invitations and launch news about Mind the Mafia. Nothing else. You can withdraw consent at any time.
• Orders — to perform the Founders’ Pass contract and deliver its perks (Art. 6(1)(b) GDPR), and to meet bookkeeping and tax obligations (Art. 6(1)(c) GDPR).
• Security — bot filtering and hosting logs rest on our legitimate interest in keeping the Site working and abuse-free (Art. 6(1)(f) GDPR).

Waitlist and order records are stored in a Cloudflare D1 database. Our processors are Cloudflare, Inc. (hosting, D1, Turnstile), Lemon Squeezy, LLC (payments, as merchant of record) and Resend (Plus Five Five, Inc.), which delivers the welcome email when you join the waitlist and the receipt when you order — so your email address is passed to Resend for those messages and nothing else. All three are US companies that may process data outside the EEA; transfers rely on the safeguards they provide, including EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Beyond these three, we share your data with no one, and we do not sell it.

• Waitlist entries: until Early Access invitations for your region are done, or until you ask us to remove you — whichever comes first.
• Order records: for as long as tax and accounting law requires.
• You can request deletion of your waitlist entry at any time; we will action it within 30 days.

Under the GDPR you can ask us for access to, rectification or erasure of your data, restriction of processing, portability, and you can object to processing based on legitimate interest or withdraw consent at any time (without affecting past processing). Write to contact@mindthemafia.com and we’ll handle it. If you play the game, deletion is also available from inside it — see deleting your account. You also have the right to lodge a complaint with your supervisory authority — in Portugal, the CNPD (cnpd.pt).

The Site is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has joined the waitlist, contact us and we will delete the entry.

If this policy changes, the “last updated” date above changes with it, and material changes will be announced on the Site. The Site’s terms of service live at /terms.