Legal
Privacy Policy
How After Midnight Enterprises ApS handles personal data under the General Data Protection Regulation. Last updated 7 September 2026.
1. Who is responsible
The data controller is After Midnight Enterprises ApS, CVR 38764845, Søndergade 44, 4., 8000 Aarhus C, Denmark. Contact: info@aftermidnight.enterprises, +45 71 86 64 95. We have not appointed a data protection officer; the company is small enough that data protection questions reach the same mailbox as everything else, and they are answered by a person rather than a queue.
2. What we collect, and why
There are exactly two forms on this site, and nothing else on it collects personal data. Both are listed here field by field, because a policy that summarises “we collect the information you provide” cannot be checked against the live form — and the two drifting apart is the most common finding in this area.
2.1 The pitch portal (/pitch-deck)
Every field is required. That is deliberate: the lawful basis is Article 6(1)(b) — steps taken at your request before entering into a contract — and that basis only covers data that is necessary for the step you are asking us to take. An optional field could not be necessary by definition, so there are none.
| Field | Why it is necessary | Basis |
|---|---|---|
| Studio name | Identifies who is submitting. | Art. 6(1)(b) |
| Contact e-mail | The address we answer to. Without it the request cannot be acted on. | Art. 6(1)(b) |
| Game title | Identifies the project the submission is about. | Art. 6(1)(b) |
| Genre | Routes the submission to the right reader. | Art. 6(1)(b) |
| Target platforms | Determines whether the project fits what we can distribute. | Art. 6(1)(b) |
| Pitch summary | The substance of the assessment. | Art. 6(1)(b) |
| Build or gameplay video link | We assess the game itself, not a description of it. | Art. 6(1)(b) |
| Design document link | Scope and plan, needed to judge feasibility. | Art. 6(1)(b) |
| Funding band | The order of magnitude you are asking about. | Art. 6(1)(b) |
Retention: 24 months from our last exchange about the submission, then deleted. You can ask for deletion sooner by quoting the reference shown to you on screen.
2.2 The contact form (/contact)
The lawful basis is Article 6(1)(f) — our legitimate interest in answering enquiries addressed to us, from consumers and businesses alike — or Article 6(1)(b) where the message is itself a step towards a contract. You can object at any time under Article 21; see section 6.
| Field | Why it is necessary | Basis |
|---|---|---|
| Your name | So a reply can be addressed to a person. | Art. 6(1)(f) / 6(1)(b) |
| Your e-mail | The address we answer to. | Art. 6(1)(f) / 6(1)(b) |
| Subject | Routes the message. | Art. 6(1)(f) / 6(1)(b) |
| Message | The enquiry itself. | Art. 6(1)(f) / 6(1)(b) |
Retention: 12 months from the last message in the exchange, then deleted.
2.3 What is recorded without you typing it
Using a website means a server records the request. We do not describe that as “nothing”, because it is not nothing. This is the complete list, and each item says whether it is linked to your submission:
- A truncated one-way hash (SHA-256) of your IP address, with the time of each submission. To count submissions per sender so the forms cannot be flooded. The raw address is never written to the database, and the hash cannot be turned back into it. Basis: Article 6(1)(f) — our legitimate interest in keeping the forms usable. Kept: The counter file is deleted 24 hours after your last submission. Linked to your submission? Yes — the same hash is stored in the row with your submission, so an abusive sender can be identified and removed. It is deleted with the row.
- Ordinary web-server log lines: IP address, date and time, the URL requested, the HTTP status and the browser user-agent string. Security, abuse investigation and diagnosing errors. This is recorded for every request to every page of this site, not only when you send a form. Basis: Article 6(1)(f) — our legitimate interest in operating the service securely. Kept: 30 days, then deleted. Linked to your submission? No. Server logs are not joined to submissions and are not used to build a profile of you.
- An application event log recording that a submission was stored, with its reference — no names, addresses, message text or IP addresses. To detect failures, such as a submission that could not be saved. Basis: Article 6(1)(f) — our legitimate interest in a service that works. Kept: 30 days. Linked to your submission? Only by the reference shown to you after sending, which on its own identifies nobody.
The second item is an ordinary web-server log, and it applies to every page you open here, not only to the forms.
3. No consent tick-box
Neither form asks you to tick a consent box, and the server does not require one. Consent is a separate lawful basis under Article 6(1)(a), and consent you would have to give in order to send a form would not be freely given under Article 7(4) — a box like that would misdescribe the basis we actually rely on. We tell you the basis at the point of collection instead. If you would rather not use a form at all, write to info@aftermidnight.enterprises or call +45 71 86 64 95.
4. Who else sees it
Your data is not disclosed to any third party for that party’s own purposes. It is not sold, not rented, not used for advertising and not shared with data brokers. That is a different statement from “nobody else ever touches it”: a hosting provider processes it on our documented instructions as a processor under Article 28, and pretending otherwise would be false.
4.1 Where the data is processed, and the transfer out of the EEA
The website and this API run on a virtual server operated by Namecheap, Inc. in Phoenix, Arizona, United States. That is outside the European Economic Area, so everything you send through a form on this site is transferred to a third country and we have to say so plainly rather than leave it to be discovered.
No adequacy decision is relied on. The European Commission’s decision on the EU–US Data Privacy Framework covers only organisations that have certified to it, and we do not claim that certification for our provider. The transfer therefore rests on Article 46(2)(c): Standard Contractual Clauses, Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), as set out in the provider’s own data-processing addendum published here.
What that means in practice: the provider hosts the machine and can technically access the disk, but it processes personal data only on our documented instructions, and it is not permitted to use anything you send us for its own purposes. If you would rather not have your data reach a US-hosted server at all, write to us at info@aftermidnight.enterprises or telephone +45 71 86 64 95 instead of using a form — that is a genuine alternative, not a formality.
The location was established by measurement from inside the server on 2026-09-07, not from an IP-geolocation database: Measured from inside the server on 07.09.2026: upstream gateway 63.250.33.1 (AS22612), GTT hop cr1-phx2 (Phoenix), TCP RTT Los Angeles 23 ms / Dallas 45 ms / New York 60 ms / Frankfurt 143 ms, RDAP allocation to Namecheap. We publish the method because an earlier version of this site, written before the server existed, correctly claimed no location at all — and a residency sentence written before there is a server to check is a claim waiting to go false.
Every asset on this site — fonts, styles, scripts, images — is served from aftermidnight.enterprises itself. There is no analytics provider, no advertising pixel, no chat widget, no content delivery network and no third-party font host. One other organisation can technically reach the data: Namecheap, Inc., which operates the server in Phoenix, Arizona, United States as our processor under Article 28 and on our documented instructions. That is a processor relationship, not a disclosure to a third party for its own purposes — and because it is outside the European Economic Area, the privacy policy names the Article 46 safeguard the transfer rests on. If an analytics or advertising tag is ever added, it will load only after you allow it in the cookie banner, and it will be listed on the cookie page before it goes live.
5. Security
The site is served over HTTPS. Form submissions go to our own API and are written to a database whose listeners are bound to the local host only, so that it does not answer from the public internet; this is checked from outside the server after every provisioning run rather than assumed from a configuration file. Each row is stored with the lawful basis and the notice version it was collected under. Application logs deliberately contain no names, e-mail addresses or message contents, and the raw IP address of a submission is never written to the database — only a truncated one-way hash, used for counting submissions.
6. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and — for anything we process under a legitimate interest — the right to object under Article 21. Objecting to the processing of a contact message means we stop processing it unless we can show compelling legitimate grounds; in practice, we simply delete it.
To exercise any of these, write to info@aftermidnight.enterprises. We answer within the one-month period set by Article 12(3). If you are not satisfied, you can complain to Datatilsynet, the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.
7. Automated decision-making
There is none. The completeness meter on the pitch portal scores how complete your submission is against a published rubric; it does not decide anything, and no decision about a submission is made without a person reading it.
8. Children
This is a business-to-business site and is not directed at children. We do not knowingly collect data from anyone under 16.
9. Cookies and storage
The only thing this site stores in your browser is the record of your choice in the consent banner. Every entry, its lifetime and its purpose are listed in the cookie policy, which also describes the processing that is not a cookie at all.
10. Changes
When this policy changes materially, the date at the top changes with it and the version stored against new submissions changes too — so it is always possible to say which wording was on screen when a given submission was made.