Privacy
Last updated: October 19, 2026.
This notice explains what personal data Plot in Hell collects, why, who else handles it, how long we keep it, and what you can ask us to do with it. The short version: we collect as little as we can, your email is never public, and we don't use tracking cookies. We're interested in your sins, not your data.
Who is responsible
The controller is FARO DEVELOPMENT SRL, a Romanian limited liability company (SRL), Str. Traian nr. 26, parter, ap. 2, 400046 Cluj-Napoca, jud. Cluj, Romania, Trade Register no. J2010000982129, CUI 27059379. Email agent@plot-in-hell.com, phone +40 264 700 388.
We haven't appointed a data protection officer, because the law doesn't require one for us. For anything about your data, write to agent@plot-in-hell.com.
What we collect, why, and for how long
| Data | When, and from where | Why | Legal basis | Kept for |
|---|---|---|---|---|
| Technical data: IP address, browser type, page requested, time | Every visit, from your browser | To deliver the Site, keep it secure and find faults (server logs at our hosting provider) | Legitimate interest in a working, secure site | 30 days |
| Your country, worked out from your IP address | When you view prices and when you order | To show the price for your country (section 5 of the Terms) | Legitimate interest in fair prices by country | The IP address isn't stored for this. The price group is kept with your hold or order. |
| IP address for abuse limits | When you reserve or claim a plot | To limit holds (two per IP address) and stop one person from holding every plot | Legitimate interest in security | 30 days |
| Technical signals from your browser for the bot check | When you reserve or claim a plot, or join the waitlist | To check that you're a person, not a bot | Legitimate interest in keeping plots available to people | We don't keep them. See "Who else handles your data" for Cloudflare's role. |
| Your hold: plot, name, epitaph, torments, extras, language, price group | When you reserve | To hold the plot for 15 minutes and prepare your payment | Steps you ask for before a contract | Deleted within 30 days after the hold ends, unless it becomes an order |
| Email address | When you pay (we receive it from our payment provider), claim a free plot or claim a gift | To send your deed, private link and emails about your order or claim, and to handle withdrawals and refunds | Contract | While your plot exists, then 3 years (the period in which legal claims can be made). For a free claim that ends unpaid: 30 days after it ends. |
| Email address (waitlist) | When you join the waitlist | To send a confirmation and one email when plots open | Your consent | Until 30 days after the launch email, or until you withdraw consent |
| Public name and epitaph | When you reserve, claim or edit | To show them on the map, your plot's page, deed and share images. They are public. | Contract | Until you change them or the plot is removed. After a withdrawal or refund, we delete them at once. |
| Plot, torments, extras, neighbours of record, language | When you reserve, claim or edit | To display your plot and send emails and deeds in your language | Contract | While your plot exists |
| Order details from our payment provider: order number, amount, currency, country, status, email | When you pay | To deliver, handle withdrawals and refunds, and keep our accounts | Contract; legal obligation (accounting) | Email: as above. Order number, amount, date and country, without the email: 10 years, as Romanian accounting law requires |
| Your messages to us, including withdrawals and complaints | When you write to us or use the withdrawal form | To answer, handle your request and keep a record | Contract; legal obligation (consumer law); legitimate interest in handling complaints and defending legal claims | 3 years after the matter is closed |
| Reports about a plot (plot, reason, explanation, optional name and email) and our decisions on them | When someone reports a plot, and when we act on a report | To review and moderate names, and to handle notices and explain our decisions as the Digital Services Act requires | Legal obligation (Digital Services Act); legitimate interest in a safe site | 12 months after the decision, or longer if a dispute is ongoing |
| Data other people give us about you: your public name on a neighbour's deed; your email, if someone gives it to us to send you a gift | When they do it | To show neighbours of record; to deliver their gift | Legitimate interest (theirs and ours) | Public names: as above. Gift emails: until the gift is claimed or its link expires |
Do you have to give us your data? You need to give an email address to buy, to claim a free plot or to claim a gift. Without it, we can't send your deed or private link. Everything else is optional or happens automatically.
Automatic decisions. Three things happen automatically: your price group is set from your country; the word filter blocks some names and epitaphs; and a plot's name is hidden after reports until a person reviews it. None of these has legal or similarly significant effects on you, so none is an automated decision under Article 22 GDPR. You can still contact us about any of them, and a person will look at it.
Our legitimate interests are running a working, secure site, fair prices by country, preventing abuse, moderating public names, counting visits without tracking anyone, and defending legal claims. You can object at any time (see "Your rights").
We never receive or store your card details. We don't need your real name. We don't sell your data, show ads or build marketing profiles. Our own marketing uses only made-up names, never yours.
Emails we send
- About your order or claim: your confirmation with the deed and private link, notices about your plot (for example, if we had to move you to another plot, or if your plot's name is under review), withdrawal and refund confirmations, and your private link again when you ask for it.
- Purgatory Claims: a reminder 2 days before your claim ends and, if it ends without payment, one email saying the plot is back on the market. We send that last one because you showed interest in that plot. You can opt out of both on the claim form, and with the link in either email.
- Waitlist: a confirmation, and one email when plots open.
We don't send newsletters. We don't track whether you open our emails or click their links.
Cookies and similar things on your device
We don't use cookies for advertising, analytics or tracking. Not even in Gluttony. We keep two small items in your browser, both needed for things you ask for:
| Name | Where | What for | How long |
|---|---|---|---|
pih.lang |
Local storage | Remembers the language of the pages you visit, so the home page opens in it | Until you clear it |
pih.cart |
Session storage | Remembers the plot, name and epitaph you're reserving while you check out | Until you close the tab |
Bot check. When you reserve or claim a plot, or join the waitlist, Cloudflare Turnstile checks that you're a person and not a bot. It reads technical signals from your browser and doesn't use advertising cookies. We load it only on those forms, not on other pages.
Analytics. Plausible Analytics counts visits and events (for example, "assessment finished") without cookies. It uses your IP address and browser type only to compute a code that changes every day and can't be traced back to you, and it doesn't store your IP address.
Fonts. The Site's font is served from our own servers. Your browser doesn't contact any font service.
Do Not Track. We don't track you across websites, so there's nothing to switch off. We treat every visitor as if Do Not Track were on.
Who else handles your data (yes, Hell outsources)
| Provider | Role | What for | Where | Safeguard for transfers |
|---|---|---|---|---|
| Google Ireland Ltd / Google LLC (Firebase, Google Cloud) | Processor | Hosting, database, file storage, servers, server logs | Belgium (europe-west1); access possible from other countries incl. the US | EU–US Data Privacy Framework; Standard Contractual Clauses |
| the payment provider named on the payment page | Independent controller (it's the seller) | Payment, tax, receipts, fraud checks | See its privacy notice | You give it your data directly at its checkout. Its privacy notice: linked from its payment page |
| Resend, Inc. (Resend) | Processor | Sending emails | USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Cloudflare, Inc. (Cloudflare Turnstile) | Processor for our bot checks; independent controller when it uses the signals to improve its service | Bot protection | USA and Cloudflare's global network | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Plausible Insights OÜ (Plausible Analytics) | Processor | Cookieless visit counts | Estonia; data hosted in the EU | No transfer outside the EU |
We work out your country from a database inside our own application, so your IP address isn't sent to anyone for that. You can ask us for a copy of the Standard Contractual Clauses.
We also share data with public authorities when the law requires it, and with our accountant or lawyers when needed. They must keep it confidential.
Public names and epitaphs can be seen by anyone. Messaging apps and social networks may keep copies of share previews even after you change or delete them. We can't control those copies.
We don't sell printed deeds yet. If we start, we'll name the printing partner here before the first order.
How we protect it
Emails, private links and holds are stored where the public can't read them. Private links are stored only as a scrambled code (a hash), so nobody can read them back from our database, us included.
Your rights (the ones even we can't take away)
You can ask us for access to your data, or to correct, delete, restrict or export it. You can object at any time to processing based on our legitimate interests, and withdraw your consent (for the waitlist) at any time. Write to agent@plot-in-hell.com, from the email address concerned if you can. We reply within one month. You can change your public name and epitaph yourself, at any time, from your private management link.
If you live outside the EU, you have these rights too, plus any others your local law gives you (for example, under the UK GDPR or Brazil's LGPD).
You can complain to the data protection authority where you live or work, or in Romania to the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, www.dataprotection.ro.
Age
The Site is for adults 18 and over. We don't knowingly collect data from anyone younger. If we learn that we hold data about someone under 18, we delete it.
Changes to this notice
If we change this notice, we update the date at the top. If a change affects how we use data you've already given us, we tell you by email or on the Site before it applies.