Privacy Policy

Last updated: 5 August 2026

StudyChessBoard is a chess training platform used by coaches, chess clubs, adult learners and children. We are aware that part of the data on the platform belongs to children and we treat it accordingly. This page explains what data we collect, why we collect it, who receives it and how you can control it.

1. Who is responsible for your data

The data controller within the meaning of the GDPR is:

DOO StudyChessBoard
Železnička 20, Novi Sad, Republic of Serbia
Company number (MB): 22012118
Tax number (PIB): 114360474
E-mail: support@wbchess.com
Phone: +381-60-400-13-64

For any question about how we handle data, or to exercise your rights, write to the e-mail address above.

2. What data we process

2.1. Account data

When you register and use an account, we store:

your e-mail address;
your first and last name, if you provide them;
your display name (nickname);
your interface language and your board and piece settings;
your password as an irreversible hash only — we never store or see the original;
your registration date and last login date.

We do not ask for a date of birth, postal address, phone number or identity documents at registration.

2.2. Signing in with Google

If you sign in with Google, we receive your e-mail address, your name and your Google account identifier from Google, solely to create and link your account. We get no access to your mail, contacts or files.

2.3. Telegram bot

If you use our Telegram bot, we store your Telegram user ID, your Telegram name and username, and the messages you send to the bot, so that we can link the bot to your platform account and answer your requests.

2.4. Learning data

As you study on the platform, the following accumulates:

solved puzzles, results and solving times, course progress;
games played, including games against the engine;
rating and statistics;
lesson attendance records;
club and tournament participation.

2.5. Student data entered by a coach

A coach or club may create a student record containing the student's name and free-form training notes. This data is entered by the coach, who is also responsible for having the right to enter it — for example, a parent's consent. We ask coaches to keep notes limited to chess training and not to record health information, out-of-lesson behaviour or other sensitive data.

2.6. Technical data

IP address and connection time;
browser and device type (User-Agent);
session identifier and connection identifier;
server log entries.

2.7. Payments

Payments are handled by our payment partner PayPro Global, acting as merchant of record. Card details are entered on their side — they never reach us and we do not store them. From PayPro Global we receive order information: order number, amount, currency, status, subscription type and the payer's e-mail address. We need this to grant the access you paid for, to keep our books and to meet legal requirements.

3. Why we process data and on what legal basis

Purpose	Legal basis (GDPR)
Creating and running your account, giving access to courses and lessons	Performance of a contract (Art. 6(1)(b))
Processing payments, subscriptions and refunds; accounting and tax records	Contract and legal obligation (Art. 6(1)(b), 6(1)(c))
Protection against automated sign-ups and abuse (reCAPTCHA), security logs	Legitimate interest (Art. 6(1)(f))
Service e-mails: address confirmation, password reset, payment notifications	Performance of a contract (Art. 6(1)(b))
News and product update e-mails	Consent, withdrawable at any time (Art. 6(1)(a))
Running lessons: student records, attendance, progress	Contract with the coach or club and legitimate interest (Art. 6(1)(b), 6(1)(f))

4. Children

The platform is designed for children as well, including young beginners, so a few rules apply.

An account for a child under 16 must be created by a parent or other legal guardian. By creating an account for a child you confirm that you are entitled to do so and that you consent to the processing of the child's data. Some EU countries set a lower age limit — in that case the limit set by your country's law applies.
We ask children for nothing beyond what lessons require: a name or nickname, an e-mail address to sign in, and a language.
We show no advertising, we do not profile children for advertising purposes, and we never pass their data to ad networks or data brokers.
A parent or legal guardian may request a copy of the child's data, its correction or its deletion at support@wbchess.com.

5. Who receives the data

We do not sell personal data and we do not share it for advertising. Data goes only to those without whom the platform cannot run:

Hosting provider — our servers and database are located in Estonia, that is, inside the European Union.
PayPro Global — payment and subscription processing, invoicing, refunds.
Google — reCAPTCHA (form protection against bots) and Google sign-in, if you use it.
E-mail provider — delivery of service and notification e-mails.
Your coach or club — if you train with a coach on the platform, they can see your training name, progress, solved puzzles, games and attendance.
Public authorities — only where the law requires it and only to the extent required.

Some of our partners operate outside the European Economic Area. Where that happens, the transfer is based on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

6. Where data is stored

The application servers and the database are located in Estonia, within the European Union.

7. How long we keep data

Account and learning data — for as long as the account exists.
After a deletion request — we delete account data within 30 days, except for what we are legally required to keep.
Payment and accounting records — for the period required by the accounting legislation of the Republic of Serbia, regardless of account deletion.
Server logs and connection records — up to 12 months.

8. Your rights

If the GDPR applies to you, you have the right to:

obtain a copy of your data;
have inaccurate data corrected;
request deletion of your data;
restrict or object to processing;
receive your data in a machine-readable format and transfer it to another controller;
withdraw consent you have given — this does not affect processing carried out before the withdrawal;
lodge a complaint with the data protection authority in your country.

To exercise any of these rights, write to support@wbchess.com. We respond within one month. Requests concerning a child's data must come from a parent or legal guardian.

9. Cookies

We only use cookies the platform cannot work without. There are no advertising cookies, tracking pixels or third-party web analytics on this site.

Cookie	Purpose
SCB_ID, SCB_SSID	Identifying the user and the session after sign-in
SCB_UserName, SCB_UserNickName	Showing your name in the interface
SCB_lng	Your chosen interface language
SCB_Board, SCB_Pieces	Your chosen board and piece design
SCB_PlanID, SCB_PLAN, SCB_IsSubscribed	Current plan and subscription status
WB_CON_ID, WB_GUEST_ID	Connection identifier, including lessons without registration

You can delete or block cookies in your browser settings, but signing in and using the board will then not work.

10. How we protect data

The connection to the site is encrypted with HTTPS.
Passwords are stored as hashes only.
Database access is restricted and protected by separate credentials.
We never receive or store card details.

No system on the internet is perfectly secure. If a data breach does occur and creates a risk to your rights, we will notify the supervisory authority and the affected users within the time limits set by the GDPR.

11. Changes to this policy

If this policy changes, we will update this page and change the date at the top. We will announce significant changes by e-mail or with a notice on the site.

12. Contact

DOO StudyChessBoard
Železnička 20, Novi Sad, Republic of Serbia
E-mail: support@wbchess.com
Phone: +381-60-400-13-64