Name: Boardgamestore
Address: 1500 Southwest 1st Avenue, Portland, Oregon, 97201, United States
Telephone: +1 (340) 865-3475

Effective Date

This policy sets our current operational standard across boardgamestore.click from 2026-10-28.

This privacy policy took effect on 2026-10-28 and governs all catalogue interactions, inquiry communications, chat transcripts, and analytical records on boardgamestore.click from that date forward.

Data Controller Identity

The operating business behind boardgamestore.click is identified with full postal details below.

The controller responsible for processing personal data on this website is Boardgamestore, trading at boardgamestore.click. Our registered physical facility and counter operations are located permanently at 1500 Southwest 1st Avenue, Portland, Oregon 97201, Portland, Oregon, United States.

Operating as a registered gaming accessory workshop in Oregon since 2026, we maintain full accountability under Oregon commercial statutes and local gaming association guidelines.

Categories of Data Collected

We only collect the operational information required to formulate custom quotes and verify technical tolerances.

We collect information submitted directly through our specification inquiry form (submit.php), which records: customer name, telephone number, email address, physical address, the kind of enquiry, the message, the requested specification, and the consent tick. Automatically with each submission, the server logs the IP address, the browser's user-agent string, the referring URL, the moment the form was rendered, and the moment it was sent.

Our support chat (chat.php) keeps the conversation and stores a session token in the visitor's browser so they can return to the dialogue. Technical and log data collected across all visits include server access logs and HTTP request headers. In addition, we collect cookie identifiers and advertising click identifiers when traffic arrives through marketing campaigns.

Account and payment data: No user accounts, passwords, or payment card numbers are collected or processed. Nothing is sold or paid for directly on this site and no payment is taken online.

Purposes of Processing

Every byte of data collected serves a defined functional, operational, or security purpose.

We use collected details solely for the following explicit purposes:

To formulate non-binding price quotes for custom tabletop accessories, verify box organizer millimeter dimensions, and respond to sleeve compatibility inquiries.
To conduct live customer support conversations via our chat interface and answer Portland counter fitting requests.
To monitor website infrastructure security, verify server integrity, and prevent automated form spam and abuse.
To measure marketing campaign efficacy and evaluate whether advertising clicks result in genuine quote inquiries.

Legal Bases for Processing

Each data processing activity operates under an explicit legal justification recognized under privacy law.

We process personal information under the following explicit legal bases:

Contract / Pre-contractual steps: Processing inquiry form submissions, component specifications, and customer correspondence is necessary to take pre-contractual steps at your request prior to entering into a potential fabrication agreement.
Legitimate interest: Logging server telemetry, IP addresses, and HTTP request headers relies on our legitimate interest in securing our website, defending against malicious form abuse, and diagnosing technical faults.
Consent: Storing non-essential cookies, recording advertising identifiers, firing marketing tags, and persisting optional browser tokens relies strictly on your prior, freely given consent.

Advertising Platforms & Click Identifiers

Paid campaigns run today across Google Ads, Microsoft Advertising, and Meta Ads using explicit click parameters.

This website receives paid traffic today from major commercial ad networks: google ads, microsoft advertising, and Meta Ads send traffic here. When a visitor arrives via an advertisement, the respective platform attaches a unique click identifier to the URL query string:

Google Ads attaches gclid to the landing URL.
Microsoft Advertising attaches msclkid to the landing URL.
Meta Ads attaches fbclid to the landing URL.

These click identifiers are used for conversion measurement and campaign attribution only when marketing storage has been permitted. Nothing anywhere claims a platform has reviewed, approved or verified this site.

Consent Mode v2 Implementation

Consent Mode v2 holds four advertising signals denied by default until you grant permission.

We deploy Google consent mode v2. Prior to the visitor granting permission, the four core operational signals are held in an absolute denied status:

ad_storage: denied
ad_user_data: denied
ad_personalization: denied
analytics_storage: denied

These four signals are held denied until the visitor allows storage. The moment the visitor declines or withdraws consent, all four signals are immediately set back to denied, blocking all advertising beacons and tracking cookies.

Third-Party Data Processors

We name each third party receiving data along with links to their privacy governance documentation.

Personal data is shared only with designated service providers necessary for website operations and campaign evaluation:

Google Ireland Ltd / Google LLC: Operates Google Ads conversion tracking and processes consent signals.
Microsoft Ireland Operations Ltd: Operates Microsoft Advertising and processes campaign attribution. Their data handling is documented at privacy.microsoft.com.
Meta Platforms Ireland Ltd: Operates Meta Ads conversion attribution for social marketing campaigns.
Hosting Provider: The hosting provider that serves this site and stores the enquiry database on secure infrastructure in the United States.
Mail Provider: The mail provider that carries the notification of your enquiry directly to the operator's inbox.

International Data Transfers

Transfers outside the country of origin are secured by standard contractual safeguards.

Our workshop counter and hosting infrastructure are located in Portland, Oregon, United States. Visitors accessing this website from outside the United States transfer data directly to our US server environment. All international data transfers originating from the European Economic Area are rendered lawful through European Commission Standard Contractual Clauses (SCCs) and contractual data processing agreements entered with our technology providers.

Data Retention Periods

We retain records for definite operational windows, never indefinitely.

We enforce real retention periods across each category of collected data:

Enquiries and their email copies: 24 months (to reference previous component dimensions and past quote proposals).
Chat transcripts: 12 months (to maintain customer support records).
Server and access logs: 90 days (for routine cybersecurity defense and error analysis).
The record of a consent choice: 6 months (stored in your browser under site_consent_v2).
Data request response: A data request is answered within 7 days.

Security Measures

Technical and physical safeguards protect all workshop data against unauthorized access.

We deploy robust technical and organizational protections including modern TLS 1.3 cryptographic protocols, encrypted web transmissions, perimeter server firewalls, isolated database permissions, automated honeypot filters against bot submissions, and role-based access restricted strictly to trained Portland workshop technicians.

European Privacy Rights (GDPR)

European visitors have enforceable statutory rights regarding their personal data under the GDPR.

Under the gdpr, visitors reaching our site from Europe possess full statutory rights:

Access: The right to request confirmation of whether we hold your personal data and obtain a copy of those records.
Rectification: The right to correct inaccurate or incomplete technical details or contact information.
Erasure: The right to obtain deletion of your inquiry details and chat logs ('right to be forgotten').
Restriction: The right to restrict the processing of your data under specific statutory circumstances.
Portability: The right to receive your personal data in a structured, machine-readable format.
Objection: The right to object to data processing based on legitimate interests.
Withdrawing consent: The right to withdraw previously granted cookie or marketing consent at any time without negative effect.

United States State Privacy Rights (CCPA / CPRA)

State privacy rights under California and Oregon statutes provide transparency and opt-out privileges.

Residents of California, Oregon, and other US states with active privacy laws enjoy specific consumer protections. Under the California Consumer Privacy Act (ccpa) as amended by the CPRA, and under Oregon law, you have the right to know what personal categories are collected, the right to request deletion of your information, the right to correct inaccurate records, and the right not to face discriminatory pricing for exercising statutory privacy privileges. We do not sell personal data or share personal information for cross-context behavioral advertising.

Global Privacy Control (GPC)

Our web server natively detects and honours browser-level opt-out signals without manual intervention.

We actively respect global privacy control signals. If your web browser emits the Sec-GPC header, our system automatically treats it as a valid, binding opt-out request for advertising tracking and optional analytics. No marketing tags will fire and no non-essential cookies will be stored during your visit, without requiring you to reopen our consent dialog.

Children's Privacy Protection

This site is not for children and takes no data from them.

Our website, component catalogue, and workshop services are directed exclusively to adults and tabletop hobbyists aged 18 and older. The site is not for children and takes no data from them knowingly. If we learn that personal details have been transmitted by a minor under 16 years of age, we delete the corresponding records immediately.

Supervisory Authority Complaints

Visitors have the right to lodge formal complaints with appropriate enforcement authorities.

If you believe our data processing violates applicable privacy laws, you possess the right to file a formal complaint with a competent supervisory authority. In the United States, complaints may be directed to your state Attorney General (such as the Oregon Department of Justice) or to the California Privacy Protection Agency in California. In the European Union, you may contact the national data protection commissioner in your country of residence.

Exercising Data Rights & Request Protocol

Submit privacy requests directly to our Portland desk; an answer is provided within 7 days.

To exercise any statutory right under the GDPR, CCPA, or Oregon privacy laws, submit a written inquiry to our administrative desk:

Email: office@boardgamestore.click
Postal Address: 1500 Southwest 1st Avenue, Portland, Oregon 97201, Portland, Oregon, United States

We verify the identity of the requester against past inquiry details. A data request is answered within 7 days without administrative fees.

Changes to this Policy

Policy amendments are published directly to this page with an updated effective date header.

Any revisions to our data handling practices or regulatory disclosures are announced by updating this page with an amended effective date. Significant operational changes affecting inquiry handling or advertising parameters will be highlighted through a prominent notification banner on the catalogue homepage.

Direct Human Contact Information

Reach a real human at our Portland workshop desk via email, phone, or in-person visit.

For questions regarding our privacy practices or component data handling, contact our workshop team directly:

Email: office@boardgamestore.click
Telephone: +1 (340) 865-3475
Postal Address: 1500 Southwest 1st Avenue, Portland, Oregon 97201, Portland, Oregon, United States
Counter Hours: Monday through Sunday, 2:00 PM – 10:00 PM PST