Privacy Policy

Who we are

Sogverse is run by School of Gaming Galactic Oy ("School of Gaming", "we", "us"), a Finnish company. We’re responsible for looking after the personal information you and your child share with us — in legal terms, we’re the "data controller".

Here are our official details:

• School of Gaming Galactic Oy (business ID 3110461-1)
• Isokatu 56, 90100 Oulu, Finland
• Email: help@sog.gg

The information we collect

We try to collect as little as possible — only what we genuinely need to run Sogverse. Here’s what that looks like:

• Your name, email address, and (if you add one) phone number — so we can set up your account and keep in touch about your child’s clubs.
• Your language and currency preferences — so the site shows up the way you expect.
• Your password, which we store only in a scrambled (hashed) form — we can never see it.
• Payment details are handled directly in Stripe. We never see or store your full card number.
• About your child: their first name, their birth month and year (we don’t ask for the full date — only what we actually need), and optionally their gender — so we can place them in the right group and address them properly. We store your family surname on their account too, because your child is part of your account; Gedus and other gamers never see it. Their account itself uses an internal Sogverse address rather than a real email, unless you choose to give them a sign-in with their own email address; we then hold that address and send them their own copy of the emails we send you about their clubs, camps and events.
• Optionally, your child’s username in the games their clubs use — today that’s Minecraft and Roblox — and the account id that game gives them, so we can recognise them in the game and so they can connect to our Minecraft server during sessions.
• Session records our Game Educators write — attendance, session reports, and short notes that help us support your child in the group.
• Messages your child sends in a session’s chat — so the Gedu and the group can read them during the session, and so we can look into a concern afterwards. A message your child removes is hidden from the group but kept until the account is closed.
• Feedback your child gives us about their sessions — any ratings and any note they choose to give when we ask how a session went — so we can see how our sessions are going and make them better.
• The technical information any website needs to run — sign-in sessions, request logs and, only if you choose it, anonymous usage statistics. See "Technical information" and "Cookies, analytics and advertising" below.
• The campaign tag — source, medium, campaign, content and term — carried by the link you arrived through. We store it on your account when you create it, and on each place you book or waiting list you join, and only if you’ve allowed marketing cookies when you do, so that we and our partners know which outreach actually reaches families, and so we can tailor the emails we send you. The link can be one you followed up to 30 days earlier, as "Cookies, analytics and advertising" below explains. Saying no to marketing later doesn’t remove a tag that was already stored.
• Which of our pages you were on your way to when you created your account — a club, camp or event, your municipality’s club, or one of our landing pages — so we know what brought you to us.
• Your answer to the marketing question when you created your account, and, when a club, camp or event asks it as you book a place or join its waiting list, your answer to its box for our emails, which starts unticked. We keep a record of each answer as you gave it, and a yes to either signs you up for our marketing emails. After that, your choice is held by Klaviyo, which sends them, and you can change it at any time in your Sogverse settings or with the unsubscribe link in any of our emails.
• If you sign up for our newsletter on one of our pages: your email address, and your first and last name if you give them. With them goes the language of the page and which page it was, and the campaign tag of a link you followed in the last 30 days if you’ve allowed marketing cookies. It all goes straight to Klaviyo, which sends our newsletter, and Sogverse keeps no copy of the sign-up. Signing up doesn’t need an account.

Technical information

Running a website means some technical information passes through the companies that host and secure it for us. None of it is something we ask you for, and we don’t keep a copy of it in any table of ours — it exists in our providers’ systems for as long as they need it to keep the site working and safe, and we don’t extend that. Here is what it is and where it goes:

• Sign-in records — when you sign in, Supabase, which runs our accounts, keeps a record of the session: when it started, the browser and device it came from and its internet address. That is what lets us keep you signed in and end a session that shouldn’t be there. The record is deleted when the session ends, and everything goes when the account does.
• Requests and errors — every page you open is a request to Vercel, which hosts the site. Like any host, Vercel logs it: the page, the time, your browser and device type and its internet address, and any error it caused. We use those logs to keep the site running and to find faults. Vercel also counts requests to each part of the site on its own servers — totals, not people — and that count runs without any cookie or consent. It is separate from the analytics you can switch on or off below.
• Cookies and analytics — a few necessary cookies, and analytics and marketing only if you choose them. All of it is set out in "Cookies, analytics and advertising" below.
• Live sessions — during a voice session your child’s device connects to Daily.co directly, so Daily sees its internet address and connection details for the length of the call. See "Voice and video sessions" below.
• What we don’t do — we don’t run an error-tracking or logging service of our own, we never store your internet address or browser details in any table of ours, and none of this is used to build a profile of you or your child.

Children’s privacy comes first

Most of the people using Sogverse are children, so their safety and privacy is our highest priority.

A child can never create their own account. Only a parent or guardian sets up a child’s account, chooses what to share, and gives permission on their behalf. That’s how we meet our responsibilities under data-protection law when it comes to children.

What we hold about a child is set out above under "The information we collect" and "Technical information", and we don’t collect anything about a child beyond what we need to run our clubs, camps, and events. We never show children advertising, and we never sell their data or share it with anyone for that company’s own marketing. A few details about your child do go to Klaviyo, our email marketing tool, so we can choose which of our emails suit your family — never their name, and exactly which details is set out under "The companies that help us run Sogverse" below. Our marketing emails only ever go to a parent, never to a child. When your child is signed in as a gamer, nothing about their browsing is sent to an advertising platform, even if marketing is switched on for the device. Live sessions are run by our trained Game Educators (we call them Gedus).

If you ever want to see, change, or delete your child’s information, just email help@sog.gg and we’ll take care of it.

How we use your information

We use the information above only to run Sogverse and give your family a good experience — specifically:

• To create and manage your account and your child’s account.
• To place your child in the right club, camp, or event group and connect them with a Game Educator.
• To run the live voice and video sessions.
• To take payments and send receipts, reminders, and important updates about your clubs.
• To send our marketing emails and our newsletter to the people who said yes to them, and to choose which of them suit your family — news of a Roblox club for the parents of children who play Roblox, say.
• To understand who our customers are — which ages, games and places our clubs reach — so we can plan what we offer next.
• To answer your questions when you contact us for help.
• To keep Sogverse safe, fix problems, and make it better over time.

Why we’re allowed to use it

Data-protection law (the GDPR) asks us to have a clear reason for using your information. Ours are simple:

• To deliver what you signed up for — the clubs, camps and events you’ve signed your child up for, paid or free (our contract with you).
• Because a parent has given permission on their child’s behalf (consent).
• To meet our legal duties, such as keeping accounting records for payments.
• For our legitimate interest in keeping the site secure and working well — always balanced against your privacy.
• For our legitimate interest in understanding our own customers and keeping our marketing relevant to them — the reason we keep a profile of every parent account in Klaviyo, whether or not you’ve said yes to marketing emails. Having a profile never means getting marketing emails you haven’t agreed to.
• Your consent, for our marketing emails and the newsletter — which you can withdraw at any time with the unsubscribe link in every one of them, or, if you have an account, in your Sogverse settings.
• Your consent, for the analytics and marketing cookies and the campaign tag — which you can withdraw at any time from Privacy choices at the bottom of every page.

The companies that help us run Sogverse

Running an online service means relying on a few trusted companies for things like hosting, payments, and email. They only handle your information to do their job for us, under contracts that require them to keep it safe. The main ones are:

• Supabase — securely stores your account, family, and club information.
• Stripe — processes payments. Your card details go straight to Stripe; we never see them.
• Brevo — sends our emails, such as receipts and reminders.
• Klaviyo — sends our marketing emails and the newsletter, holds your choice about our marketing emails, and holds a profile of every parent account, so we can understand our customers and choose which emails suit which family. The profile is kept up to date as you use Sogverse, whether or not you’ve said yes to marketing emails. It holds your name, email address and phone number, the language you read Sogverse in (which our emails to you are written in), the languages you speak, the municipality and country you gave as your home, and your currency; when you created your account and confirmed your email address; the campaign tag on your account, if you allowed marketing cookies, and which of our pages you were on your way to when you created it; and your answer to the marketing question. About your children it holds only how many you have, each child’s birth year and their gender if you gave it, and whether a Minecraft or Roblox account is linked — never their names or birth months. About your family’s places, it holds the kinds and topics of the clubs, camps and events your family has places on, paid or free, finished ones included, the date the last of your paid places runs to, and what you’re on a waiting list for; and about payments, when you first and last paid and how much you’ve paid in all. With that goes a record of when you created your account, joined a waiting list (with the campaign tag, if you had allowed marketing cookies when you joined), were offered a place or cancelled a subscription, and of every place booked, paid or free: which club, camp or event it is, whether it is paid, free or paid for by your municipality, whether it is your child’s or your own, your child’s birth year and gender, where and in which language it runs, and the campaign tag, if you had allowed marketing cookies when you booked. Each time your child, or you on a place of your own, is marked present or absent at a session, Klaviyo receives that mark too. Klaviyo also keeps lists of the families who have ever had an account, a club, a camp, an event or a municipality’s club with us. Deleting your account deletes its profile in Klaviyo too. Klaviyo also receives newsletter sign-ups from our pages (see "The information we collect").
• Daily.co — powers the live voice and video sessions; your child’s device connects to it directly during a session.
• Vercel — hosts the website, so every request passes through it (see "Technical information"), and provides anonymous usage statistics if you allow analytics.
• Meta (WhatsApp) — used to send some messages and reminders to families who prefer WhatsApp.
• Roblox — receives your child’s Roblox account id, so we can confirm the account, and your browser fetches their avatar picture from Roblox directly.
• Mojang (Microsoft) — receives your child’s Minecraft username, so we can confirm the account.
• mc-heads.net — your browser fetches the picture of your child’s Minecraft character from it directly, using their Minecraft username, which is public in the game. It is a free public service rather than a contractor of ours, and it sees only that request.
• Meta (Facebook and Instagram) — through the Meta Pixel in your browser and reports from our servers, sees how you use our site, so we can show you our ads there and measure how they perform. When you create an account or sign up, our servers also send Meta scrambled (hashed) copies of your email address and of your School of Gaming account id, and which club, camp or event you signed up for or created your account from, so it can recognise you if you use Facebook or Instagram and tell that it is the same parent from one visit to the next. Neither the address nor the id itself is ever sent, and never your child’s name, age or other details about them. Only if you allow marketing cookies.
• Reddit — through the Reddit Pixel in your browser and reports from our servers, sees how you use our site, so we can show you our ads there and measure how they perform. When you create an account or sign up, our servers also send Reddit scrambled (hashed) copies of your email address and of your School of Gaming account id, and which club, camp or event you signed up for or created your account from, so it can recognise you if you use Reddit and tell that it is the same parent from one visit to the next. Neither the address nor the id itself is ever sent, and never your child’s name, age or other details about them. Only if you allow marketing cookies.
• Google (Analytics and Ads) — through a tag manager in your browser, sees which of our public pages you visit and what you signed up for, so we can measure how our advertising performs and show you our ads. Only if you allow marketing cookies — not analytics: the analytics you can switch on is Vercel’s alone.

The Creator Academy, run with Lynx Educate

If you enrol your child in the Creator Academy, which we run in collaboration with Roblox, we share what the programme needs with Lynx Educate, who deliver it with us, and a limited set with Roblox for its research into the programme. Lynx Educate receives:

• The campaign tag on your account — source, medium and campaign — so they can see which outreach brought your family to the programme.
• Your first name, surname and email address — so they can reach you about the programme.
• The municipality and country you gave as your family’s home, if you gave one.
• Your child’s first name.
• Your child’s birth month and year — we never ask for the day.
• Your child’s Roblox username and the account id Roblox gives it.
• Which terms and policies you accepted when you enrolled, and your answers to the marketing and photography questions.
• The enrolment itself — the club, camp or event, the group your child is in, and when they signed up.
• Whether your child was marked present or absent at each session.
• The title and link of anything your child publishes on Roblox, as a Game Educator records it.
• Photographs attached to a session report — only where you allowed photography.

Lynx uses it to run the programme, on the basis of the programme terms you accept when you enrol and its legitimate interest in running it safely — except the campaign tag, which is shared only if you allowed marketing cookies, and photographs, which are shared only where you ticked the box. What Roblox receives, and everything else about the programme, is in the Creator Academy Privacy Policy.

Cookies, analytics and advertising

A few cookies are simply how the site works: they keep you signed in and remember when you’ve switched between the accounts in your family, remember that you entered your parent PIN, hold your language and timezone, store the cookie choice you make, and remember that you’ve closed the guide we show before a first session. These don’t need your consent — without them there is no site to consent to.

Everything else waits for you. The first time you visit we ask, and nothing beyond those necessary cookies runs in your browser until you answer. You can change your mind whenever you like from Privacy choices at the bottom of every page: switching something off takes effect straight away, and it doesn’t change anything we already did while it was on.

There are two things to say yes or no to:

• Analytics — Vercel’s, and only if you choose it. It counts visits, measures how quickly pages load, and receives a few anonymous events about how the site is used: how someone reached their My SOG, when someone changes the language. It can’t see who you are, and we never hand it to advertisers.
• Marketing — advertising cookies, only if you choose them. They let the advertising platforms named above — today, Meta, Reddit and Google — see how you use our site, so they can show you our ads and we can tell which ads work. Google’s tags reach your browser through a tag manager, which lets us and the partner who runs our campaigns add or remove a platform without changing the site; whichever platforms it carries are named in the list above, and that list carries a date. If you allow marketing, a small cookie of our own also remembers for 30 days which campaign link brought you here — that is the campaign tag described above — and a later campaign link replaces it. It is set only with marketing consent. If you create an account, book a place or join a waiting list while it is there and marketing is still allowed, the tag is stored with it too, and goes to Klaviyo with your account’s profile or the record of the booking or of joining the waiting list, so we can tailor the emails we send you. The advertising scripts never run, and our own cookie is never written, while a gamer is signed in. Switching marketing off deletes these cookies, our own included, and the small amount of data these scripts keep in your browser alongside them, but not what the platforms already hold — you can ask them to delete it in your settings with them.

Voice and video sessions

Live clubs, camps, and events take place over voice and video, powered by Daily.co. Sessions are run live by our trained Game Educators, and we use it only to deliver the session your child signed up for.

Your child’s device connects to Daily.co directly for the call, so Daily sees its internet address and connection details for as long as the session lasts, and Daily’s own software reports faults it meets in the browser back to Daily. To put your child in the right room we give Daily their first name and, where they have added one, their game username and the id that game gives them, so the Gedu and the other gamers in the room can see who is speaking. The audio and video are not recorded.

How long we keep your information

We keep your information for as long as you have an account with us. If you close your account, we delete or anonymise your information — except where the law requires us to keep certain records longer, such as Finnish accounting law, which requires payment records to be kept for several years.

Closing your account deletes everything Klaviyo, our email marketing tool, holds under your account’s email address — a newsletter sign-up made with that address included. A newsletter sign-up made with a different address stays with Klaviyo until you ask us to delete it.

Where your information is kept

Some of the companies that help us (listed above) are based outside the European Union, for example in the United States. When your information is sent to them, we make sure it’s protected by the safeguards data-protection law requires — usually the European Commission’s Standard Contractual Clauses.

Your rights — and your child’s

You’re in control of your information. At any time you can ask us to:

• Show you what information we hold about you and your child.
• Correct anything that’s wrong.
• Delete your information (the "right to be forgotten").
• Give you a copy to take elsewhere.
• Stop or limit how we use it.

Keeping your information safe

We protect your information with industry-standard measures: encrypted connections, passwords stored only in scrambled form, and strict limits on who can access data. No system is ever perfectly secure, but we work hard to keep your family’s information safe.

Changes to this policy

We may update this policy from time to time — for example, if we add a new feature. When we make an important change, we’ll update the date at the top and, where it matters, let you know.

Getting in touch and your right to complain

To use any of the rights above, or if you have a question about your privacy or your child’s information, just email help@sog.gg. There’s no charge, we’ll always reply, and email is the best way to reach us.

If you’re ever unhappy with how we’ve handled your information, you have the right to complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) at tietosuoja.fi(opens in a new tab).