Last updated 3 October 2026

This page says what personal information Ridiculus handles, why, who else is involved, how long we keep it, and what you can ask of us. We have tried to keep it plain. If anything here is unclear, write to info@ridiculus.co.

Ridiculus is a sole proprietorship (eenmanszaak) run by Kaan Ertenli (KVK 97337854), based at Hugo de Grootplein 20, 1052 KX Amsterdam, the Netherlands.

Three situations

Which part of this page applies to you depends on how you meet us.

• You visit this website or write to us. We decide why and how your information is used, so we are responsible for it. See “This website”.
• You are a member of an organisation that uses our panel. We create and secure your account. See “The panel”.
• You are a player, or the parent or carer of one. The organisation that runs the sessions is responsible for what is recorded about you. We are its processor. See “Players”, and ask the organisation first.

This website

What we receive. Our hosting provider receives the technical details every web server receives when a page is requested: your IP address, the page asked for, the time, and your browser type. We use this only to deliver the site and keep it secure, because running a website safely is a legitimate interest of ours.

What we do not do. We set no cookies, we do not measure visits, we load no advertising or tracking from anyone, and the fonts you see are hosted by us, not fetched from another company.

The contact form. If you use it, we receive your first and last name, email address, country, the organisation you name if you give one, and whatever you write. We use it to reply and to talk about working together, which is a step you ask us to take before any agreement, and a legitimate interest of ours in answering the people who write to us. The form sends your message to a function on our own server, which is in Ireland. That function passes it on by email, through Resend in the European Union, to our inbox, which is hosted with Google Workspace. Our server keeps no copy of the message. It keeps only a scrambled marker of your visit for up to a day, which cannot be turned back into your address, so that one visitor cannot send a flood of messages. We keep a message in our inbox for as long as we need it to deal with your request. If no agreement follows, we delete it within 12 months of our last contact.

The panel

The panel is the web page where members of an organisation set up sessions, watch them, and read what happened. Accounts are created by invitation only. For each member we keep an email address, a role (Member or Admin) and the sign-in details needed to secure the account. Admins must use a second sign-in step. We use this information to provide and secure the panel, and to send invitations and password resets. These emails are sent for us by Resend, in the European Union. We also use your email address to tell you about changes to the service that affect you. A member’s account stays until an Admin of the organisation removes it.

The panel remembers your sign-in and a few preferences, such as your chosen layout, in your browser. This is needed for it to work and is not used to track you. See Cookies.

Players

Our games are for ages 10 and up and are played in sessions that an adult from an organisation sets up and stays with. Players do not create accounts, and nothing in the panel is meant for a child to use alone. The organisation is the controller of what is recorded about its players. We are its processor and act on its instructions, under a written agreement. If you are a player or a parent or carer, please ask the organisation first. We will help it answer you.

What is recorded.

• A name or nickname that the organisation enters for the player. We recommend a first name or nickname.
• For each session: which game, when it was played, which exercises were shown, each move on the rods and when it happened, the answers typed, and how long each took.
• Measurements that fit the game to the room and the player, such as standing height, reach and how high they jump.
• Notes and saved sets of exercises that the organisation’s members write.
• Observations the panel draws from the above. These come from fixed, written rules and describe what happened. They are not decisions, and a person decides what, if anything, to do with them.

What is not recorded. We do not store video, audio or photographs. During a session a member can watch the player’s view live. That stream is passed through a relay service while it is watched and is not stored. We do not ask for medical information or reports, and we ask organisations not to enter any.

Why we treat it with care. A record of how someone works with numbers can say something about how they learn. Depending on how an organisation uses a game, for example when a child plays as part of care or support, what is recorded can count as data concerning health. We do not ask for medical information, and we handle all player information to the standard the law sets for health data. It is visible only to members of the organisation that recorded it. Our own administrators cannot open an organisation’s players, sessions or notes in the panel. We can reach the underlying database to run and repair the service, and we do that only when it is needed for that.

The headset. The headset’s own system software is made by the headset maker and has its own privacy terms, which we do not control.

What schools ask us

The Dutch data protection authority has asked suppliers of digital learning tools to be open about a short list of things. Here are our answers, in one place.

What do you collect, and where is it kept?

What is listed under “Players” above, and nothing else. Player records are stored in Ireland, in the European Union.

Who can see it?

Members of the organisation that recorded it. Our own administrators cannot open players, sessions or notes in the panel.

How do pupils and parents use their rights?

Through the organisation, which is responsible. We help the organisation answer, and deleting a player in the panel deletes their sessions and notes.

Are you part of a company in the United States?

No. Ridiculus is based in Amsterdam and is not part of a company in the United States. Some of the providers we use are American, and they are named above.

Do you build profiles of children?

The panel shows what happened in a session, and patterns across a child’s sessions, such as which kinds of exercise went well. These come from fixed, written rules, are visible only to the organisation’s members, and are not used to rank, score or make decisions about the child.

Is pupil information used to train AI?

No. We will not use it for that, or for any purpose of our own, without the organisation’s written agreement.

Does AI or automated decision-making affect pupils?

No. No AI processes player information today, and no decision about a child is made automatically.

What if Ridiculus is sold or merges?

We will tell organisations before any change of ownership takes effect, and player information stays under the same terms.

Who else handles information

We use these providers to run the service. Each handles information only to do the job described.

Supabase

Our database, sign-in and server functions, including the function behind the contact form. Information is stored in Ireland, in the European Union. Supabase is a company based in the United States.

LiveKit

Relays the live view of a session to the member watching it. Nothing is stored. Our LiveKit project is set to the European Union (Frankfurt) data region. LiveKit is a company based in the United States.

Netlify

Hosts this website and the panel’s pages. It sees the technical details described under “This website”. No player information is stored there. Netlify is a company based in the United States.

Resend

Sends the panel’s invitation and password emails, and delivers messages from the contact form to us, in the European Union.

Google Workspace

Hosts our email, so messages you send us are stored there. Google is a company based in the United States.

We do not use AI services on player information. If we ever do, it will be switched off unless the organisation turns it on, anything written by AI will be labelled as such, and we will update this page first.

Information that leaves the European Union

Several providers above are based in the United States, so some information, such as IP addresses, email and the live view, can be handled there. Where that happens, we rely on the safeguards European law requires, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework, as set out in each provider’s terms. Players’ records are stored in the European Union.

How long we keep it

• Players’ information: for as long as the organisation keeps the player in its account. When the organisation deletes a player, that player’s sessions and notes are deleted with them. If an organisation ends its agreement with us, we delete its information. Backups held by our database provider are overwritten as part of their normal cycle.
• Members’ accounts: until an Admin removes them.
• Contact messages: as described above.
• Server logs: for the period our hosting provider keeps them.

How we keep it safe

• Accounts are by invitation only, and Admins must use a second sign-in step.
• Each organisation’s information is separated from every other’s inside the database itself, not only on the page.
• Information travels over encrypted connections, and our database provider encrypts stored information.
• A headset proves who it is with a secret that we store only in scrambled form.

No system is perfectly safe. If something goes wrong that affects your information, we will tell the organisation without delay, and the authorities where the law requires.

Your rights

You can ask us to give you a copy of your information, correct it, delete it, limit how it is used, or move it to another service. You can object to use that rests on our legitimate interest, and you can withdraw any consent you gave. Write to info@ridiculus.co. We reply within one month. For a player’s information, the organisation decides, and we will pass your request to it and help it respond.

If you think we handle your information wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. We would like the chance to put it right first.

Changes

If we change how we handle information, we will update this page and its date. For changes that affect an organisation’s players, we will tell the organisation directly.