Compliance
Trust, security and compliance
Strategy in Play is built with privacy and data security as a foundation. Here you can see who processes data on our behalf, where data is stored, and how we protect it.
Data controller
EXP//LABS (VAT DK46109937), represented by Henrik Stender. Address: Strandvejen 177, 2900 Hellerup, Denmark. Contact: henrik@stender.dk.
Where data is stored
All personal data and workshop data is stored in Lovable Cloud, which runs on Supabase infrastructure with EU-based databases. Static files and cache are served via Cloudflare's global CDN. Real-time video relay (TURN) for live streaming is provided by Twilio. Emails are sent from notify.strategyinplay.com.
Security measures
- Encryption in transit (TLS/HTTPS) and encryption of files and storage.
- Row Level Security (RLS) in the database so each user can only see their own data.
- Role-based access control (super admin, org admin, facilitator, client viewer).
- Short-lived tokens for live streaming and TURN relay — no static credentials in the browser.
- Automated security scans and dependency updates.
- Consent logging and IP-limited logging in the admin interface.
Sub-processors and services
We only use necessary, GDPR-compliant sub-processors. Standard Contractual Clauses (SCC) and DPAs are in place where required.
| Service | Purpose | Region | Basis |
|---|---|---|---|
| Lovable Cloud / Supabase | Database, auth, storage, realtime | EU | DPA + SCC |
| Cloudflare | CDN and DNS | Global (GDPR-compliant) | DPA + SCC |
| Twilio | TURN relay for WebRTC live streaming | Global (GDPR-compliant) | DPA + SCC |
| OAuth login | US/EU | DPA + SCC | |
| OpenAI / Lovable AI Gateway | AI-generated text (reports, company profiles, chatbot) | US/EU | DPA + SCC |
| Firecrawl | Web scraping for company profiles (public websites only) | US/EU | DPA + SCC |
| Lovable Email | Transactional emails (login, invitations) | EU | DPA + SCC |
Your rights
- Right to access the data we hold about you.
- Right to rectification of inaccurate data.
- Right to erasure (right to be forgotten), unless we are required to retain data.
- Right to data portability.
- Right to object to processing.
Cookies, AI and consent
We only use functional and analytical cookies. You can change your consent at any time via the cookie banner. Our chatbot and AI features only answer questions about Strategy in Play and LEGO® SERIOUS PLAY®; they cannot book, price or enter agreements on behalf of the company.
Contact us about data
If you have questions about data security, GDPR, or want to exercise your rights, write to us at henrik@stender.dk.
Last updated: September 2026.