Privacy notice
Last updated: .
1. Who is responsible for your data?
Michael Demetriou, Andrea Kyriakou 16, Konia 8300, Pafos, Cyprus. Contact for any question or request: info@carrecards.com. No data protection officer (DPO) has been appointed.
2. What data, why, on what basis?
| Data | Why | Legal basis |
|---|---|---|
| A random player id, a device secret (a random key we create; no advertising id or hardware id), the declared age band | Create and protect your account; refuse minors | Contract (providing the game); 18+ requirement |
| If you link an account: Apple or Google subject (kept as an encrypted fingerprint), or e-mail address (kept encrypted) and password (kept only as a derived hash, never in clear) | Recover your account on a new device; send a reset code | Contract |
| Game data: matches, hands and results, coin balance and movements, purchases, settings | Run tables, balance the coin economy, prevent fraud, leaderboards | Contract; legitimate interest (security, anti-cheating) |
| Chat: preset phrases in matches; free text only in the lobby and clubs | Player communication | Contract |
| Ad-consent choice (answer, date, text version, screen) | Prove your choice; configure ads | Legal obligation / proof of consent |
| Minimal technical data: we do not store or log your IP address; it is held in memory only to limit connection abuse. An error line in the proxy log may occasionally contain one, inside a log kept for at most 30 days | Security and operation | Legitimate interest |
| Purchases: payment is handled by the App Store (Apple) or Google Play; we receive no card or bank details, only the purchase confirmation | Deliver your coins; accounting | Contract; legal obligation |
| Rewarded ads (once they are live): Google AdMob, provided in the EEA by Google Ireland Ltd, with Google's consent prompt. Google may process your device's advertising id and technical data; personalised ads only if you consent, never for an account declared under 18 | Fund the game | Consent (personalised ads); legitimate interest (non-personalised) |
| Beta sign-up, if you use the form on the site: your e-mail address (lower-cased), the language you chose, the date and time of sign-up and the version of this notice shown. Nothing else: no IP address, device or browser. Kept in our own database and not shared with a mailing-list service; the e-mails are sent through our delivery provider (see section 3) | Tell you about the beta and the launch | Consent, given when you send the form |
Your display name and avatar stay on your device: we do not keep them on our servers, and other players see you as "Player NNNN". We do not ask for your name, phone number or date of birth. We do not sell your data.
3. Who receives it?
Our authorised people and our technical providers:
- host Contabo GmbH (servers in Germany);
- backup storage Scaleway (Paris);
- e-mail delivery Resend (Plus Five Five, Inc., United States);
- Apple and Google, for purchases and sign-in;
- Google Ireland Ltd, for ads, once they are live.
Transfers outside the EEA: Resend processes e-mail in the United States under the EU-US Data Privacy Framework and standard contractual clauses. Once ads are live, Google Ireland Ltd transfers data to Google LLC (United States).
4. How long?
- Account and sign-in methods: until you erase your account; the sign-in methods are then removed at once.
- Match and coin history: for the life of the service, under a random id that, after erasure, is no longer linked to you.
- Consent history: 36 months after it is replaced by a newer choice.
- Beta sign-up e-mail: until you ask us to remove it, or until we close the beta list, whichever comes first. To ask, write to info@carrecards.com or use the site's request form (see section 5); the address is then deleted for good.
- Server logs: 30 days.
- Backups: 28 days; host snapshots: 30 days at most.
5. Your rights.
You have the right of access, rectification, erasure, restriction, objection and portability. You can withdraw consent at any time, without effect on the past. In France you can also leave instructions on your data after your death. To exercise these rights, write to info@carrecards.com or use the site's request form. We send a confirmation link to the address given; once the request is confirmed we reply within 30 days. We can only act if we can link the account to you (for example through a linked e-mail): an unlinked anonymous account cannot be identified, and its coin balance cannot be restored.
Erasure: we delete the sign-in methods linked to your account and end your sessions; match and coin history stays under a random id that is no longer linked to you.
6. Complaints.
You may complain to a supervisory authority: in France the CNIL (www.cnil.fr); in Cyprus the Commissioner for Personal Data Protection (www.dataprotection.gov.cy); or the authority in your country of residence.
7. Required or optional?
An account is needed for online tables. Solo mode works without a linked e-mail. Refusing personalised ads does not stop you playing.
8. Minors.
The game is for 18 and over; we do not knowingly collect minors' data. If you think a minor is using the game, write to info@carrecards.com.
9. Security.
Encrypted connections, passwords stored as hashes, e-mails encrypted at rest, restricted access.
10. Changes.
We will publish changes here with the date.