Who we are
Paulapagliad Ressage (paulapagliadressage.com) is responsible for the personal information described here. This policy explains what we collect, why, where it's kept and the choices you have under UK data protection law (UK GDPR and the Data Protection Act 2018).
This website is operated by (company number ), .
What we collect
- When you sign up: first name, last name, email address, UK phone number and a password. Your password is turned into a scrambled code (a hash) before it is saved, so it is never stored as you typed it.
- If you sign up with Google: your name, verified email address and Google account ID, sent by Google and checked by our server with Google. We ask for your phone number separately.
- While you use your account: your coin balance, XP and level, the games you open, when you last collected your daily bonus, when you joined, your last sign-in and a count of failed sign-in attempts (five wrong tries pause sign-in for 15 minutes).
- When you contact us: your name, email, topic and message.
We never ask for or store card or bank details.
Where it's kept
Your account is stored on our server as a protected file that can't be opened from the web. We don't use a public database, and your details are never written into our pages, shown in tables or put in the address bar. When you're signed in, the page asks our server for your name, email, balance and level over an encrypted connection; your password hash is never sent to your browser.
Messages you send through the contact or Player Care forms are processed on our server and emailed securely to our support inbox through our email delivery provider.
Form records: our server keeps a short record of each form submission in protected log files (for example the date, the form used, your name, email and, for messages, the topic and message) so we can reply, deal with requests and spot misuse. Passwords are never written to any log.
Why we use it
| Purpose | Information | Lawful basis |
|---|---|---|
| Create and run your account, coins and levels | Sign-up details, account activity | Contract (providing the service you asked for) |
| Check you are 18+ and in the UK | Your confirmations, phone number | Legitimate interests and legal obligations |
| Keep accounts secure and prevent misuse | Sign-in times, failed attempts, form records | Legitimate interests |
| Reply when you contact us | Name, email, topic, message | Legitimate interests |
| Breaks, restrictions and responsible play | Your request and account details | Legitimate interests |
We don't sell your information and we don't use it for advertising.
Who we share it with
- Our hosting provider, which runs the server where your account and form records are kept.
- Our email delivery provider (Brevo), which delivers contact and Player Care messages to our inbox.
- Google, only if you choose to sign in with Google. Google's own privacy policy applies to that.
- Authorities, if the law requires it.
Where a provider handles data outside the UK, we rely on UK-approved safeguards such as adequacy regulations or standard contractual clauses.
How long we keep it
- Account: until you delete it from My account or ask us to delete it.
- Messages and form records: up to 12 months, or longer only if we need them for an open request or a legal reason.
Keeping it safe
- The site is served over HTTPS, so information you send is encrypted on the way.
- Passwords are hashed with PHP's built-in password hashing.
- Account files and logs sit in folders that are blocked from the web.
- Your sign-in uses a secure, HTTP-only session cookie that page scripts can't read.
- Repeated wrong passwords pause sign-in for 15 minutes.
Your rights
You can ask to see, correct or delete your information, ask us to restrict or stop using it, or ask for a copy to take elsewhere. You can delete your account yourself at any time from My account. To make a request, use the contact form with the topic “Privacy question” or email .
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
The site is only for adults aged 18 and over. We don't knowingly collect information about anyone under 18. If you think a child has created an account, please contact us and we'll delete it.
Cookies
We use one strictly necessary cookie to keep you signed in, and browser storage for your age check and cookie choice. See the Cookies Policy for the full list.
Changes to this policy
We'll update this page if anything changes. The date at the top shows the latest version.