Privacy notice

1. Who is responsible

Mussuela Digital, Unipessoal Lda., registered in Portugal (NIPC 516284793), with its registered office at Rua do Sol 25, 3800-390 Aveiro, Portugal, operates emberlowe.com and is the controller responsible for the personal data described in this notice. Every privacy request and question goes to privacy@emberlowe.com, which reaches the person who handles privacy at Emberlowe directly. Reply times are set out under your rights below. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Because we are established in Portugal, the EU General Data Protection Regulation also applies to us, and the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD) supervises our processing.

2. What we collect

• Account details you give us: display name, email address, date of birth, the UK nation you live in, and your password (stored only as a one-way hash).
• Play data created as you use the site: your Ember balance, rounds played (game, stake and result), experience, Merits, errands, favourites, rewards collected and safety-tool settings.
• Messages you send through the contact form: name, email, topic and message.
• Technical data needed to run the site securely: your IP address is used briefly to limit repeated sign-in or form attempts, and our hosting provider keeps standard server logs.

We do not collect payment details, because nothing on Emberlowe is for sale. We do not use analytics or advertising trackers.

3. Why we use it, and our lawful bases

• To provide your account and the games you ask for (contract).
• To check you are 18 or over, enforce breaks and self-exclusions, and keep the site safe from abuse (legitimate interests and legal obligations).
• To answer your messages and send password-reset emails you request (contract and legitimate interests).

We do not send marketing emails, we do not sell personal data and we do not make automated decisions that have legal or similarly significant effects on you.

4. Guests and demo mode

If you play without an account, we do not create a profile and the game stores nothing: demo credits live only in your open page. Your browser keeps two small settings — your age confirmation and that you have seen the cookie notice — as described in our Cookie policy.

5. Who we share it with

We share personal data only with the hosting and email providers that run the site for us, under contracts that require them to protect it, or where the law requires us to (for example, a valid request from the police). Data is stored in the United Kingdom or the European Economic Area.

6. How long we keep it

We keep account and play data while your account is open. If you close your account we delete it straight away, except that records of self-exclusion are kept for the length of the exclusion so it can be enforced. Contact messages are kept for up to two years. Sign-in attempt records are kept for at most a day.

7. Security

Passwords are stored with a modern one-way hashing algorithm. The site uses HTTPS, secure and HttpOnly session cookies, protection against cross-site request forgery, and limits on repeated attempts. Password-reset links work once and expire after one hour. Changing your password signs out every other device.

8. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its use, and to receive it in a portable format. You can download your data and delete your account yourself from your profile, or email privacy@emberlowe.com. We confirm receipt within five working days and reply in full within one month, as UK data protection law requires; if a request is unusually complex we will tell you within that month why we need up to two more.

9. Children

Emberlowe is only for adults aged 18 and over. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account and its data.

10. Changes to this notice

We will update this notice if our practices change and show the new date at the top. If a change affects how we use data you have already given us, we will tell members by email or on the site before it takes effect.

11. Complaints and the ICO

If you are not happy with how we handled your data or your request, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. You can also complain to the Portuguese authority, the Comissão Nacional de Proteção de Dados (CNPD). We would appreciate the chance to put things right first, so please write to privacy@emberlowe.com before you do.