Legal information

Privacy and Cookie Policy

Version in force as of October 12, 2026.

This policy is written in French and translated into English. This English version is provided for convenience: if the two versions differ, the French version prevails. Escape & Chill is run from France and processes data under the EU General Data Protection Regulation (GDPR), whatever country you play from.

Data controller

Rémi Bouvant EI (Escape & Chill), 6 rue d’Amance, 13012 Marseille, France. For any question about your data, contact contact@victoire-digital.fr.

Data we process, why, and for how long

We only collect what we need to run the game and process sales.

Account: email address: PurposeCreate the account, let you log in, attach the games you bought; Legal basisPerformance of a contract; RetentionUntil the account is deleted, or 3 years after the last login

First name or nickname entered to play: PurposeShow the players during the game, hand out roles; Legal basisPerformance of a contract; RetentionFor the length of the game, 30 days at most

Games in progress (code, progress, choices): PurposeRun the game and let you resume it; Legal basisPerformance of a contract; Retention30 days after the game is created

Results (team name, number of players, time, hints, ending reached): PurposePublic leaderboard and game statistics; Legal basisLegitimate interest (keeping the game lively and improving the puzzles); Retention3 years after the game

Reviews (rating, optional comment, first name entered to play, number of players, date): PurposePublish verified reviews of the game and calculate the average rating; Legal basisConsent (you choose to submit the review); RetentionAs long as the game is on sale, or until you ask for removal

Gift card (buyer’s email, recipient’s email and message, giver’s first name, code, purchase and redemption dates): PurposeSend the card, let it be redeemed, handle refunds; Legal basisPerformance of a contract; Retention3 years after the card expires or is redeemed, 10 years for accounting records

Order (game bought, amount, date, Stripe payment ID): PurposeGive access to the game, handle complaints, accounting; Legal basisPerformance of a contract and legal obligation; Retention10 years for accounting records (Article L123-22 of the French Commercial Code)

Contact form: name, email, subject, message: PurposeAnswer your request (question, support, quote, refund); Legal basisLegitimate interest, or pre-contract steps for a quote; Retention3 years after the last exchange

Newsletter: email address, date and source of sign-up: PurposeSend the newsletter (new games, game night ideas), about once a month; Legal basisConsent (checkbox, when you start a game or at checkout); RetentionUntil you unsubscribe, or 3 years without an open or click

Customers: email address, game bought, purchase date, number of purchases and amount spent: PurposeTell you about our next games, about once a month at most; Legal basisLegitimate interest (products similar to the one you bought, Article L34-5 of the French Postal and Electronic Communications Code). You can refuse at checkout and unsubscribe in one click from every email; Retention3 years after the last purchase

Checkout started then abandoned: email address, game, amount, date: PurposeSend you a single reminder about 2 hours later, so you can pick up your purchase if you want to; Legal basisLegitimate interest, only if you did not check the box declining our emails on the purchase page. You can unsubscribe in one click from the reminder; Retention3 years, like customer data

Free trial email: email address given to start the free room, game, code and game progress: PurposeSend you the link to your game, then a few reminders to resume it if you stop partway; our offers and upcoming cases only if you asked for them (“Yes, keep me posted”); Legal basisPerformance of the service (sending the link) and legitimate interest (reminders); consent for offers. You can unsubscribe in one click from every email; Retention3 months after the last game, if you did not consent to offers

Personalized reminders: first names entered by the team, time and number of hints in room 1, comparison with other teams’ times, rating and reason given on the purchase screen, type of device used to play (data the game already records): PurposeTailor the recap sent after the free room and the reminders (a sentence picked based on your game, with no automated decision about you); test several sentences and measure, without any email address, which one makes people most want to resume. None of this data is sent to an artificial intelligence tool; Legal basisLegitimate interest. You can object at any time using the unsubscribe link in every email; RetentionSame as the free trial email

Feedback on the purchase screen (rating of room 1, reason given, optional comment, first name entered to play, number of players, date) and answers to the question in reminder emails (answer, optional comment, a hash of the email address, not the address itself): PurposeImprove the game; Legal basisLegitimate interest; Retention24 months

Technical data (IP address, connection logs): PurposeSecurity of the service, abuse prevention; Legal basisLegitimate interest; Retention1 year

Data	Purpose	Legal basis	Retention
Account: email address	Create the account, let you log in, attach the games you bought	Performance of a contract	Until the account is deleted, or 3 years after the last login
First name or nickname entered to play	Show the players during the game, hand out roles	Performance of a contract	For the length of the game, 30 days at most
Games in progress (code, progress, choices)	Run the game and let you resume it	Performance of a contract	30 days after the game is created
Results (team name, number of players, time, hints, ending reached)	Public leaderboard and game statistics	Legitimate interest (keeping the game lively and improving the puzzles)	3 years after the game
Reviews (rating, optional comment, first name entered to play, number of players, date)	Publish verified reviews of the game and calculate the average rating	Consent (you choose to submit the review)	As long as the game is on sale, or until you ask for removal
Gift card (buyer’s email, recipient’s email and message, giver’s first name, code, purchase and redemption dates)	Send the card, let it be redeemed, handle refunds	Performance of a contract	3 years after the card expires or is redeemed, 10 years for accounting records
Order (game bought, amount, date, Stripe payment ID)	Give access to the game, handle complaints, accounting	Performance of a contract and legal obligation	10 years for accounting records (Article L123-22 of the French Commercial Code)
Contact form: name, email, subject, message	Answer your request (question, support, quote, refund)	Legitimate interest, or pre-contract steps for a quote	3 years after the last exchange
Newsletter: email address, date and source of sign-up	Send the newsletter (new games, game night ideas), about once a month	Consent (checkbox, when you start a game or at checkout)	Until you unsubscribe, or 3 years without an open or click
Customers: email address, game bought, purchase date, number of purchases and amount spent	Tell you about our next games, about once a month at most	Legitimate interest (products similar to the one you bought, Article L34-5 of the French Postal and Electronic Communications Code). You can refuse at checkout and unsubscribe in one click from every email	3 years after the last purchase
Checkout started then abandoned: email address, game, amount, date	Send you a single reminder about 2 hours later, so you can pick up your purchase if you want to	Legitimate interest, only if you did not check the box declining our emails on the purchase page. You can unsubscribe in one click from the reminder	3 years, like customer data
Free trial email: email address given to start the free room, game, code and game progress	Send you the link to your game, then a few reminders to resume it if you stop partway; our offers and upcoming cases only if you asked for them (“Yes, keep me posted”)	Performance of the service (sending the link) and legitimate interest (reminders); consent for offers. You can unsubscribe in one click from every email	3 months after the last game, if you did not consent to offers
Personalized reminders: first names entered by the team, time and number of hints in room 1, comparison with other teams’ times, rating and reason given on the purchase screen, type of device used to play (data the game already records)	Tailor the recap sent after the free room and the reminders (a sentence picked based on your game, with no automated decision about you); test several sentences and measure, without any email address, which one makes people most want to resume. None of this data is sent to an artificial intelligence tool	Legitimate interest. You can object at any time using the unsubscribe link in every email	Same as the free trial email
Feedback on the purchase screen (rating of room 1, reason given, optional comment, first name entered to play, number of players, date) and answers to the question in reminder emails (answer, optional comment, a hash of the email address, not the address itself)	Improve the game	Legitimate interest	24 months
Technical data (IP address, connection logs)	Security of the service, abuse prevention	Legitimate interest	1 year

The public leaderboard only shows the team name chosen by the players, the number of players and the time. Please avoid using a full name there. You can ask for a result to be removed at any time.

Bank card details are entered and processed directly by Stripe, which acts as an independent data controller for this. We never have access to them.

We do not sell any data and do not use it for targeted advertising. No automated decision with legal effects is made about you.

Recipients and service providers

Supabase: database, accounts and sending of login links. Data is hosted in the European Union (Paris).
Stripe: online payment (Stripe Payments Europe, Ltd., Ireland).
IONOS (IONOS SE, France): website hosting, on servers located in France.
Brevo (Sendinblue SAS, France): sending emails (address confirmation, login link, purchase confirmation, abandoned checkout reminder, newsletter) and the contact file (purchases, amount spent). Data is hosted in the European Union.

When data is transferred outside the European Union, notably to the United States, these transfers are covered by the European Commission’s standard contractual clauses and, where applicable, by the EU-US Data Privacy Framework that the provider has joined. If you play from outside the EU, your data is still processed in France and the EU.

Your rights

You have the right to access, correct, erase, restrict, object to and port your data. French law also lets you set instructions for what happens to your data after your death. To use these rights, write to contact@victoire-digital.fr. We reply within one month. You can delete your account by writing to the same address.

If you think your rights are not being respected, you can file a complaint with the CNIL (Commission nationale de l’informatique et des libertés, the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr. You can also contact the data protection authority in your own country.

Minors

Purchases are for adults, or for minors authorized by their parents. A minor can join a game by entering only a first name or nickname, with no account.

Cookies and storage on your device

The following cookies and local storage items are strictly necessary for the site to work. They do not require consent (Article 82 of the French Data Protection Act, which implements the EU ePrivacy rules):

Login session: keeps you logged in after you click the link you received by email.
Games in progress: your browser remembers the codes and IDs of the games you joined, so the game recognizes you and offers to resume it.
Payment: during checkout, Stripe sets the cookies needed to secure the transaction and fight fraud.

The site uses no advertising cookies and no social media trackers.

Audience measurement. We use Umami, hosted on our own server in France, to count visits (page views, where visitors come from, device type). It sets no cookies and cannot follow you from one day to the next, so it is exempt from consent under the CNIL’s guidelines.

Visit recording (with your consent). If you accept in the banner, Umami also records how your visit unfolds (clicks, scrolling, mouse movements on the page) to help us spot what isn’t working. What you type into form fields is never recorded. Recordings stay on our server, are only seen by us, and are deleted after 6 months. You can change your mind at any time with the “Manage cookies” link at the bottom of every page. Game screens (TV and phones) are never recorded.

Security

Communication with the site is encrypted (HTTPS). Access to data is limited to the people who need it to run the service.

See also the legal notice and the terms of sale.