Last updated · 13 October 2026 · Version 2026-10-13.2
Privacy Policy
This policy explains what personal data flan games (flan.games and all its games and features), operated
by Betlifter ("we", "us"), collects, why, who we share it with, how long we keep it and the rights you have
wherever you live. It is written to meet the GDPR and UK GDPR, the US state privacy laws (including the CCPA/CPRA), the
LGPD (Brazil), Ley 25.326 (Argentina), the LFPDPPP (Mexico), PIPEDA and Quebec Law 25 (Canada), and the other laws listed
in section 12. We never sell your personal data and we do not use third-party advertising trackers.
Resumo em português. Coletamos o mínimo para os jogos funcionarem, seu e-mail se você o deixar (CRM), o que você escreve ao King Flan (processado pelo provedor de IA) e IP e navegador por segurança. Análise e e-mails de marketing só com consentimento. Não vendemos dados. Direitos da LGPD: privacy@flan.games.
1. Who is responsible
The data controller is Betlifter, the maker of flan games. Privacy contact, data protection officer / encargado / encarregado / privacy officer: privacy@flan.games.
2. What we collect, per feature
| Feature | Data | Why |
|---|---|---|
| Every page | A random device id stored in your browser; your consent choices; language and country (country derived once from your IP, see section 4); on our servers your IP address and browser user-agent. | Run the games, remember your choices, keep the Service secure, prove your consent. |
| Analytics (only if you allow it) | Pages and sections visited, named game events (e.g. game started or finished), referring site host, campaign tags of your first visit, linked to the device id, IP and user-agent. | Count visits, measure the funnel and improve the games. First-party only. |
| All games (trivia, tarot, predictions, Squish, Shibuya, Plinko, Kart, Tower) | Games started and finished, scores, levels, records, streaks, predictions made, results, Flan Coins and Points, linked to your device id or account. | Provide the games, show your progress, keep results honest, enforce free-play limits. |
| Free-play gate and CRM | Email address, name (optional), device ids, number of games, game where you signed up, language, your invite code and who invited you, verification status and code (stored only as a hash, expires in 15 minutes), flan club status, notes our team adds, terms version accepted and marketing preference. | Verify your email, run your access and club pass, prevent abuse, support you, and send news only if you opted in. |
| Account | Email, password (hashed by our auth provider), display name, avatar, language and country. | Create and secure your account. |
| Tarot & horoscopes | Birth date and, if you give it, birth place; readings; private journal notes; daily-email preference. | Calculate your chart and readings; send the daily email if you asked for it. |
| Talk to Flan & La mesa (AI) | Your messages, King Flan's replies, a short memory (summary and facts you shared, the name you want to be called), time zone, table room codes and participants' display names. | Generate replies, remember context, run party rooms, enforce usage limits and safety. |
| Trivia duels, referrals, invitations | Invite codes, which code brought you, duel links and results, and an email or name you or the inviter leave. | Run duels and invitations; credit referrals; prevent abuse. |
| Community chat | Messages, display name, avatar and moderation status. | Run a pre-moderated community and keep it safe. |
| flan club | Pack bought, amount, dates, payment status. Card details are handled by Stripe or Mercado Pago; we never see your full card number. | Provide the pass, accounting and tax duties, refunds. |
| Contact with us | What you write to privacy@ or ip@ and our replies. | Answer you and keep records. |
We do not ask for sensitive data. Please do not share health, religious, political, sexual or financial details with King Flan or in the chat; if you do, we process them only to reply to you and you can ask us to delete them.
3. Consent and how we record it
- Before you play, the "Before you play" notice asks you to confirm you are 18+ and to accept the Terms and this policy, and lets you switch analytics (first-party and Google Analytics) on or off. In the EU, EEA, UK and Switzerland, and wherever we cannot tell where you are, analytics starts off. Until you decide, no analytics event is sent.
- When you leave your email in a game we ask, separately, for your acceptance of the Terms and this policy (required) and for marketing emails (optional, unticked).
- We keep a record of each consent: policy version, your choices, date and time, device id, email (if given), country, IP address and browser. We keep it to be able to prove consent, as the law requires.
- You can withdraw or change consent at any time from "Your privacy choices" at the bottom of every page, from the unsubscribe link in any marketing email, or by writing to us. Withdrawing does not affect processing done before.
- We honour Global Privacy Control: if your browser sends it, analytics stays off and we treat it as an opt-out of any sale or sharing.
4. IP address and location
When your browser talks to our servers we receive your IP address and user-agent. We record them with security and analytics events and consent records to protect accounts, detect abuse (bots, fraud, ban evasion) and estimate the country traffic comes from. We do not build advertising profiles. On your first visit our CDN (Netlify) resolves your IP at the edge and returns only a two-letter country code, which we keep in your browser to open the site in your language; if that is unavailable we ask GeoJS, a public service, for the same country code. We do not store precise location.
5. Legal bases (EEA, UK, Brazil and similar laws)
- Contract — running the games, your account, the free-play gate, email verification, AI chat and club passes.
- Consent — first-party analytics, marketing emails, the tarot daily email, and storing non-essential items in your browser. You can withdraw it any time.
- Legitimate interests — security, fraud and abuse prevention, keeping consent records, moderating the community, our CRM's internal notes and improving the Service in ways you would expect, balanced against your rights. You can object.
- Legal obligation — accounting, tax, consumer and data-protection duties, answering lawful requests.
6. Who we share it with
We never sell or rent your personal data and we do not share it for cross-context behavioural advertising. We share it only with providers that process it on our behalf under data-processing terms:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, authentication, server functions (all game data, CRM, consent log) | USA / cloud regions |
| Netlify | Website hosting, CDN and country lookup | Global CDN, USA |
| Anthropic | AI model that writes King Flan's replies (Talk to Flan, La mesa, editorial) | USA |
| Resend | Sending verification codes and emails | USA |
| Stripe, Mercado Pago | Payments for flan club passes (independent controllers for fraud and legal duties) | USA, Latin America |
| Google Fonts, jsDelivr | Delivering fonts and an open-source library to your browser; they receive your IP address when your browser loads them | Global |
| Google Analytics (Google LLC) | Visit and session statistics, only if you allow analytics; receives pages
visited, IP address and browser details and sets the _ga cookies | USA, Global |
| GeoJS | Backup country lookup from your IP | Global |
We may also disclose data if required by law, to protect the rights, safety and property of users or Betlifter, or as part of a merger or sale of the business, under the same protections. Our AI provider does not use your messages to train its models under its commercial terms.
7. International transfers
Our providers process data in the United States and other countries that may not offer the same protection as yours. We rely on adequacy decisions where they exist (including the EU-US Data Privacy Framework for certified providers), the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, the ANPD standard clauses (Brazil), the model clauses approved in Argentina, and equivalent safeguards elsewhere. By accepting this policy you are informed of these transfers; where your law requires consent for them (for example Argentina, Mexico, Colombia or Korea), your acceptance in the "Before you play" notice is that consent. Ask us for a copy of the safeguards.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, game progress, club status | While your account or device is active, then up to 24 months of inactivity, then deleted or anonymised. |
| CRM contact (email you left) | Until you ask us to delete it or 24 months after your last activity. Unsubscribing stops marketing but keeps a suppression record so we don't email you again. |
| Verification codes | Valid 15 minutes; rows removed with routine cleanup. |
| Analytics and security events (incl. IP, user-agent) | Up to 12 months. |
| Consent records | 5 years, to prove consent. |
| AI conversations and memory | While you use the feature; memory can be deleted on request. Usage records up to 12 months. |
| Payments | As required by tax and accounting law (usually 5–10 years). |
| Chat messages | While relevant for moderation and safety. |
9. Your rights
Depending on where you live you can: access your data, correct it, delete it, get a portable copy, restrict or object to processing (including to direct marketing, always), withdraw consent, opt out of sale/sharing and targeted advertising (we do neither), limit the use of sensitive data (we do not use it to infer characteristics), and not be subject to decisions based solely on automated processing with legal or similarly significant effects (we make none: the free-play gate only counts games). You will not be discriminated against for exercising your rights.
Write to privacy@flan.games from the email linked to your data, or tell us your device id (from your account page). We answer within the legal deadline (generally 30 days; 15 business days in Brazil; 10 business days for access in Argentina; 45 days in US states, extendable where allowed). You can use an authorised agent. If we refuse, you can appeal by replying to our answer, and you can always complain to your data protection authority.
10. Minors
flan games is for adults (18+). We do not knowingly collect data from anyone under 18 (or under 13 for COPPA purposes); if we learn we have, we delete it and close the account. Parents can write to us.
11. Security
Data is encrypted in transit, passwords and verification codes are hashed, our database enforces row-level security so each player reads only their own data, and only authorised administrators can access the CRM, consent and security logs. If a breach affects your data we will notify you and the authorities as the law requires.
12. Region-specific information
- EEA, UK, Switzerland (GDPR, UK GDPR, FADP). Legal bases in section 5; transfers in section 7. You can complain to your local supervisory authority (e.g. AEPD in Spain, CNIL in France, the ICO in the UK, the FDPIC in Switzerland).
- United States (California CCPA/CPRA, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other state laws). Notice at collection: in the last 12 months we collected identifiers (email, device id, IP), internet activity (pages, game events), approximate geolocation (country), commercial information (club passes), audio/visual: none, inferences: none, and the content of messages you send. Sources: you, your device, our providers. Purposes: section 2. We have not sold or shared personal information and have no actual knowledge of selling or sharing data of consumers under 16. We honour Global Privacy Control. Retention: section 8. Rights and appeals: section 9.
- Brazil (LGPD). Controller: Betlifter. Encarregado: privacy@flan.games. Você pode exercer os direitos do art. 18 e reclamar à ANPD.
- Argentina (Ley 25.326). Tenés derecho de acceso gratuito cada seis meses, rectificación, actualización y supresión. La AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.
- México (LFPDPPP). Este texto es nuestro aviso de privacidad integral. Podés ejercer tus derechos ARCO (acceso, rectificación, cancelación, oposición) y revocar tu consentimiento en privacy@flan.games.
- Colombia (Ley 1581 de 2012), Chile (Ley 19.628 y Ley 21.719), Perú (Ley 29733), Uruguay (Ley 18.331) and the rest of Latin America. Al aceptar autorizás el tratamiento descrito para las finalidades indicadas; podés conocer, actualizar, rectificar y suprimir tus datos y revocar la autorización, y acudir a la autoridad de tu país (SIC, Agencia de Protección de Datos Personales, ANPD Perú, URCDP).
- Canada (PIPEDA, Quebec Law 25). Our privacy officer is reachable at privacy@flan.games. You can complain to the OPC or, in Quebec, the CAI.
- Australia (Privacy Act, APPs) and New Zealand. You can complain to the OAIC or the NZ Privacy Commissioner.
- Japan (APPI), South Korea (PIPA), Singapore (PDPA), India (DPDP Act 2023), South Africa (POPIA), Türkiye (KVKK) and other countries. We process data only for the purposes above, transfer it abroad under the safeguards in section 7, and you may exercise the rights your law grants by writing to privacy@flan.games, which also acts as our grievance officer, and complain to your national authority.
13. Changes
If we change this policy we update the version and date at the top. For material changes we ask for your acceptance again in the "Before you play" notice and, where required, notify you in advance.
14. Contact
Privacy questions and requests: privacy@flan.games. Intellectual-property or abuse reports: ip@flan.games.