Privacy Policy

I. Basic provisions

This privacy policy explains how the controller processes the personal data of site visitors, customers, and anyone who contacts the controller through this site or by email.

The data controller is:

Kryštof Brož
Company ID (IČ): 21076031
Registered address: Lhotka 189, 739 47 Lhotka, Czech Republic
Email: hello@littleescape.store

The controller has not appointed a data protection officer.

The controller processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and related legislation.

II. What personal data we process

• Identification and contact data — name and email address given in the order.
• Order data — the product purchased, price, purchase date and payment status. Card details are handled by Polar and never reach us.
• Personalization data — only if you order personalized case files: the answers you type into the order form (see section IV).
• Communication data — the content of emails and support requests.
• Technical data — IP address, browser and device type, time of visit, and cookies where used.

III. Purposes and legal bases

1. Fulfilling the order and delivering the files — performance of a contract (Art. 6(1)(b) GDPR).

2. Accounting and legal obligations — compliance with a legal obligation (Art. 6(1)(c)).

3. Customer support and complaints — performance of a contract or legitimate interest (Art. 6(1)(f)).

4. Protection of legal claims — legitimate interest (Art. 6(1)(f)).

5. Marketing emails — we may send existing customers occasional news about similar products on the basis of legitimate interest, unless they object. Every such email contains a one-click unsubscribe. Anyone else receives marketing emails only with their consent.

6. Analytics and advertising — only if the visitor consents to analytics or marketing cookies (Art. 6(1)(a)). See our Cookie Policy. With marketing consent, when you buy, our server also sends the purchase to Meta (Meta Conversions API): your email address in hashed (SHA-256) form, the order value and id, the Meta cookie ids (_fbp, _fbc), your IP address and browser type. To do this we keep those browser details for up to 7 days between opening the checkout and the payment. Without marketing consent, nothing is sent.

IV. Children and personalized case files

Our games are played by children, but this website and our products are sold to and directed at adults — parents and other grown-ups. We do not knowingly collect personal data from children, and no personal data about children is needed to buy or play the ready-made games. If you believe a child has provided us with personal data, please contact us and we will delete it.

If you order personalized case files, you — the parent or guardian — give us details to print into the game: the child's first name and optional nickname, age group, difficulty, a strength and a hobby chosen from a list, teammates' and a pet's first names, a short family message and, optionally, a photo for the ID badge. Please only enter other children's names with their parents' agreement.

We use these details only to create your PDFs (performance of a contract, Art. 6(1)(b) GDPR). The optional photo is deleted as soon as your PDFs are created. Your answers and the finished PDFs are kept for 24 months after the order so you can download them again, and are deleted earlier whenever you ask us to. They are never used for marketing, profiling or training anything.

V. How long we keep personal data

• Order data — for the duration of the contract and then as needed to protect legal claims, as a rule no longer than 10 years.
• Accounting records — for the period required by law.
• Personalization answers and PDFs — 24 months after the order (the photo only until the PDFs are made).
• Marketing data — until you unsubscribe or object.
• Support communication — as long as needed to handle the matter, and a reasonable period afterwards.
• Cookies — for the periods stated in the Cookie Policy.

VI. Recipients and processors

• Polar (polar.sh), our Merchant of Record. Polar runs the checkout, processes the payment, handles tax and delivers the download files through its customer portal. We never collect or store full card numbers.
• Cloudflare, the hosting and security provider of this website, which also stores your order and personalized PDFs.
• GitHub (Microsoft), whose build servers create the personalized PDFs. Your answers are only processed there during the build and are not stored.
• Brevo, which sends our order emails, and MailerLite, which stores customer email addresses for occasional news.
• Accounting and tax service providers.
• Microsoft Corporation (Microsoft Clarity) — analytics, only with your consent.
• Meta Platforms Ireland Ltd. (Meta Pixel and Conversions API) — advertising measurement, only with your consent.
• Email providers, where used.

VII. Transfers outside the European Union

Some of the providers above may process data outside the EU/EEA. Where that happens, the controller ensures the transfer complies with the GDPR, for example on the basis of standard contractual clauses.

VIII. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access your personal data,
• rectification of inaccurate data,
• erasure,
• restriction of processing,
• object to processing,
• data portability,
• withdraw consent at any time, where processing is based on consent,
• lodge a complaint with a supervisory authority.

You can exercise your rights by emailing hello@littleescape.store. Requests are answered as a rule within 30 days.

The competent supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic — uoou.gov.cz. If you live in another EU or EEA country, you may also complain to the authority in your country.

IX. Additional rights for US residents (including California)

We do not sell your personal information and do not share it for cross-context behavioral advertising without your consent. We share it only with the service providers needed to deliver what you bought. You can request access to, or deletion of, the personal information we hold about you at hello@littleescape.store.

X. Security

The controller applies appropriate technical and organisational measures to protect personal data, in particular by restricting access and selecting trustworthy providers.

XI. Automated decision-making

The controller does not carry out automated decision-making or profiling with legal or similar effects.

XII. Changes to this policy

This policy may be updated. The current version is always available on this site.

This policy is effective from 26 September 2026.