Privacy Notice

When you register an account we collect:

• First name and last name. Combined into a display name (e.g. “J Doe”) which is shown on public leaderboards.
• Email address. Used to identify your account, for account-related security messages, and, only if you opt in, for marketing emails.
• Password. Stored using industry-standard, one-way salted hashing. We never see or store your password in plain text.
• Game data. Your puzzle scores, gameplay statistics, dates played, and your marketing preference (and the timestamp you set it).

When you visit the site we also collect:

• Your IP address, briefly, for rate-limiting and abuse prevention. It is not stored long-term and is not linked to your account.
• Aggregate visit analytics via Vercel Analytics: page views and country-level location. This does not use cookies and does not identify you as an individual.

When you register, we ask whether you'd like to receive marketing emails. If you say yes, we may send you marketing emails from Lime Street Labs and from Bontra Limited, which operates the Service and provides other products and services to the London (re)insurance market. Saying no is equally easy and does not affect your access to the Service.

Marketing emails may include daily puzzle reminders, news about Lime Street Labs and updates about Bontra Limited's services. We will not pass your details to unaffiliated third parties for their own marketing.

You can withdraw your consent at any time by emailing privacy@limestreetlabs.co.uk, or by clicking the unsubscribe link in any marketing email we send you. Withdrawing consent does not affect the lawfulness of processing before withdrawal, and it will not affect your ability to keep using the Service.

We do not sell your data and we do not share it for advertising. Your data is processed on our behalf by a small number of carefully-selected service providers (“processors”), under written agreements (Data Processing Agreements and UK-approved Standard Contractual Clauses where relevant):

• Our managed database provider. Your account and game data is stored at rest in a UK (London) data centre.
• Our website hosting and analytics provider. Runs the site and provides cookie-free aggregate analytics. Some processing occurs on edge servers internationally, including in the United States.
• Our DNS provider. Routes requests only; does not see or store the personal data you submit to the Service.

A current list of our sub-processors is available on request from privacy@limestreetlabs.co.uk. If we change processors we will update this notice. We may also disclose personal data where required by law (e.g. in response to a court order).

Your personal data is primarily processed and stored within the UK and European Economic Area. Where data is transferred outside the UK, we rely on UK-approved transfer mechanisms, including the UK addendum to the EU Standard Contractual Clauses and, in respect of US-based providers, the UK Extension to the EU-US Data Privacy Framework / UK-US Data Bridge.

• Account data and scores: while your account exists. You can delete your account at any time from the profile menu. This immediately deletes all of your scores and personal data.
• Marketing consent record: for the life of your account plus one year, as evidence that valid consent was given (required by ICO guidance).
• Aggregate analytics: up to 12 months.
• Server logs (IP, request metadata): up to 30 days, for security and rate-limiting.

Under UK GDPR you have the right to:

• Access the personal data we hold about you (a “subject access request”).
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”). You can do this immediately from the profile menu, or email us.
• Restrict how we use your data in certain circumstances.
• Object to processing that we rely on legitimate interests for.
• Data portability. Receive your data in a structured, commonly-used, machine-readable format.
• Withdraw consent to marketing emails at any time. Doing so will not affect your access to the Service.
• Not be subject to a decision based solely on automated processing. We do not carry out any such automated decision-making.

To exercise any of these rights, email privacy@limestreetlabs.co.uk. We will respond within one month, as required by UK GDPR. There is no charge for exercising your rights, but we may charge a reasonable fee or refuse requests that are manifestly unfounded or excessive.

If you believe we have mishandled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We'd appreciate the chance to address your concerns first. Please contact us before approaching the ICO.

We use one strictly-necessary cookie:

• lsl_session. Keeps you signed in. HttpOnly, SameSite=Lax, 1-year expiry. Strictly necessary for the Service to function, so no consent is required (PECR Reg 6(4)).

We do not use any tracking, advertising, profiling or third-party cookies. Vercel Analytics is cookie-free.

We take appropriate technical and organisational measures to protect your data: HTTPS-only transport, encryption at rest, industry-standard one-way password hashing, signed HttpOnly session cookies, rate-limiting on authentication endpoints, principle-of-least-privilege access to production systems, and routine review of dependencies for security advisories. No system can be guaranteed fully secure, but we take this seriously.

The Service is intended for adults working in or with the London insurance market. We do not knowingly collect personal data from children under 13. If you believe a child has registered, please contact us and we will delete the account promptly.

We may update this notice from time to time to reflect changes to the Service, our processors, or the law. If we make material changes, we'll update the “Last updated” date at the top and, where appropriate, notify you by email (if you have an account).

For the purposes of UK GDPR, the data controller for the Service is Bontra Limited.

Privacy queries: privacy@limestreetlabs.co.uk