Privacy notice

1. Who is responsible for your information

The data controller is Grayson Tech Limited, trading as Grayson Games, company number 17515625, registered in England and Wales. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

For privacy questions or requests, email richard@richardbatt.com.

2. Information we collect

Playing and prize competitions

• You can play without giving us contact details. If you make a player account, we use your chosen username and a securely hashed password.
• If you enter a prize competition, we collect your name, email address, confirmation that you are 18 or over and a UK resident, and any contact details you choose to provide. Public prize information uses your first name and last initial; a winner’s town may also be published under the prize terms. Contact emails and phone numbers are not shown on the leaderboard.
• We collect scores and run information, such as duration, distance and the business you choose to play for. We use this to operate the leaderboard and review scores before awarding prizes.
• Game statistics include a pseudonymous player or device hash (anon_hash), shopfront impressions, play-for choices, website clicks and QR check-ins. The server uses a salted hash rather than storing the device’s random identifier with events.
• For optional location-verified check-ins, your device can send its location so we can check whether it is near the business. We record the check-in and whether verification passed; the location is used for this check and is not retained. A check-in can still count without location permission.
• Selfies stay on your device and use your device’s sharing tools. We do not upload or store them.

Business portal and services

• We collect the owner or manager’s name and business email, the business’s name, website, address and other listing details, authority and adult confirmations, claim and verification information, and membership of the business account.
• We keep account and marketing consent records, including the wording, version, timestamp, source and whether permission was given or withdrawn.
• If you enquire about or buy services, we collect your enquiry, order and subscription information, project milestones, comments, updates, documents and images you choose to upload, and service results and integration data relevant to your business.
• PayPal processes payments. We receive payment and subscription references, amounts and status information needed to manage orders and billing; we do not collect your full card details in the portal.

Security and device storage

The game uses local device storage to keep progress, settings and a random statistics identifier. The business portal uses a secure session cookie to keep you signed in. IP addresses are used for request rate limiting; they are not stored with game-statistics events. Events do not contain your name, browser user-agent string or precise location.

3. Why we use information and our lawful bases

• Game accounts, scores and competitions: to provide the game and competition you ask to use, administer entries, verify scores and eligibility, contact winners and fulfil prizes. Our bases are performance of the relevant contract and our legitimate interests in running a fair game and preventing cheating.
• Portal accounts and services: to verify business claims, manage access, provide sign-in links, maintain listings, respond to enquiries, deliver projects and services, show business results, and manage billing. Our bases are steps requested before a contract and performance of a contract, together with legitimate interests in secure account administration and fraud prevention.
• Game and service statistics: to understand game use, report aggregate results to businesses, improve reliability and measure services. We use legitimate interests and keep game-event data pseudonymous and private by default. Businesses receive aggregate game statistics, not player contact lists.
• Legal obligations and records: to keep records where necessary to meet a legal obligation, and to establish, exercise or defend legal claims.
• Optional marketing: only with your separate consent. The marketing checkbox is unticked by default and optional. Prize entry and the core account service do not depend on it.

For player marketing, Grayson Games may email you about new games, prize draws and local offers only if you opt in. Grayson Games sends those offers itself: it does not give the player email list to businesses. Every marketing email includes an unsubscribe link. You can also contact us to withdraw consent. Withdrawal does not affect the lawfulness of earlier use based on consent.

Essential sign-in, claim, project, billing and prize-administration messages are service messages and are separate from marketing. You can turn off optional play-statistics collection using the game’s “Don’t send play stats” setting.

4. Who receives information

We use the following service providers to operate the game and portal:

• Cloudflare: game and portal hosting, security, scheduled processing and storage of business project files.
• NoCodeBackend: database storage for game, business, consent, project and results records. Business portal, prize-eligibility and consent, project and results records are stored in our EU instance.
• Emailit, or Resend as a fallback: delivery of sign-in links, account and service messages, and marketing where you consent.
• PayPal: payment processing and subscription administration under PayPal’s own privacy information.

Where you buy a connected service, we may use providers relevant to that service, such as 20i for hosting and backups or DataForSEO for search rankings and AI search visibility. Search checks use agreed business names, domains, keywords and prompts. Access and data used are limited to the service being supplied.

Authorised Grayson Tech staff can access information where needed to deliver the service. A business account can access its own listing, projects, files and results. Businesses do not receive players’ email addresses or marketing lists. A prize donor receives a winner’s details only if the winner agrees to that sharing for prize fulfilment. Photos and quotations are used for publicity only with the winner’s agreement.

We may disclose information where required by law or to protect legal rights. We will publish or make available limited winner information as explained in the prize terms. Winners can object before publication, though we may still need to give those details to the Advertising Standards Authority if asked.

5. How long we keep information

• Raw game events: 90 days.
• Unique-player statistics rows: 13 months.
• Consent records: for the life of the account plus six years, so we can demonstrate permissions and withdrawals.
• Account deletion: the user account and business memberships are removed; necessary consent and audit records are retained.

Other account, competition, service, project and payment records are kept only as long as necessary for the purpose described above, including relevant legal and accounting obligations. We do not retain identity-document copies as part of a winner’s age check.

Approval note: Richard must confirm the detailed retention schedule for project files, payment records, enquiries and prize-entry contact records before publication. No specific period for those records has been invented in this draft.

6. Children and young people

Anyone can play without giving personal contact details. Players under 13 should ask a parent or guardian before using the game. Prize entrants and winners must be 18 or over and live in the UK. Under-18s can play without submitting contact details for a prize.

Game statistics are private by default. We do not use game-event information for behavioural advertising or share a player contact list with local businesses.

7. Your choices and rights

Depending on the circumstances, you can ask to access your personal information, correct it, erase it, restrict its use, receive a portable copy, or object to processing based on legitimate interests. You can withdraw marketing consent at any time using the unsubscribe link or by contacting us.

Email richard@richardbatt.com to make a request. We may need to confirm your identity before releasing or changing personal information. Rights are subject to the conditions and exceptions in data-protection law.

You can complain to the UK Information Commissioner’s Office if you are unhappy with how we use your information: ICO: make a complaint. You can contact us first so we can try to resolve the issue.

8. Changes to this notice

We will keep this notice up to date when the game, portal or services change. The version and date appear on this page.