Privacy & Data Notice

About This Notice

This document sets out the personal-information practices that apply across Lucky Lama Games websites, mobile titles, and connected products. We call those offerings the “Games,” “Platform,” or “Services.” References to “Lucky Lama Games,” “we,” “our,” and “us” identify the business that obtains, uses, retains, and discloses the information described below.

Our promotional activities, reward activities, contests, giveaways, and reward systems are not sponsored, endorsed, administered by, or associated with Apple Inc., Google LLC, the Apple App Store, or Google Play. An in-game or optional purchase and a premium feature do not improve a user’s chance in any promotion, contest, giveaway, or reward event, and purchasers receive no preferential advantage. Our games and promotional systems are intended to comply with applicable platform rules and local law.

Using a Service indicates that you have reviewed this Notice and understand the practices it sets out. The Notice is incorporated into our Terms of Use. An SDK, advertising company, analytics provider, or other outside integration can process information under its own notice, so consult the relevant provider’s terms when interacting with it.

Do not continue to a Service if these practices are unacceptable to you. Lucky Lama Games is the party responsible for managing and protecting the personal data covered by this document. Privacy enquiries may be sent to Lucky Lama Games in Türkiye at [email protected] with “Privacy” in the subject line.

Acceptance and Minimum Age

When you register and choose “ACCEPT & CONTINUE,” you confirm that you have reviewed and accepted this Notice and become a “User.” A person under 18, or anyone who does not agree, may not register or access Lucky Lama Games Services.

Relationship with Our Terms

Our Terms of Use incorporate this Privacy Policy. Accessing any Service means you agree to the Terms and the policies included in them. A permanent link to the Terms is available in this website’s footer.

Updates to This Privacy Notice

We may revise this Notice. A new version will carry an updated “Last updated” date, and material revisions may also be announced in a mobile app. Check this page periodically. If you do not accept a revision, discontinue use.

We collect and use personal data only for defined, legitimate purposes described here and in accordance with applicable privacy law. If you need clarification, contact us using the details in this Notice.

A. PERSONAL DATA WE RECEIVE

1. Information You Share Directly

“Personal Data” is information that identifies or can reasonably be linked to you. Depending on how you use a Service, it may include a name, email, telephone number, account information, device identifiers, gameplay activity, reward records, support correspondence, and other information you elect to provide. We limit collection to information needed for the purposes in this Notice.

a. Details Collected During Registration and Use

When you create an account or communicate with us, we receive details such as your name, email, account choices, and communication preferences. Use of the mobile app can also supply technical information such as an IP address, approximate location, and advertising identifier, including through integrated providers described in Section E.

Registration and Platform Data May Include:

• Full name: the given name and family name entered when an account is opened.
• Age: used to confirm age eligibility and determine available content.
• Gender (optional): if supplied, used to personalize the experience and editable in account preferences.
• Google, Facebook, or Apple login: a third-party sign-in may be used to link your identity, access the connected email, and deliver required updates, announcements, or consented promotions. If “Hide My Email” is selected with Apple, we may receive Apple’s unique relay address rather than your personal email.
• Profile photo: a connected or uploaded image may appear in leaderboards or other public areas until you change or remove it.
• Phone number: used mainly to verify by SMS; after permission, it can also carry messages about time-limited offers or campaigns.
• Identity or video verification: a video selfie or similar check may be requested to verify redemptions, preserve reward integrity, and prevent fraud. We may also ask for an additional security check, gameplay review, verification task, or other eligibility step.
• Preferences: language, notification, interface, and comparable settings.
• Direct support communications: messages and materials you provide through email, surveys, support tickets, or another contact channel.
• Promotional entries: information required to check eligibility, record participation, stop abuse, determine outcomes, and review or fulfill rewards in promotional events, contests, giveaways, and reward features.

b. Technical and Device Data

• IP address: used to infer a broad location, such as city or country, and for networking, diagnostics, security, and fraud prevention.
• Geolocation: with device permission, latitude, longitude, or comparable location data may be collected intermittently for location-based functions; it is not continuously tracked.
• Mobile device identifiers: values tied to a particular device, potentially including IMEI or Android identifiers, that assist recognition and help secure the Platform.
• Advertising identifiers: identifiers such as Google Advertising ID or Apple IDFA used for campaign measurement and ad personalization, subject to device privacy controls.
• Device specifications: operating system, hardware or device type, language, and comparable technical details used to optimize performance.

c. Activity, Gameplay, and Interaction Data

• Connection logs: app sessions, connection and device information, timestamps, network data, and security signals used for stability, fraud and abuse detection, and Service protection.
• Gameplay metrics: session duration, levels, progress, events, errors, purchases, reward activity, and redemption history used to operate and improve titles, validate promotional rewards, and identify suspicious behavior.
• File storage usage: read or write access to shared content when a feature requires it.
• Usage patterns: over daily, weekly, or monthly periods, we aggregate how often and how long the app is used to assess engagement and performance.
• Audience segmentation: interaction, gameplay, approximate location, and usage-time data may be grouped into audiences to personalize content and Services.

B. Storage Locations and Data Handling

Grounds for Processing

We process personal data only where an applicable legal basis exists. Depending on the activity, that basis may be explicit consent; our legitimate interest in operating, securing, maintaining, and improving the Platform when not outweighed by your rights; a legal or regulatory duty; the establishment, exercise, or defense of claims; or a substantial public interest where recognized by law.

Data is used only for purposes in this Notice. Before materially different processing begins, we will provide appropriate information and request consent where required.

Hosting Locations and Cross-Border Transfers

Personal data is primarily hosted on secured Amazon Web Services and Microsoft Azure infrastructure located in Germany. Operational needs or a provider’s location may result in access, storage, or processing in another jurisdiction, including the United States.

Protection Measures for Stored Data

We select established providers and use contractual, organizational, and technical measures to protect data. Privacy law can differ between Germany, the EEA, the United Kingdom, the United States, and other jurisdictions, so limited international access may occur in exceptional cases.

EEA and UK Transfer Safeguards

For EEA and UK users, data hosted in Germany is handled in accordance with GDPR requirements. A transfer outside the EEA uses an appropriate safeguard, including the European Commission’s Standard Contractual Clauses where applicable.

C. Why We Process Personal Data

We process personal data only when consent applies, processing is necessary for a legitimate interest not overridden by your rights, law requires it, legal claims require it, or a substantial public interest authorizes it. We will give notice and obtain permission where a new purpose requires consent.

1. Permission-Based Processing

Registering or using the Platform provides the informed permissions described in this Notice. If you disagree, do not use the Services. We do not sell personal data in exchange for money or for commercial resale.

With permission, we may send product news, offers, or updates by the selected channel, including email, phone, or push notification, and may allow group companies to do the same. Preferences can be revised or withdrawn in account settings. Where consent is the sole legal basis, withdrawal may limit functions but does not invalidate earlier lawful processing or processing supported by another basis.

2. Processing for Legitimate Business Interests

Some activities rely on our legitimate interests in operating and improving the Platform. Before doing so, we balance the intended benefit against the effect on your privacy and rights. Legitimate-interest processing may include:

• Personalized user journey: recommending content, features, or games from interaction patterns.
• Active Platform use: enabling achievements, progression, in-game benefits, and event or promotional functions connected to genuine participation.
• Service optimization: assessing gameplay, engagement, reward systems, and overall service quality.
• Promotional strategy: measuring and refining communications for audiences and channels.
• Participation events: running contests, promotions, and giveaways, including a fair determination of their winners.
• Performance attribution: validating installation, use, and reward delivery records.
• Platform protection: identifying anomalous conduct, fraud, and unauthorized access.
• Identity verification for security: in selected cases, an encrypted short video may be requested to deter duplicate accounts, protect reward eligibility, and identify automation or bots.

Other Uses of Data Insights

• Innovation: using behavior insights to improve current products and develop new ones.
• Reporting: creating aggregate analytics about service performance.
• Content relevance: adapting communications and content to observed interactions.
• AI-based personalization: applying machine learning so the experience can be adjusted to characteristics associated with a user profile.

3. Processing Required to Deliver the Service

Registration and use create the agreement stated in our Terms. We process information required to supply the contracted Services and perform our obligations to you.

4. Legal Duties and Protection of Rights

We may process information to comply with law or to bring, defend, or establish a legal claim. Where legally justified, information may be disclosed without advance consent to identify or contact someone harming our systems, infringing rights, violating law, or causing damage.

5. Processing for Substantial Public Interests

In limited circumstances, processing may occur for a substantial public interest where the conditions of applicable data-protection law are satisfied.

D. Practices Requiring Special Attention

a. Data Collected Automatically

Some technical information is collected passively during interaction with the Platform, including aggregate usage measurements, session identifiers, access timestamps, device characteristics, and interactions with push notifications.

b. Controlling Push Notifications

We may send push notifications for the purposes described here. Device settings generally allow app-specific or global notification control. Disabling notifications can reduce or alter some functions.

c. Privacy of Minors

We do not knowingly collect personal data from anyone under 18. Additional age or eligibility verification may be requested where a feature, law, or platform rule requires it. Use of the Platform represents that you are 18 or older. If we learn that a minor registered using false information, we will deactivate the account and remove the data, subject to mandatory retention. Report suspected collection from a minor to [email protected].

• Only adults who have reached their eighteenth birthday may access the Platform.
• Some information may be retained when required by law or necessary to deliver a Service.
• Our Cookie Policy describes cookies and similar technology.

d. Links to External Services

A Service may link to an external application or platform such as Google Play. The third party operates that destination under its own privacy policy, which you should review directly.

e. Withdrawing Permission

You may withdraw consent by emailing [email protected]. After a valid request:

• Processing halted: consent-based processing will stop within a reasonable period.
• Impact of withdrawal: certain functions, including access to unredeemed promotional rewards, may become unavailable. Withdrawal does not affect prior lawful processing.
• Deleting your account: account deletion may permanently eliminate unused rewards, balances, and Platform benefits.

f. Promotional Messages

Where you opted in, we may send promotional messages. You may opt out using the instructions in a message. Account, security, transactional, and Service notices can still be delivered after a marketing opt-out.

E. Third Parties That Process Data for Us

We use outside vendors to support Platform functionality and operations. Where they process data for us, contracts require confidentiality and appropriate security and do not permit independent use or disclosure unless we expressly authorize it. If you separately use a provider outside our Services, its own privacy terms govern that relationship.

a. Advertising and Ad Technology Providers

Advertising partners provide banners, video, rewarded ads, and other placements. Some personalize ads using activity, device identifiers, trackers, or behavioral retargeting, including activity outside our app, although not every item of personal data is used for targeting. Provider notices explain their practices and opt-outs. Device advertising preferences and the Network Advertising Initiative opt-out page may provide further controls.

b. Usage Measurement and Analytics Providers

These providers measure how people move through and interact with our applications, allowing us to analyze usage.

Pre-Release Testing Providers

Beta tools distribute prerelease software to selected users and may gather device information, usage records, diagnostics, and crash reports.

c. Experimentation and Content Testing

These tools compare engagement after changes to an application’s content, layout, or functions so we can evaluate variants such as different buttons, pages, or headlines.

AppLovin. AppLovin analytics and marketing products may support A/B tests and campaign-performance measurement using country, device, logs, usage metrics, trackers, and other information in its notice.

d. Payment and Redemption Processors

Except where expressly stated, card, bank, wallet, and similar payments are handled by outside processors. Payment credentials go directly to the processor and are not stored or processed by our app. We may receive a limited result such as confirmation that a payment succeeded.

e. Cloud Hosting and Backend Providers

Hosting providers store data, files, and system components needed to run and distribute the Services. Globally distributed infrastructure can make a precise processing location difficult to identify.

f. Performance and Error Monitoring

Monitoring tools measure app and feature performance, detect faults, and support service reliability.

g. Communications and Notification Delivery

These systems organize contact details, deliver email or push messages, and may record whether a communication was viewed or used.

h. App Distribution Platforms

Distribution platforms host apps and can supply tools for analytics, databases, and commerce. Distributed systems mean processing locations may vary.

i. Sharing and Invitation Features

Social tools support sharing and invitations and may measure referrals and interactions for analytics and marketing.

F. Retention, Deletion, and Account Closure

We retain personal information while needed for the purpose of collection and for a reasonable period afterward, including to satisfy legal, contractual, regulatory, and legitimate business needs.

• Deletion: we destroy paper and other physical records securely and erase digital records on a permanent basis. Twelve months of inactivity may lead to removal of both an account and its related information.
• Retention: information is kept while you actively use the Services or for the legally required period. Following account deletion, it may remain for up to 12 additional months for administrative purposes. Where possible, information may be anonymized for legitimate needs such as tax compliance.
• Delete requests: request deletion using the contact information in this Notice. Deleting an account permanently forfeits unused Lucky Bills and unredeemed promotional rewards. Anonymous or de-identified data that cannot be relinked to you may be retained.

G. When Personal Data May Be Shared

Information is mainly used inside the Platform but may be disclosed under controlled circumstances:

• Corporate affiliates and transactions: legal safeguards apply when information goes to an affiliate or subsidiary, or forms part of financing, restructuring, an acquisition, a merger, or another business transition.
• Legal and security requirements: to comply with law, protect rights, respond to claims, or prevent abuse and fraud.
• Service providers: vendors supporting hosting, security, customer service, marketing, and other operations under contractual protections; a provider may combine supplied information with data it independently holds where its terms permit.
• Advertising and marketing partners: identifiers, IP addresses, and similar data may be shared for personalized advertising, attribution, and analytics, subject to applicable choices.
• Marketing vendors: information may support campaigns, testing, and surveys within legal and opt-out limits.
• Analytics providers: usage information may be provided to services that help us understand and improve the Platform.

H. How We Protect Personal Data

We use physical, administrative, and technical safeguards. Personal information is restricted by role to authorized personnel, and access is logged. You must also protect credentials and devices. No system is completely immune from unauthorized access, and, to the extent allowed by law, we are not responsible for incidents caused by transmission errors, outside actors, or events beyond our control.

When appropriate, a security incident notice will be delivered to registered contact details or in-app.

Safeguards We Use

• Access to database servers is limited to protected areas of our network.
• Confidentiality duties apply to authorized staff and, where relevant, continue after their employment ends.
• Passwords secure portable computers and storage media.
• Firewall layers separate and protect both database infrastructure and web servers.
• Where practicable, data is encrypted both while stored and while moving between systems.
• To prevent duplicate sessions, each browser is limited to one active session.
• Files held in AWS S3 are placed in non-public storage.
• Row-level controls in PostgreSQL limit which data can be reached.
• Rate limits tied to IP addresses help deter abusive activity.
• Independent specialists periodically perform external security reviews and penetration testing.

I. Choices and Rights Over Your Data

Subject to the law applicable to you, you may have the following rights:

• Marketing choice: tell us not to send further promotional messages.
• Withdraw consent: end processing based only on consent, such as optional gender information, without affecting earlier lawful processing or another valid legal basis.
• Request processing details: ask whether we process your information and request the details described here.
• Request deletion: ask for account or personal-data deletion, subject to mandatory retention.
• Request correction: have information amended when it is out of date, incomplete, or wrong.
• Challenge processing: raise an objection to covered uses of information, including automated ones.
• Contacting us: exercise rights or ask questions at [email protected].

J. Extra Information for EEA and UK Users

1. Transfers Beyond the EEA and UK

As explained above, we use servers in Germany to keep primary hosting in the EU. If a transfer to a non-EU country is necessary, we rely on an applicable mechanism:

• Adequacy decision: the destination has received European Commission recognition that its protections are sufficient.
• Standard Contractual Clauses: the recipient is bound by Commission-approved contractual protections.
• Code of conduct or certification: an enforceable approved framework protects transferred information.
• Explicit consent: after being informed of relevant risks, you expressly agree to the transfer.

You may ask us which mechanism applies to a particular transfer.

2. Rights Under GDPR and UK GDPR

EEA and UK residents, and where applicable Swiss residents, have rights including:

• Access: obtain a copy of personal data and information about its processing.
• Correction: ask us to fill gaps in your information or fix details that are wrong.
• Object: object to direct marketing and certain processing relying on legitimate interests.
• Erasure: request deletion where no lawful reason requires continued retention.
• Data portability: ask for eligible information in an interoperable, structured and machine-readable file, or have it sent to a different controller where available.
• Withdraw consent: take back permission whenever you choose; functions dependent on that permission may then be affected.

3. Submitting a Privacy Rights Request

Submit a request using the contact details in this Notice. We may verify identity before acting. An EEA resident may also complain to their local data-protection supervisory authority.

K. California Privacy Information and Rights

California residents receive the following additional information and rights under the California Consumer Privacy Act (CCPA), as amended.

1. Access and Deletion Requests

• You may ask for an account of the personal-information categories involved and the particular data entries we have collected, used, disclosed, sold, or shared.
• Up to twice in a 12-month period and without charge, you may request a report identifying the personal information held, the categories of recipients, and the business or commercial reasons for collection or sharing.
• You may request deletion. After a verified request, we will either remove qualifying information or, if requested and appropriate, place contact details on a suppression or “do not contact” list.

2. Timing of Our Response

We generally answer a verified CCPA request within 45 days. If reasonably necessary, we may extend the period to a total of 90 days and will explain the extension and expected timing.

3. Requests Submitted Through an Agent

You may appoint an agent registered with the California Secretary of State. We require written permission and sufficient evidence of your identity and the agent’s authority before processing the request.

4. Summary of Collection, Use, and Disclosure

The following summary reflects the categories, sources, purposes, and commercial use contemplated by California Civil Code Section 1798.140:

5. How Data Is Used and Disclosed

During the preceding 12 months we may have disclosed personal information to service providers for legitimate business purposes, but we do not sell personal information for monetary compensation. California law can treat certain non-monetary targeted-advertising disclosures as a “sale” or “sharing.” We do not knowingly collect, sell, or share personal information belonging to a person under 16.

6. California Retention Periods

We retain information only for the time required to provide Services, perform the original purpose, or meet legal and contractual duties. An account inactive for 12 consecutive months may be deactivated and its related data securely removed as described in this Notice.

7. Optional Rewards and Incentive Programs

Optional promotional rewards, loyalty-style engagement programs, reward activities, or incentives may qualify as a “financial incentive” under California law. Any value is reasonably related to the value of participation, engagement, and related Platform activity. Participation is voluntary and may be ended at any time. See the Terms of Use for program details.

8. CCPA Choices Available to You

• Right to know: ask what is collected, used, disclosed, sold, or shared.
• Right to delete: ask for covered information to be erased, except where an exemption permits us to keep it.
• Right to correct: have personal information fixed when it is wrong.
• Right to opt out: opt out of sale or sharing and cross-context behavioral advertising.
• Right to limit use and disclosure: place applicable limits on our handling and sharing of sensitive personal information.
• Right to non-discrimination: receive equal treatment after exercising a CCPA right.

Send requests to [email protected]. Where the law applies, a Global Privacy Control (GPC) preference transmitted by your browser is also treated as an opt-out request.

Use the subject “Personal Information Privacy Request,” include your full name, email address, mailing address, and the relevant Lucky Lama Games Service, and explain whether a deletion request seeks full removal or placement on a do-not-contact list. Future activity can provide information again after deletion unless a continuing global opt-out applies. We generally respond within 45 days, subject to a permitted extension.

9. No Penalty for Exercising Privacy Rights

We do not discriminate against a California resident for exercising a privacy right, including by unfairly changing Service access, quality, or price.

10. Browser Do Not Track Signals

Some browsers transmit a “Do Not Track” preference. Because there is not a uniform standard for responding to DNT, the Platform does not currently respond to that signal. Where legally required, we separately honor Global Privacy Control signals as explained above.

L. Privacy Rights in Colorado, Connecticut, and Virginia

Residents of Colorado, Connecticut, or Virginia may have additional state-law rights. The earlier “How We Use Your Personal Data,” “Disclosure of Personal Data,” and collection sections explain relevant practices. Depending on the governing law, information used for targeted advertising or marketing can be treated as a sale or profiling.

• Right to access: learn whether processing takes place and, if it does, review the personal data concerned.
• Right to data portability: obtain your eligible information as a machine-readable copy arranged in a structured and widely used format.
• Right to correct inaccuracies: have omissions or errors in your information remedied.
• Right to deletion: ask us to delete qualifying information.
• Sales and targeted-advertising choice: instruct us to exclude covered information from sales and targeted-advertising activity.
• Right to opt out of profiling: refuse profiling that supports decisions producing legal or similarly significant effects.

To exercise a right, follow the contact instructions in this Notice, use “Personal Information Privacy Request” as the subject, and include your full name, email address, physical address, and relevant Lucky Lama Games Service. For deletion, specify complete erasure or a do-not-contact list. If we deny the request, you may appeal by replying to the decision. An authorized agent may act after identity and authority are verified.

M. Privacy Information for South Korean Users

When a user accesses the Services from South Korea, personal data may be transferred abroad in compliance with South Korea’s Personal Information Protection Act (PIPA) and applicable information-communications privacy requirements. We use safeguards such as secured communications during transmission and storage. Information is retained only while necessary for the collection purpose and then erased or anonymized under Korean requirements.

Transferred categories may include account and device data, usage records, logs, identifiers, approximate location, device model, operating system, mail address, phone number, and other information needed for hosting, security, analytics, and operation. Relevant recipients can include the providers listed in Section E and Lucky Lama Games analytics and operations systems. Purposes include advertising, engagement measurement, gameplay analytics, reward verification, fraud prevention, account security, feature improvement, and Service-performance monitoring.

N. LGPD Information for Brazilian Residents

This section applies to Brazilian Users under the Lei Geral de Proteção de Dados (LGPD) and prevails if it conflicts with a general provision above.

1. LGPD Grounds for Processing

We process personal data only under an LGPD legal basis, commonly consent, legitimate interests, contractual necessity, or legal obligation. Contact us for details applicable to a specific activity.

2. Types of Data Covered

See Section A for the full description of information categories we can collect.

3. Sharing with Other Parties

Sections C and G explain how, why, and with whom personal data may be shared.

4. Why We Process Data in Brazil

Purposes appear in Section C and include providing Services, improving the experience, administering rewards, protecting the Platform, and meeting legal duties.

5. Privacy Rights Granted by LGPD

A Brazilian resident may:

• confirm whether processing occurs;
• access personal data;
• have information completed, updated, or corrected when it is incomplete, old, or inaccurate;
• ask that information processed unlawfully or beyond what is necessary be anonymized, blocked, or erased;
• be informed about a requested consent and what may happen if it is not given;
• learn which third parties received data;
• have eligible data sent to a different provider, so long as our commercial secrets are not compromised;
• ask us to erase information handled on the basis of consent, except where the law permits retention;
• withdraw consent;
• bring a complaint before Brazil’s data-protection regulator, the ANPD;
• object to non-compliant processing;
• obtain an explanation of systems that make automated decisions; and
• have an automated decision reconsidered when it produces a significant effect on them.

Choosing to use an LGPD right will not result in discriminatory treatment from us.

6. Making an LGPD Request

You or a legal representative may submit a request without charge using the contact information above. For confirmation or access, state whether you prefer electronic or printed delivery and a simplified or complete response. Unless our trade secrets would be compromised, a detailed answer identifying origin, method, and purpose will be provided within 15 days. After a valid correction, deletion, anonymization, or blocking request, we will notify recipients unless doing so is impossible or disproportionately burdensome.

7. Transfers Outside Brazil

A transfer outside Brazil will be carried out in accordance with the LGPD. Contact us for further information.

O. KVKK Information for People in Türkiye

This section supplements the Privacy Policy for people in Türkiye under Personal Data Protection Law No. 6698 (KVKK).

1. Data Categories Covered by KVKK

Personal data may include:

• an email or other contact detail, together with a given or family name when it forms part of a username;
• an avatar or profile picture from which someone can be recognized;
• messages, letters, and other exchanges between you and our team;
• records about technology and access: for example, IP and login data, browser, operating system, screen resolution, time zone, plugins, cookies, sessions, traffic, and other access logs; and
• other information you voluntarily provide.

Section A and related sections provide the complete collection description.

2. KVKK Grounds for Processing

Under KVKK, processing may rely on one or more of:

• Contractual necessity: information needed so we can carry out an agreement made with you or your employer.
• Consent: where you have given specific and freely provided permission.
• Legitimate interests: processing that our operations require, provided its effect does not take priority over a person’s fundamental freedoms and rights.
• Legal obligation or public interest: processing mandated under Turkish law or supported by a relevant matter of public interest.