1. Who we are
This Privacy Policy explains how Catouris Me ("we", "us", "our") collects and uses personal data when you use catourisme.com. We are the controller of your personal data under applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the UK GDPR where they apply. The website is operated by (company no. ), .
For any privacy question or request, use our contact form or , or email .
2. The short version
- We only collect what we need to run your account and answer your messages.
- Accounts are stored on our own secure server, not in your browser. Passwords are stored only as one-way encrypted hashes.
- We never ask for payment details and we never sell your data.
- You can see, correct or delete your data at any time.
3. What we collect and why
| What we collect | Why | Lawful basis |
|---|---|---|
| Account details: first and last name, email address, password (stored only as an encrypted hash), sign-in method, account dates | To create and run your account and let you sign in securely | Contract |
| Google sign-in details: name, verified email and Google account ID | To sign you in with Google if you choose to | Contract |
| Play data: virtual coin balance, XP and level, daily bonus times, recently opened games | To provide the coin basket, bonus and passport features | Contract |
| Messages you send: name, email, topic and message | To answer your question or Player Care request | Legitimate interests; legal obligation for data-rights requests |
| Security records: date and type of sign-in or account events, a shortened one-way hash of your IP address, session cookie | To keep accounts secure, prevent abuse and investigate problems | Legitimate interests |
| Your age confirmation | To make sure only adults use the website | Legal obligation / legitimate interests |
You can play every game without an account. If you play as a guest we do not create an account record for you.
4. How we keep your data safe
- Server-side accounts. Account records are kept in protected files on our server. These files cannot be opened from the web.
- Encrypted passwords. Passwords are stored only as strong one-way hashes, so nobody, including us, can read them.
- Secure sessions. Sign-in uses a session cookie that scripts cannot read and that is sent only over HTTPS.
- Server-side forms. Sign-up, sign-in, account and contact forms are processed on our server. Contact messages are sent by encrypted email to our team.
- Protection against misuse. Repeated wrong passwords lock an account temporarily, and forms include spam protection.
- Limited access. Only authorised staff can access account and message records, and only when needed.
5. Who we share data with
We do not sell or rent personal data. We share it only with service providers who help us run the website, under contracts that protect your data:
- Web hosting provider - stores the website, account files and logs.
- Email delivery provider (Brevo) - delivers the messages you send through our contact and Player Care forms to our inbox.
- Google - only if you choose Google sign-in, to confirm your identity. Google's own privacy policy applies to your Google account.
We may also share data if required by law, or to protect the rights, safety or property of our players or others.
6. International transfers
Some providers may process data outside your country. Where this happens we make sure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses.
7. How long we keep data
- Accounts - for as long as your account is open. When you delete your account, the account file is removed from our server straight away.
- Messages - up to 24 months after we answer, so we can follow up on the same issue.
- Security and form logs - up to 12 months, then deleted.
- Data may be kept longer only if needed to meet a legal obligation.
8. Your rights
Depending on where you live, data protection law gives you the right to:
- access a copy of your personal data;
- correct data that is wrong or incomplete;
- have your data deleted;
- restrict or object to how we use your data;
- receive your data in a portable format;
- withdraw consent where we rely on it.
To use any of these rights, use our contact form or , or email , choosing "Privacy question". We will reply within one month. You can delete your account yourself at any time from My passport.
If you are unhappy with how we handle your data, you can complain to the data protection authority in your country (for example the ICO in the UK or your national authority in the EU). We would appreciate the chance to help first.
9. Children
The website is only for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18 we will delete it.
10. Cookies
We use one strictly necessary session cookie to keep you signed in and small browser settings for your age check and cookie choice. See our Cookie Policy for details.
11. Changes to this policy
We may update this policy from time to time. The date at the top shows the latest version. If we make important changes we will show a notice on the website.