1. Who we are
This site (“Last Card”, “we”, “us”) is operated by DJM Business Concepts(“the Company”), the data controller responsible for personal data processed through bigcardparty.com and related domains. If you have any questions about this notice, contact us at privacy@bigcardparty.com.
2. Our role
DJM Business Concepts acts as the data controller for personal data you provide directly to Last Card (such as your display name and, if you buy an ad, your contact email). Our payment provider Paddle acts as an independent controller and Merchant of Record for billing data (see Section 5).
3. Personal data we collect
- Gameplay data — the display name you type, an anonymous device identifier stored in your browser, and the state of any games you join (cards, turn order, room codes).
- Advertiser data — headline, description, destination link, and contact email you submit through /advertise.
- Technical data — IP address, user agent, and request logs collected automatically by our hosting and backend infrastructure for security and abuse prevention.
- Support messages — anything you email us.
We do not require account creation, and we do not knowingly collect data from children under 13.
4. Purposes and legal bases
- Provide the game (contract / legitimate interests) — sync game state between players in real time using the display name and device identifier.
- Provide the advertising service (contract) — accept ad submissions, display approved ads, and contact advertisers about their listing.
- Security and abuse prevention (legitimate interests) — detect fraud, spam, and misuse using request logs.
- Legal obligations — comply with tax, accounting, and law-enforcement requests where applicable.
5. Who we share data with
- Paddle.com Market Limited — our Merchant of Record. Paddle processes all payments, handles billing, invoicing, sales tax, refunds, and chargebacks. See Paddle's Privacy Policyand Buyer Terms.
- Hosting and backend providers — used to serve the site, run the realtime database, and store submitted ad content.
- Professional advisers — legal, accounting, and tax advisers where strictly necessary.
- Authorities — where required by law, court order, or to protect our or others' rights.
We do not sell personal data.
6. International transfers
Our providers may process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.
7. Retention
- Game rooms and hands are automatically discarded shortly after games end or become inactive.
- Approved ad submissions run for 30 days and are then deactivated; underlying records are kept for up to 24 months for accounting and dispute purposes.
- Payment records held by Paddle are retained per Paddle's own policies and applicable tax law (typically 7+ years).
- Support emails are kept for up to 24 months.
8. Your rights
Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to our processing of your personal data, and to withdraw consent where processing is based on consent. To exercise any of these rights, email privacy@bigcardparty.com. We aim to respond within one month. You also have the right to complain to your local data protection authority.
9. Security
We use appropriate technical and organisational measures — including encryption in transit (HTTPS), row-level database security, and restricted access to production systems — to protect personal data. No system is 100% secure; please use a unique display name and avoid sharing sensitive information in-game.
10. Cookies and local storage
We use strictly necessary browser storage (localStorage) to remember your display name, an anonymous device identifier, and your board theme preference. We do not use advertising or third-party analytics cookies at this time.
11. Changes to this notice
We may update this notice from time to time. The “Last updated” date at the top reflects the latest version.