Privacy policy

Who is responsible for your data?

It depends on who you are:

• You are a customer (you created a EscapeDash account for your escape room): EscapeDash, 3B Impasse Barnabé, 34000 Montpellier, is the controller of your data.
• You play a mini game on an escape room’s website: that escape room is the controller of your email address and game data. EscapeDash only acts as a processor (Article 28 GDPR), on the escape room’s behalf and following its instructions. See Players of the mini games.
• You simply visit this website or write to us: EscapeDash is the controller.

For any question about your data, write to us at contact@escapedash.com.

Customers: escape room owners

Data we process

• Account: name, email address, password (stored only in hashed form by our authentication provider — we never know it).
• Business: trade name, city, website address, information about your rooms (theme, description, photos or texts you send us to create the games).
• Billing: chosen plan, payment history and invoices. Payments are handled by Stripe: we never receive or store your card number.
• Communications: emails sent by the service (sending log), messages you send us, game change requests.

Purposes and legal bases

• Creating and managing your account, producing your games, putting them online, invoicing you: performance of the contract (Art. 6(1)(b) GDPR).
• Keeping invoices and accounting records: legal obligation (Art. 6(1)(c) GDPR).
• Securing the service and preventing fraud; telling you, as a customer, about what’s new: legitimate interest (Art. 6(1)(f) GDPR). You can object at any time.

Retention periods

• Account data: for the whole duration of the contract. Once it ends, your contact details may be kept for 3 years to contact you about our offers, unless you object.
• Invoices and accounting records: 10 years (Article L123-22 of the French Commercial Code).
• Log of emails sent: 6 months.

Players of the mini games

Did you play a mini escape game on an escape room’s website? That escape room is the controller of your data; EscapeDash processes it on its behalf, as a processor, and never uses it for its own purposes. We never sell or rent any data.

Data collected

• Your email address, only if you win and ask for your promo code.
• Your game data: progress, answers entered, dates and times, game language.
• Your agreement to receive the escape room’s offers (checkbox, required to receive the code).

Some escape rooms choose not to collect email addresses: the promo code is then shown right at the end of the game, and only your game data is processed.

We do not store your IP address and use no tracking cookies. The widget only saves a display preference in your browser (localStorage) — for instance that you closed the bubble — which is never sent to us.

Why, and on what legal basis

• Emailing you your promo code when you complete the mission: performance of the game you asked to play (Art. 6(1)(b) GDPR). One code per email address, per room and per month.
• Receiving the escape room’s offers and news by email: your consent (Art. 6(1)(a) GDPR and Article L34-5 of the French Postal and Electronic Communications Code), given by ticking the dedicated box. The promo code is offered in return for this agreement, as stated before you enter your address. These messages are sent by the escape room itself. You can withdraw your consent at any time, in one click from each message, without losing the code you already received.
• Improving the game and measuring its results for the escape room (number of games played, success rate) from game data: the escape room’s legitimate interest.

If you don’t want these offers, don’t enter your address: you can play freely, only the promo code is reserved for players who agree. If you withdraw your consent later, the escape room may no longer send you marketing.

Who can access it

The escape room on whose website you played (it sees winners’ emails and their choice about its offers in its dashboard), EscapeDash as processor, and our technical providers listed below, strictly within the scope of their task.

How long

• Email without consent to offers: deleted 12 months after your win.
• Email with consent to offers: kept 3 years from collection, or less if you withdraw your consent or ask for erasure.
• Game data: deleted after 12 months.
• Log of emails sent: deleted after 6 months.

The escape room can also delete a winner at any time from its dashboard.

Exercising your rights

Ideally, contact the escape room concerned. You can also write to us directly at contact@escapedash.com, stating the escape room and the email address you used: we will forward your request to the escape room and help it answer, usually by deleting or correcting the data ourselves. Your rights are detailed below.

Website visitors and contacts

You can browse this website without an account. We use no analytics or advertising tools. Our hosting provider technically processes requests (including IP addresses) to serve the website and protect it against abuse; we do not build any visitor file.

If you write to us, we use your contact details and message to reply (legitimate interest) and keep them as long as needed to follow up, then for at most 3 years after our last contact.

Our providers

We use the following providers, bound by contractual confidentiality and security commitments in line with Article 28 GDPR:

Supabase

Database and account authentication. Data hosted in the European Union (AWS, Paris region, eu-west-3).

Vercel Inc.

Hosting of the website and server functions (including the widget API). United States: transfers covered by the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

Stripe Payments Europe Ltd

Subscription payments and invoicing (customers only). Ireland; transfers to the United States covered by the Data Privacy Framework and standard contractual clauses. Stripe processes card data: we never receive or store it.

Resend

Transactional emails (winners’ promo codes, account emails). United States: transfers covered by standard contractual clauses and the Data Privacy Framework.

Cloudflare (R2)

Storage of game illustrations. No personal data is stored there.

Transfers outside the European Union

Our database is hosted in the European Union. Some providers (Vercel, Resend, and Stripe for part of its processing) are based in the United States or may access data from there. These transfers rely on the EU–US Data Privacy Framework adequacy decision where the provider is certified, and on the European Commission’s standard contractual clauses. You can ask us for a copy of these safeguards.

Cookies and local storage

We only use trackers that are strictly necessary for the service to work, which are exempt from consent (Article 82 of the French Data Protection Act):

• a session cookie to stay signed in to the dashboard (customers only);
• a cookie remembering the language you chose on this website;
• in the widget, a display preference saved in your browser (e.g. bubble closed).

No analytics, advertising or social media cookies: that is why no consent banner is shown. The escape room’s website where the widget is embedded may use its own cookies: please refer to its policy.

Security

Data is encrypted in transit (HTTPS/TLS). Access is limited to the people who need it, with authentication and permission checks: each customer only sees the data of its own games. The database is hosted in the European Union and administrative operations are logged. If a data breach is likely to put you at risk, the controller will inform you as required by the GDPR.

Your rights

Under the GDPR and the French Data Protection Act, you have the following rights over your data:

• right of access and rectification;
• right to erasure;
• right to restriction of processing;
• right to object, in particular to marketing, at any time and without giving reasons;
• right to portability of the data you provided;
• right to withdraw your consent at any time, without affecting processing already carried out;
• right to set instructions for what happens to your data after your death.

To exercise them, write to contact@escapedash.com. We reply within one month (which may be extended by two months for complex requests, in which case we let you know). We may ask you to confirm your identity if there is reasonable doubt.

If, after contacting us, you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr — or with the supervisory authority of your country of residence.

Changes

We may update this policy to reflect changes to the service or to the law. The date of the latest update is shown at the top of the page; customers are notified by email of any significant change.