Who we are
This policy explains how Elenabe Besh ("we", "us") collects and uses personal information when you use elenabebesh.com. We are the data controller for this information.
The data controller is Elenabe Besh.
Questions or requests: use the contact form and choose Privacy question, or email .
What we collect
- When you sign up with email: first name, last name, email address, UK phone number and a password. Your password is turned into a one-way scrambled code (a hash) before it is saved, so it is never stored as you typed it.
- If you sign up with Google: your name, verified email address and Google account ID, which our server checks with Google. We ask for your phone number separately. We never receive your Google password.
- While you use your account: your coin balance, experience points and level, the date of your last daily bonus, how many games you've opened and the last few games you opened.
- For security: the date you joined, your last sign-in, and a count of wrong password attempts (five wrong tries lock the account for 15 minutes).
- When you contact us: your name, email address, topic and message.
- Form records: when a form is sent we note the date, the form, whether it worked, and your name and email. Passwords are never recorded.
We don't collect payment details. There is nothing to buy on the site.
Why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and running your account, coins, bonuses and levels | Contract: we need it to provide the service you asked for |
| Checking you are 18+ and in the UK | Legal obligation and legitimate interests |
| Keeping accounts secure and stopping abuse and spam | Legitimate interests |
| Replying to messages and acting on break or restriction requests | Legitimate interests, and contract for account requests |
We don't use your information for advertising, we don't sell it, and we don't make automated decisions about you.
Where it's kept
Your account is stored on our own server as a protected file that can't be opened from the web. It is not stored in your browser. It stays there until you delete your account from My account, or ask us to delete it.
Signing in sets one strictly necessary session cookie (eb_sid). It holds a random identifier only, can't be read by page scripts, and ends when you close your browser or sign out. See our Cookie policy.
Messages you send through the contact or Player Care forms are emailed from our server to our support inbox through our email delivery provider (Brevo), over an encrypted connection. A copy is kept in a protected log on our server so we can reply and confirm it arrived. We delete it once your request has been dealt with, and in any case within 12 months.
Form records are kept in a protected log on our server for up to 12 months for security, then deleted.
Who we share it with
- Our hosting provider, which runs the server where accounts and logs are stored.
- Brevo, which delivers contact and Player Care emails to our inbox.
- Google, only if you choose Continue with Google. Google's own privacy policy applies to that sign-in.
- Authorities, only if the law requires it.
Our games and fonts are hosted on our own server, so playing a game doesn't share your information with a games provider. If any provider stores information outside the UK, we make sure suitable safeguards are in place.
Your rights
Under UK data protection law you can ask to see, correct or delete your information, ask us to limit how we use it, object to how we use it, or ask for a copy to take elsewhere.
- You can see your details on My account, and delete your account yourself at any time. This removes your account file from our server straight away.
- For anything else, use the contact form. We reply within one month.
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
Elenabe Besh is only for adults aged 18 or over. We don't knowingly collect information about anyone under 18. If you believe a child has created an account, tell us and we will delete it.
Keeping it safe
The site uses an encrypted (HTTPS) connection. Account files and logs sit in folders that are blocked from the web. Passwords are stored only as hashes, sign-in sessions are renewed when you sign in, and repeated wrong passwords lock the account for 15 minutes. No system is perfectly secure, so please use a password you don't use anywhere else.
Changes to this policy
We'll update this page if anything changes. The date at the top shows the latest version.