Privacy policy

1. Who we are

This privacy policy explains how personal data is processed when you use CardSuffly at cardsuffly.com (the “site”). The site is operated by Viiskanta Constellation, Finland, VAT number FI28596934 (Finnish Business ID 2859693-4). Viiskanta Constellation is the controller of the personal data described in this policy (“we”, “us”). The site is not offered to visitors in Canada or the United Kingdom, and access from those countries is blocked. The sections on those countries apply only if their residents reach the site anyway, for example through a VPN.

You can contact us about privacy with the privacy request form at the end of this page. We are not required to appoint a data protection officer, so the owner of Viiskanta Constellation is the person responsible for privacy matters, including under Quebec law and as the contact channel required by Brazil’s LGPD.

2. Summary

• You do not need an account. We do not ask for your name, email address or any other details to use the site.
• Card draws, readings and games run entirely in your browser. We do not receive or store what you draw.
• We do not use our own analytics or tracking tools.
• The site shows ads from Google AdSense. Google and its partners may use cookies and similar technologies for ads. Where the law requires it, this only happens after you agree in Google’s consent message.
• We do not sell personal data for money. Under some US state laws, advertising cookies can count as “selling” or “sharing”, and you can opt out (see sections 8 and 10).

3. What we process, why and on what legal basis

Server logs. When you open a page, your browser sends technical data to our web host: IP address, date and time, the page requested, the referring page, and browser and device type. Our hosting provider records this in server logs. We use it only to deliver the site, keep it secure and fix errors. Legal basis: our legitimate interest in running a secure website (GDPR Article 6(1)(f)). The logs are deleted by the hosting provider’s routine log rotation once they are no longer needed for these purposes.

Data stored on your device. The site uses your browser’s local storage to remember your settings (for example whether reversed cards are allowed), game records such as your best score or time, and whether you have already revealed today’s card of the day. This data stays on your device and is never sent to us. It is strictly necessary for features you choose to use, so no consent is needed (Article 5(3) of the ePrivacy Directive and the national laws based on it). You can delete it at any time by clearing your browser’s site data.

Shared readings. If you use “Share this reading”, the cards drawn are written into the link. The link is only shared if you send it to someone. It contains no information about you.

Advertising (Google AdSense). We use Google AdSense, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for visitors in the EEA, the UK and Switzerland, and by Google LLC (USA) elsewhere. To show ads, Google and its advertising partners may read and store cookies and similar identifiers on your device and process your IP address, device and browser information, approximate location derived from your IP address, the pages you view and your interactions with ads. This is used to show ads, limit how often you see the same ad, measure ad performance and prevent fraud, and, if you allow it, to show ads based on your interests (personalised ads). Legal basis: your consent (GDPR Article 6(1)(a)), which you give or refuse in Google’s consent message. If you refuse, Google may still show non-personalised or limited ads, which use cookies only as permitted by your choices. Google uses this data as an independent controller for its own purposes, described in How Google uses information from sites that use its services and the Google Privacy Policy. The advertising partners Google works with are listed in the consent message.

Consent records. Google’s consent tool stores your choice on your device (as a consent string and cookies) so that it does not ask you on every page. Legal basis: our legal obligation to be able to show that consent was given (GDPR Articles 6(1)(c) and 7(1)).

Privacy requests. If you use the privacy request form, we process your email address, country or state, and the content of your message to handle your request and reply to you. Legal basis: our legal obligation to answer data protection requests (GDPR Article 6(1)(c)). We keep this correspondence for as long as needed to handle the request and to show that we handled it correctly, normally no longer than three years.

We do not use your data for automated decisions that have legal or similarly significant effects on you.

4. Cookies and similar technologies

• Strictly necessary (local storage, first party): your settings, game records and card of the day status. Kept until you clear your browser data. Never sent to us.
• Consent choice (Google, for example FCCDCF and FCNEC): stores your consent decision. Kept for up to 13 months.
• Advertising (Google and its partners, for example __gads, __gpi and __eoi on cardsuffly.com, and IDE on doubleclick.net): used for showing and measuring ads, frequency capping and fraud prevention, and for personalised ads if you allow them. Kept for up to 13 months, depending on the cookie.

Advertising cookies are only set after your consent where the law requires consent. The exact list of cookies and partners can change; the current details are shown in Google’s consent message.

5. Who receives data

• Our hosting provider (hosting.com), which processes server logs on our behalf as a processor under a data processing agreement.
• Google and its advertising partners, as described in section 3.
• Authorities, only when we are legally required to disclose data.

We do not give or sell your data to anyone else.

6. International transfers

Google and some of its partners process data in the United States and other countries. Transfers from the EEA, the UK and Switzerland to the USA are covered by the EU–US Data Privacy Framework, its UK extension and the Swiss–US Data Privacy Framework, under which Google LLC is certified, and otherwise by the European Commission’s Standard Contractual Clauses. Our hosting provider’s servers may be outside your country; where data leaves the EEA, the transfer is protected by Standard Contractual Clauses or an adequacy decision.

If you are in Latin America, Canada or elsewhere, your data may likewise be processed in the EU and the USA. We rely on these safeguards and, where your law requires it, on your consent to the transfer given through Google’s consent message or by using the site.

7. How long we keep data

• Server logs: only as long as needed for security and error fixing, then deleted by routine log rotation.
• Local storage: on your device until you delete it.
• Consent and advertising cookies: up to 13 months, as described in section 4.
• Privacy requests: normally up to three years.

8. Your choices

• Change or withdraw consent: visitors in the EEA, the UK and Switzerland can reopen Google’s consent message at any time with the “Privacy and cookie settings” link in the footer or the button below. Withdrawing consent does not affect processing done before.
• US visitors: use the “Do Not Sell or Share My Personal Information” link that Google shows to visitors in US states with privacy laws.
• Global Privacy Control: if your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of the sale or sharing of personal data and ask Google to show you only non-personalised ads.
• Do Not Track: there is no common standard for Do Not Track signals, so the site does not respond to them. We do respect Global Privacy Control.
• Google settings: you can manage ad personalisation in My Ad Center and learn more about interest-based ads at youronlinechoices.eu, aboutads.info and youradchoices.ca.
• Your browser: you can block or delete cookies and site data in your browser settings. The site still works, but ads may be less relevant.

9. Your rights in Europe

European Economic Area (EU member states, Iceland, Liechtenstein and Norway). Under the General Data Protection Regulation (GDPR) you have the right to access your personal data, have it corrected, have it erased, restrict its processing, receive it in a portable format, object to processing based on legitimate interests, and withdraw your consent at any time. You also have the right to lodge a complaint with the data protection authority of the country where you live or work, or with our lead authority, the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

United Kingdom. You have the same rights under the UK GDPR and the Data Protection Act 2018, and can complain to the Information Commissioner’s Office (ico.org.uk).

Switzerland. You have the rights given by the Federal Act on Data Protection (FADP), including access, correction and deletion, and can contact the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

Other European countries outside the EEA (for example Albania, Andorra, Bosnia and Herzegovina, Georgia, Kosovo, Moldova, Monaco, Montenegro, North Macedonia, San Marino, Serbia, Turkey and Ukraine). We give you the same rights as under the GDPR, in addition to any rights under your national data protection law. You can also complain to your national data protection authority.

10. Your rights in North America

California (CCPA as amended by the CPRA). In the last 12 months we and Google have collected these categories of personal information: identifiers (such as IP address and cookie or device identifiers), internet or other electronic network activity (pages viewed, interactions with ads), approximate geolocation derived from IP address, and inferences drawn by Google for advertising. Sources: your browser and device. Purposes: providing and securing the site, and advertising as described in section 3. We disclose identifiers and internet activity to Google and its advertising partners for cross-context behavioural advertising, which can count as “sharing” and, in some cases, “selling” under California law. We do not sell or share personal information for money, we do not collect sensitive personal information, and we do not knowingly sell or share the personal information of consumers under 16. You have the right to know what personal information we collect, use and disclose, to access it, to have it deleted or corrected, to opt out of its sale or sharing, and not to be discriminated against for using these rights. You may use an authorised agent; we may ask the agent for proof of authorisation. We keep data only as long as described in section 7.

Other US states. If you live in a state with a comprehensive privacy law, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, you have the right to confirm whether we process your personal data, to access, correct and delete it, to get a portable copy, and to opt out of targeted advertising, the sale of personal data and profiling. If we decline your request, you can appeal by replying to our answer; we will respond to the appeal within the time set by your state’s law. If the appeal is denied, you can contact your state Attorney General. Nevada residents can ask us not to sell their covered information; we do not sell it within the meaning of Nevada law but will record such a request.

Canada. Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial laws, including Quebec’s Act respecting the protection of personal information in the private sector (Law 25) and the laws of Alberta and British Columbia, you have the right to access your personal information, ask for corrections and withdraw your consent, subject to legal limits. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial commissioner, such as the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

Mexico. Under the Federal Law on the Protection of Personal Data Held by Private Parties, you have the ARCO rights (access, rectification, cancellation and opposition) and the right to revoke your consent. You can also contact the Mexican authority responsible for personal data protection.

11. Your rights in Central and South America

Brazil (LGPD, Law 13.709/2018). You have the right to confirmation that your data is processed, access, correction of incomplete or inaccurate data, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with your consent, information about who we share data with, information about the possibility of not giving consent and its consequences, revocation of consent, and to object to processing. You can petition the National Data Protection Authority (ANPD). As a small processing agent, we provide the privacy request form as our communication channel.

Argentina (Law 25.326). You have the right to access your data free of charge at intervals of no less than six months, unless you have a legitimate interest, and to have it corrected, updated or deleted. The Agency for Access to Public Information (AAIP), as the supervisory authority of Law 25.326, has the power to handle complaints and claims from those affected in their rights by non-compliance with the rules on personal data protection.

Chile, Colombia, Ecuador, Paraguay, Peru, Uruguay and other countries in the region. Under your national data protection law (for example Chile’s Law 19.628 and Law 21.719, Colombia’s Law 1581 of 2012, Ecuador’s Organic Law on Personal Data Protection, Peru’s Law 29733 and Uruguay’s Law 18.331) you have the right to access, correct, update and delete your data, to object to its processing and to withdraw consent. You can complain to your national data protection authority, such as Colombia’s Superintendence of Industry and Commerce (SIC), Uruguay’s Personal Data Regulatory and Control Unit (URCDP) or Peru’s National Authority for the Protection of Personal Data.

12. How to use your rights

Send your request with the privacy request form. It is free of charge. We answer within the time required by the law that applies to you, for example one month under the GDPR (extendable by two months for complex requests), 45 days under US state laws (extendable by 45 days), 30 days under Canadian law and 15 days under Brazil’s LGPD.

Because the site has no accounts, we usually hold no data that identifies you by name. To protect you, we may ask for information that lets us link a request to the data concerned, such as the date and time of your visit. Requests about advertising data can also be made directly to Google in My Ad Center or through Google’s privacy help.

13. Children

The site is not directed at children under 13, and in the EEA not at children below the age of digital consent in their country (between 13 and 16). We do not knowingly collect personal data from children, and children’s data is not used for personalised ads. Some pages, such as the Kings drinking game and the lottery number generator, are meant for adults only. If you believe a child has given us personal data, contact us and we will delete it.

14. Security

The site is served only over an encrypted HTTPS connection. We keep the personal data we process to a minimum and limit access to it. No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures to protect personal data.

15. Changes to this policy

We may update this policy when the site, our partners or the law change. The date at the top shows when it was last updated. If we make significant changes, we will show a notice on the site.

This policy is available in several languages. Where the law allows, the English version prevails if the translations differ.