1. Data controller
LAST EXIT PUBLISHING (LEP), 41 rue de Coat-Tan, 29200 Brest, France. Email: support@bandit.cards.
2. Data and purposes
For orders we process name, email, phone number, delivery address or pickup point, and order details to take payment, fulfil and deliver the order, provide support and meet legal obligations. Stripe processes payment data; we do not store full card details.
3. Service providers
Data needed to provide the service may be sent to Stripe (payment), the shipping carrier used for the order (including Boxtal/Mondial Relay, La Poste/Colissimo or FedEx), Resend (transactional email), Railway (hosting), Google Analytics/Google Ads after consent (measurement), and OpenAI when a visitor uses Bandit GPT.
4. Retention
Order and invoice records required for accounting and legal obligations are retained for the applicable statutory periods, including ten years for French accounting documents. Other support data is deleted or anonymised when no longer necessary. First-party analytics is retained for up to 13 months and Bandit GPT logs for up to 12 months.
5. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, objection or portability by emailing us. You may withdraw consent at any time and lodge a complaint with the CNIL or your local data-protection authority.
6. Cookies and measurement
Strictly functional storage supports the cart, language and security. First-party audience measurement, advertising attribution, affiliate tracking, Google Analytics and Google Ads run only after consent. Purchase contact data may be normalised, securely hashed and sent to Google for Enhanced Conversions only after the required consent. Refusing measurement does not prevent ordering or using the game.
7. Bandit GPT
The visible conversation remains in the browser. The server stores the question, response, status, language, pseudonymous identifier and browser information for quality and security for up to 12 months. Questions are sent to OpenAI to generate answers.
8. Affiliate accounts and legal bases
If you join the affiliate programme, we process your name, email, password hash, payout details and attributed-sale records to administer the programme and pay commissions. Order and affiliate administration is based on performance of the requested contract; accounting retention is based on legal obligations; optional measurement is based on consent; service security and fraud prevention rely on our legitimate interests. Required form fields are marked as such; without them we cannot process the order or create the requested account.
9. International transfers
Some providers may process data outside the European Economic Area. Where required, transfers are governed by an applicable adequacy decision or the contractual transfer safeguards available under the relevant provider agreement. You may ask us for further information. We do not sell personal data.
10. Optional checkout assistance
If you explicitly tick the checkout reminder box, we store your email, selected country, language, pack and consent record to send at most one reminder after 90 minutes. No reminder is sent if a completed order is detected first. The link expires after 7 days. After 30 days, identifiers, sparse dimensions and exact times are removed; only month-level performance events may be retained for up to 13 months. The optional checkout questionnaire stores the selected reason, an optional comment and technical checkout context for up to 12 months. It has no shared identifier with the reminder. Email addresses and phone numbers entered in the free comment are automatically removed.
11. Pickup-point search and map
The street, number, postal code and city entered to find a pickup point are sent through our server to Boxtal and, if needed, Mondial Relay. They are used only for this search, remain in the browser session draft and are not saved with the order. After a successful search, map software is loaded from unpkg and map tiles from OpenStreetMap; those providers receive standard connection data such as IP address and browser information, as well as the approximate area displayed on the map.
12. Verified customer reviews
After a direct purchase, we may send one neutral email inviting you to review BANDIT. This relationship message is based on our legitimate interest in improving the game and informing customers; it contains no promotion and includes a one-click opt-out. If you choose to submit a review, we process your rating, text, display name, language, order and review dates, moderation status and verified-purchase evidence for publication and review integrity. Your email and order number are never displayed. We contact only the email address used for the order and only when necessary to verify the purchase or moderate the contribution.
Published reviews and their automatic translations are retained for up to 5 years; pending or rejected submissions for up to 12 months; and invitation and delivery records for up to 24 months. A pseudonymous email fingerprint used to prevent repeated invitations or submissions is kept for no more than 5 years; a separate opt-out fingerprint is kept for as long as the objection remains active. OpenAI receives only the public review text and target language when a visitor requests a translation. If a review is rejected, a clear, understandable reason is sent to the order email address; the decision may be challenged through support@bandit.cards. A submitted review cannot be edited. You may object to invitations, request removal of your review at any time and, where appropriate, receive a new invitation to submit another review. Order records required by law remain subject to their separate statutory retention periods. See our review policy.