Privacy policy

Who we are and scope

Lambquil Oy (“Lambquil”, “we”, “us” or “our”), Kaijonharjuntie 19, 90570 Oulu, Finland, is the data controller for the processing described here: we decide why and how that information is used. Contact us about privacy or your rights at contact@lambquil.com.

This policy covers Lambquil.com (including its public research information pages), the current Maxi Yatzy browser game at maxi-yatzy.com, and Lambquil Market Research. The Maxi Yatzy section also describes its development preview. Each service has different data practices; a feature or provider listed for one service does not automatically apply to the others.

Additional websites, games and mobile applications will be identified here as they are introduced. Planned advertising and leaderboards are not current features of the services described below. We will update the relevant section before introducing new processing.

Hosting and security

Cloudflare provides hosting and delivery for Lambquil.com and Maxi Yatzy. Delivering pages and protecting them from abuse involves technical request data, including IP addresses, requested URLs, browser information (user agent) and request times. IP addresses and other technical information can be personal data even when you do not create an account.

The websites are served over HTTPS. Cloudflare may use security cookies where a security feature requires them, for example after a challenge. This is separate from game storage and visitor analytics. Lambquil has not enabled additional application logging or log exports beyond Cloudflare’s default dashboard statistics. Cloudflare’s own service and security processing still applies. Retention is explained below.

Cloudflare Network Error Logging is also enabled. A supporting browser may automatically send Cloudflare a report about a failed network request, including the requested URL and technical error details, to help diagnose connection problems. Cloudflare states that it uses the client IP address to derive network and location information (network provider, country and metro area), then drops the IP address when the report request finishes and does not log it in the Network Error Logging pipeline. This is separate from the disabled Web Analytics beacon. See Cloudflare’s Network Error Logging documentation.

Purposes and legal bases

The following bases apply where the information is personal data. Anonymous aggregate research or statistics do not identify an individual.

Delivering and protecting the websites and browser game

Legitimate interests (GDPR Article 6(1)(f)): making the services requested by visitors available, preventing abuse and diagnosing technical problems, using the technical request information described above.

Responding to messages

Legitimate interests (Article 6(1)(f)): answering questions and providing support using the contact details and message content you send us.

Basic traffic statistics

Legitimate interests (Article 6(1)(f)): understanding traffic and diagnosing delivery problems using Cloudflare’s server-side request statistics. This is separate from the optional browser analytics beacon, which is disabled.

Internal market research

Legitimate interests (Article 6(1)(f)): evaluating product opportunities and operating and troubleshooting the Google Ads integration. This applies to any account or diagnostic metadata that relates to an identifiable person, rather than the aggregate keyword metrics themselves.

Handling data protection requests

Legal obligation (Article 6(1)(c)): meeting our duties under the GDPR to respond to and document requests concerning your rights.

You can object to processing based on legitimate interests because of your particular situation. We limit these purposes to providing and protecting the services, answering your messages, understanding basic traffic and operating the internal research integration.

Who receives information

• Cloudflare: website delivery and security for the public sites, including basic server-side traffic statistics.
• Google: authentication information, account identifiers and requests for the internal Google Ads API integration. Google does not receive website visitors’ game scores through this integration.
• Microsoft: Microsoft 365 (Exchange Online) handles Lambquil’s email, including messages sent to contact@lambquil.com and their attachments.
• Lambquil personnel handling the relevant task: messages or internal research as appropriate.

Cloudflare processes website request data on our behalf, and Microsoft processes mailbox contents on our behalf, under their standard data-processing terms. Providers also process some information for their own service administration, security and legal purposes. Google handles the internal API requests and account information under its applicable service terms and privacy policy. Providers may use subprocessors to deliver their services.

International transfers

Our providers operate internationally. Information may be processed outside the European Economic Area (EEA), including in the United States. The local research database stays on the operator’s computer, but requests sent to Google involve its international services.

• Cloudflare: its Data Processing Addendum, incorporated into its standard service agreement, provides for the EU–US Data Privacy Framework where applicable and EU standard contractual clauses for restricted transfers.
• Microsoft: the Microsoft Products and Services Data Protection Addendum provides contractual safeguards, including EU standard contractual clauses, for its online services.
• Google: its published data-transfer framework describes reliance on adequacy decisions, including the EU–US Data Privacy Framework, and standard contractual clauses where an adequacy decision does not cover a transfer.

An adequacy decision recognises an appropriate level of data protection in a destination; standard contractual clauses impose data-protection duties on the parties. The linked terms explain these safeguards. Contact contact@lambquil.com for more information or a copy of the relevant safeguards.

How long information is kept

We retain correspondence while it is needed to answer your question, handle the support issue or resolve related follow-up. Records of data-protection requests are kept as needed to handle the request and demonstrate our response. Retention also takes account of any applicable legal duty or unresolved legal claim. These are purpose-based criteria, not an automatic mailbox deletion schedule. Microsoft’s service includes recovery and deletion processes, so deleting a message does not necessarily erase every service copy immediately.

For Cloudflare’s service and security information, its privacy policy bases retention on the processing purpose, the nature and risk of the data, and legal or contractual requirements. Lambquil has not enabled separate log exports or an additional application-log archive. There is no single verified deletion period covering all Cloudflare request and security data.

Cloudflare Web Analytics was previously enabled on the public sites and was disabled on 9 October 2026. It measured visits and browser performance. Cloudflare describes it as not using cookies, local storage or fingerprinting to track visitors. Disabling the beacon stops new collection from newly loaded pages; it does not itself erase earlier reports. Cloudflare documents access to the previous six months of analytics, which is a reporting window, not a guarantee that every underlying record is deleted at six months. See its Web Analytics FAQ.

Game storage and local research files have the separate retention arrangements described below. Google’s own account and service records follow its retention policy: periods depend on the data and purpose, including security and legal requirements. Deleting Lambquil’s research files does not delete Google’s service records.

Your rights and complaints

Under the GDPR, subject to the conditions for each right, you can:

• Ask whether we process your personal data and obtain access and a copy.
• Have inaccurate information corrected and incomplete information completed.
• Ask for erasure or restriction of processing.
• Object to processing based on legitimate interests on grounds relating to your situation. We must stop unless we demonstrate overriding compelling grounds or need the data for legal claims.
• Receive data you provided in a portable format where automated processing is based on consent or a contract.
• Withdraw consent at any time. You can always object to direct marketing.

Email contact@lambquil.com and identify the relevant service and request. Do not send passwords, API keys or other credentials. We may request proportionate information to verify your identity. We normally respond free of charge within one month; if complexity or the number of requests requires up to two additional months, we will explain the extension within the first month.

We cannot retrieve game records that exist only in your browser. If we cannot identify data relating to you in our systems, we will explain that limitation; you may provide additional information that helps identify it. You can clear local game data yourself as described below.

You may complain to a supervisory authority, particularly in the EU/EEA country where you live or work or where an alleged infringement occurred. In Finland, contact the Office of the Data Protection Ombudsman, email tietosuoja@om.fi, postal address P.O. Box 800, 00531 Helsinki, Finland. You do not have to contact us first.

The services described here do not use personal data for automated decisions with legal or similarly significant effects on you.

Changes to this policy

We will revise this page and its last-updated date when our practices change. Where a change requires additional information or consent, we will provide that information or request consent in the relevant service before the new processing begins. Continuing to use a service is not itself consent to new processing.

A. Lambquil.com

The company website presents Lambquil and its games. It has no visitor accounts and serves no advertising. Cloudflare hosts and delivers it. Hosting and security involve the technical request data described in Part I. The website does not set application cookies; Cloudflare security cookies are described above.

Cloudflare provides basic traffic and request statistics from the requests it handles. The optional Cloudflare Web Analytics browser beacon is disabled. The company site does not currently use that browser-based measurement.

Contacting us

You can contact Lambquil by email. If you write to us, we receive your email address, any name you provide, message contents and attachments so we can respond. Providing these details is voluntary, but we need a return address to reply. Browsing and playing do not require you to send a message.

Newsletter signup is currently closed. The previous signup page received no subscriptions, so Lambquil has no newsletter subscriber records from that page.

External destinations have their own practices. See Cloudflare’s privacy policy for information about the website host.

B. Maxi Yatzy

The current browser game has no accounts, registration, advertising or public leaderboards. It does not ask for your name or email. Game progress, scores and settings stay in your browser and are not uploaded to Lambquil or a game server.

Storage on your device

The game uses browser local storage to remember the following between visits:

maxiYatzy.game

Your game in progress.

maxiYatzy.best

Your best score.

maxiYatzy.settings

Settings, such as score suggestions.

maxiYatzy.language

Your chosen language.

maxiYatzy.learned

Which how-to-play hints you have seen and whether the first-game scorecard tour has been shown.

This storage supports playing, resuming and remembering your choices. Local storage persists between visits until cleared or replaced; there is no fixed expiry described for these records. Clear the game site’s data in your browser settings to remove it. Clearing or blocking storage can remove saved progress and prevent settings from being remembered. Different browsers and the development preview have separate site storage.

Hosting and visitor statistics

Cloudflare hosts and protects the game, processing request information such as your IP address, requested URL and browser details. The game itself does not use cookies, although Cloudflare may set a security cookie where needed. Game assets, including its font, are served from the game’s own site.

Cloudflare provides basic server-side traffic and request statistics. The optional Cloudflare Web Analytics browser beacon is disabled. Game scores and saved progress are not included in the server-side traffic statistics.

C. Lambquil Market Research

This tool is for Lambquil’s internal product research only. There are no public accounts or signups. It uses the Google Ads API for keyword research, not to display advertisements to website visitors. The current integration does not create advertisements or change campaigns.

Information accessed and its sources

• Entered by the operator: seed keywords, selected countries or geographic targets, languages and internal project names.
• Returned by Google Ads: keyword ideas and close variants, available search-volume estimates, advertising competition, bid ranges and monthly search history. These are aggregate planning metrics, not individuals’ search histories.
• Account and technical metadata: the configured Google Ads customer ID, optional manager account ID, account currency, targeting identifiers, retrieval times and run status. Diagnostics may include error codes and Google request IDs. These come from the operator’s configuration, Google’s responses and the tool’s runs.

Research inputs are sent to Google to request keyword ideas and metrics. Lambquil uses the results to investigate demand, compare countries and languages, and inform product decisions. Account metadata supports authentication and interpretation of results; diagnostics help resolve failed requests. The tool does not identify individual searchers.

Authentication and credentials

The tool authenticates with a Google service account. Visitors are not asked to sign in with Google, and it does not access their Gmail, Drive files, contacts or personal search histories. Authentication keys are kept separately from research records. Private keys and access tokens are not stored in the research database or CSV exports.

Local files, retention and deletion

Research inputs, results, account metadata and retrieval details are stored in a local SQLite database on the operator’s computer for Lambquil’s internal use. Selected results can be exported as CSV files. The tool does not publish these records or automatically upload saved databases or exports to third-party services. Public information pages do not expose the database, and the website host does not receive it through the tool.

There is no automatic expiry for saved research. Records remain until Lambquil deletes them. A database deletion does not remove separately exported CSV files or other copies; those must be deleted separately. Revoking the service account’s access stops future Google Ads access but does not erase research already saved.

No cloud-backup service has been selected. Before research files are backed up externally, we will update this policy to identify the provider and the information stored there. Any personal information in research files is retained only while needed for the research or troubleshooting purpose; deletion is manual.

Google and the public information pages

Google receives the authentication information, account identifiers and research requests needed for the integration, under its applicable service terms and privacy policy. The public research information pages contain no forms, advertising or application cookies. As pages on Lambquil.com, their hosting, website analytics and any email inquiries are covered by the Lambquil.com section. Website analytics does not receive the local research database or CSV exports through the tool.