Mill AndWho we are
This Privacy Policy explains how Mill And Design ("we", "us") collects and uses personal data when you use millanddesign.com. We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. (company number ), .
To contact us about privacy, please email us at [email protected] or use our contact form and choose the "Privacy question" topic.
What we collect
| Data | When | Why |
|---|---|---|
| Username, email address and password (stored only as a one-way encrypted hash) | When you create an account | To create and secure your account |
| Google account ID, name and verified email | Only if you choose "Continue with Google" | To sign you in with Google |
| Coin balance, XP, level, games opened and dates, sign-in times | While you use your account | To show your balance, level and recent games |
| Name, email, topic and message | When you send the contact or Player Care form | To reply to you and help with your request |
| Technical data such as IP address, browser type and pages requested | When you visit (standard web server logs) | To keep the Website secure and working |
We do not collect payment details, we do not use advertising or analytics trackers, and we do not sell your data.
Our lawful bases
- Contract: to provide your account, coins, levels and games when you sign up.
- Legitimate interests: to keep the Website secure, prevent misuse, answer messages and improve our games.
- Legal obligation: where we must keep or share data by law.
- Consent: for anything optional, which you can withdraw at any time.
How we keep it safe
- All forms are processed on our server. Nothing you type is stored in your browser or shown on a public page.
- Passwords are hashed with a strong one-way algorithm before they are saved, so nobody, including our team, can read them.
- Account records and form logs are stored in protected server folders that cannot be opened from the web.
- Sign-in uses a secure, HTTP-only session cookie, and repeated wrong passwords temporarily lock the account.
- The Website uses HTTPS, and contact messages are sent to our team over an encrypted (TLS) mail connection.
Who we share it with
We only share personal data with service providers who help us run the Website, under contracts that protect your data:
- Our web hosting provider, which stores the Website and its files.
- Brevo (Sendinblue SAS), which delivers contact and Player Care emails to our team.
- Google, only if you choose to sign in with Google.
Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to protect it. We may also share data if the law requires it.
How long we keep it
- Account data: until you delete your account, or 24 months after your last sign-in.
- Contact and Player Care messages and form logs: up to 12 months.
- Server security logs: up to 90 days, unless needed to investigate misuse.
Your rights
Under UK data protection law you have the right to access your data, correct it, delete it, restrict or object to how we use it, and receive a copy in a portable format. You can delete your account at any time from the Account page. For anything else, please email us at [email protected] or use our contact form. We reply within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to help first.
Under-18s
The Website is only for adults aged 18 or over in the UK. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, please contact us and we will delete it.
Changes to this policy
We may update this policy. The date at the top shows the latest version. Significant changes will be highlighted on the Website.