Nutty OrangeNutty Orange
Back to home

Privacy Policy

Last updated: July 2026

This policy sets out the basis on which Barton Technology Ltd, Company No. 3930086, of Suite 652, 124 City Road, London, EC1V 2NX (“we”, “us”, “our”), will process any personal data we collect from you, or which you provide to us, in the course of using nuttyorange.games. We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

Information we collect

The detective quiz (/quiz)

If you complete our detective quiz and submit the form at the end, we collect:

  1. your name;
  2. your email address;
  3. the detective agency name you choose (a free-text answer, so it may contain anything you type);
  4. your answers to the quiz questions. These include the country or region you are based in, your age range, how you heard about us, what brought you to the site, the mystery genres and types of offer you prefer, and your self-assessed puzzle-solving preferences;
  5. marketing attribution data: any UTM campaign parameters in the link you arrived on, the web page that referred you, and the address of the page you submitted the form from.

Game registration (/register-game)

If you register a game you have bought, in order to unlock the bonus downloads, we collect:

  1. your first and last name;
  2. your email address;
  3. which game you are registering;
  4. where you bought it (for example, which Amazon store);
  5. your order or invoice number, if you choose to give it (optional);
  6. the same marketing attribution data described above (UTM parameters, referring page, and the page you submitted from).

We do not verify your purchase and we do not receive any payment or card details through this site.

Purchases made on our shop

Our shop at nuttyorange.com is a separate Shopify store. When you place an order, create an account, or opt in to marketing there, Shopify sends us your name, email address, the products ordered, and the marketing attribution data attached to your visit, so that we can add you to our customer contact records. We only add you to marketing from a shop account signup where you have indicated you accept marketing.

Collected automatically

  1. Technical information about your device, browser type, operating system, and IP address. Your IP address is used in memory, for up to a minute at a time, to rate-limit our forms and downloads against abuse;
  2. Information about your visit including pages viewed, referring source, and time spent on the site;
  3. Cookie identifiers used by our analytics providers (only with your consent — see the Cookies section below).

Why we use it, and our lawful basis

  1. To send you the emails you asked for — your game recommendation, hints and bonus content, and occasional news about new games. Lawful basis: consent, given when you submit the form. Every email includes an unsubscribe link.
  2. To unlock and deliver your bonus downloads and to recognise which game you registered. Lawful basis: performance of a contract / our legitimate interest in delivering the content we promised you.
  3. To check that an email address is genuine before we add it, so that our emails reach real inboxes. Lawful basis: legitimate interests (protecting our email deliverability and preventing abusive signups).
  4. To understand which games and questions people respond to and improve what we make and how we describe it. Lawful basis: legitimate interests, or consent where the data comes from analytics cookies.
  5. To keep the site secure — rate limiting, verifying download entitlements, and diagnosing errors. Lawful basis: legitimate interests.
  6. Analytics. Lawful basis: your consent, given via the cookie banner.
  7. Advertising and remarketing — to show you our games again on other websites and social platforms after you have visited, to build audiences of people who have shown an interest, and to measure which of our ads led to a signup or a sale. Lawful basis: your consent, given via the cookie banner. This is a separate choice from analytics — saying yes to measuring does not say yes to advertising.

Who we share it with

We do not sell your personal data. We share it with the service providers we use to run the site and our email programme, each acting as our processor and only for the purposes described above:

  1. Email marketing platform (Emailit) — receives your email address, first name, last name where given, and your attribution data, plus flags recording which game you registered, where you bought it, and your order number where given. This is what sends you our emails.
  2. Our own contact database (BartMail, hosted on Supabase) — our primary record of your contact details, name, attribution data, the tags describing which forms you completed, your quiz answers and detective agency name where given, and flags recording which game you registered, where you bought it, and your order number where given.
  3. Email verification service (Reoon) — receives your email address only, to check it is valid and not disposable.
  4. Our own business email (Microsoft 365 / Microsoft Graph) — a notification of your quiz signup, containing your name, email, detective agency name and attribution data, is sent to our own internal address.
  5. Hosting and content delivery (Vercel, Cloudflare, Cloudinary) — host the site, store the downloadable PDFs, and serve our images. They process technical data such as your IP address as part of delivering the site to you.
  6. Error monitoring (Sentry) — records technical diagnostic information when something goes wrong, which can include your IP address and a recording of the actions in your browser that led to the error.
  7. Analytics (Rybbit and Google Analytics 4) — only after you accept cookies. See the Cookies section.
  8. Advertising and remarketing platforms — currently Google Ads and Meta, which covers Facebook and Instagram — only if you agree to advertising cookies. They receive an identifier for your browser or device, which of our pages you looked at, and whether you completed a form, so that we can show you our games again elsewhere and count which ads brought people here. We may add other advertising or social platforms of the same kind in future; this page and the cookie settings page always name the ones actually in use.

Some of these providers are based outside the UK, so your data may be transferred internationally. Where that happens we rely on the provider’s standard contractual clauses or an equivalent safeguard.

We may also disclose personal data where we are required to do so by law, or to establish, exercise or defend legal claims.

Cookies, analytics and advertising

We use cookies and similar tracking technologies for two separate purposes: measuring how the site is used, and advertising. The banner on your first visit asks about both, and you get three options — Accept all, Analytics only, or Reject all. Nothing but the strictly necessary cookie described below runs until you choose, and saying yes to measuring does not say yes to advertising. Your choice is stored in your browser’s local storage until you change or clear it.

Measuring how the site is used (analytics)

Loaded only if you accept analytics cookies:

  1. Rybbit — privacy-first, self-hosted analytics that does not use persistent identifiers or cross-site tracking;
  2. Google Analytics 4 — Google’s analytics platform. Google’s privacy policy is at policies.google.com/privacy.

Advertising and remarketing

Loaded only if you accept advertising cookies. These let an advertising platform recognise your browser or device so that we can show you our games again on other sites, apps and social platforms after you have been here (that’s remarketing), build audiences of people who have shown an interest in a particular game, and see which of our ads actually led to a signup or a sale. Our lawful basis for all of it is your consent.

The platforms we use for this are:

  1. Google Ads — conversion tracking and remarketing audiences, using the same Google tag infrastructure as Google Analytics. Google’s privacy policy is at policies.google.com/privacy;
  2. Meta — the advertising platform behind Facebook and Instagram, using the Meta pixel. Meta’s privacy policy is at facebook.com/privacy/policy.

We may add other advertising, social or affiliate platforms of the same kind in future — the same consent rules apply to any of them, and this page is updated to name them when they go live. We do not sell your personal data, and we do not let these platforms use what they learn here for anything other than our own advertising.

We also use Google Consent Mode, which means that if you say no to advertising, Google’s tags are told not to store or use advertising identifiers for you at all.

The one cookie we set regardless

When you register a game we set a signed cookie named _nog_rt, which lasts 24 hours and is what unlocks your bonus downloads. It contains only the game you registered and a timestamp — no personal data — and it is not used for advertising or analytics. It is strictly necessary and is set regardless of your cookie choice, because the downloads cannot work without it.

Changing your mind

You can change or withdraw your choice at any time on our cookie settings page — turn advertising off, turn analytics off, or clear the lot and be asked again. Withdrawing is as easy as giving consent and takes effect immediately; it does not affect anything done before you withdrew. You can also block cookies at the browser level — note this may affect how some sites function.

Data retention

We keep your contact details and the information linked to them for as long as you remain subscribed to our emails, and afterwards only as long as we need to in order to honour your unsubscribe or deletion request and to meet our legal obligations. You can ask us to delete your data at any time using the contact address below.

Quiz answers are retained alongside your contact record and used to shape the games and emails we produce. Analytics data is retained in accordance with the retention settings of each analytics provider. The download cookie expires after 24 hours. IP addresses held for rate limiting are kept in memory only, for a rolling one-minute window, and are never written to a database by us.

Your rights

Under UK GDPR you have the right to:

  1. Access the personal data we hold about you;
  2. Rectify inaccurate data;
  3. Request erasure (“right to be forgotten”);
  4. Restrict processing;
  5. Object to processing, including direct marketing at any time;
  6. Data portability where applicable;
  7. Withdraw your consent at any time — this does not affect processing carried out before you withdrew it.

To exercise any of these rights, contact us at orders@nuttyorange.com. You can unsubscribe from our emails at any time using the link at the bottom of every email.

If you are unhappy with how we have handled your personal data you have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Children

This site is not directed at children. Our forms are intended for adults, and we ask that anyone under 16 does not submit their details without a parent or guardian’s permission.

Third-party links

This site links to our shop at www.nuttyorange.com, to Amazon listings and review pages, and to an external pre-sale checkout provider for pre-order pages. Anything you enter on those sites is collected by their operators under their own privacy policies, not by us. We are not responsible for the privacy practices of third-party sites.

Changes to this policy

We may update this policy from time to time. The “last updated” date above reflects when it was most recently revised.

Contact

Barton Technology Ltd, Suite 652, 124 City Road, London, EC1V 2NX.
Email: orders@nuttyorange.com