Privacy Policy.
What we collect, why we use it, where it lives and your rights under UK law.
Last updated: 11 October 2026
Who we are
Lada Boutique ("we", "us") runs the website ladaboutique.com, a free social casino for adults aged 18+ in the United Kingdom. We are the data controller for the personal data described here. This policy follows the UK GDPR and the Data Protection Act 2018.
The data controller is , .
What we collect
- When you create an account: username, email address, UK phone number and a password. The password is turned into a one-way hash before it is saved, so it is never stored as you typed it. We also record the date you joined, your last sign-in, a count of failed sign-in attempts (five wrong tries lock the account for 15 minutes), your coin balance, XP, level, bonus times and the games you launch.
- If you sign up with Google: your name, verified email address and Google account ID, which our server checks directly with Google. We then ask you for a username and phone number.
- When you contact us (contact form or Player Care): your name, email address, chosen topic and message.
- Automatically: the IP address and time of each form submission (kept in our protected submission log), and standard web-server access logs.
- In your browser only: your 18+ confirmation and cookie choice, held in local storage and never sent to us.
We never ask for or store card or bank details. There is nothing to buy.
Why we use it
- To create and run your account, coin balance and level (performance of our contract with you).
- To check you are 18+ and in the UK and to keep the site safe from abuse (legal obligation and legitimate interests).
- To reply when you contact us and to act on break, restriction or deletion requests (legitimate interests and legal obligation).
- To keep a record that messages were sent and received (legitimate interests).
We do not use your data for advertising, profiling or automated decision-making, and we do not send marketing emails or texts.
Where it is kept
Your account is a protected file on our server. We do not use a database. The accounts folder is blocked from the web and every account file begins with a line that makes the web server answer "not found", so it cannot be opened in a browser. Only our server-side code reads it.
Signing in sets one strictly necessary session cookie (lb_sid), described in the Cookie Policy. Messages you send are emailed from our server to our support inbox over an encrypted SMTP connection, and a copy is written to a protected log folder that is also blocked from the web. All processing takes place on servers located in the United Kingdom or the European Economic Area, or in countries with adequate protection under UK law.
Who we share it with
- Google, only if you choose Google sign-in. Google's own privacy policy applies to its sign-in window.
- Our email delivery provider, which carries contact and Player Care messages from our server to our inbox.
- Google Fonts, which serves the typefaces used on the page and may see your IP address.
- Authorities, where the law requires it.
We never sell personal data.
How long we keep it
- Account data: until you delete your account from the account page or ask us to delete it. Deletion removes the account file immediately.
- Messages and the submission log: up to 12 months, so we can handle follow-ups and prove requests were received, then deleted.
- Server access logs: up to 90 days.
Your rights
Under UK data protection law you can ask to see the data we hold about you, have it corrected or deleted, restrict or object to how we use it, and receive a copy in a portable format. You can delete your account yourself at any time from the account page. For anything else, send a request through the contact form with the topic "Privacy question" or email . We answer within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Passwords are hashed with a strong one-way algorithm. The session cookie is HttpOnly and SameSite. Account and log folders are blocked from the web. Forms are processed only by our own server-side code. We review these measures regularly. No system is perfectly secure, so please choose a strong, unique password.
Children
The site is for adults aged 18 or over only and is not directed at children. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.
Changes
We will update this page if anything changes. The date at the top shows the latest version.
Contact
Privacy questions: contact form or .