Privacy, clearly explained.

1. Who is responsible?

Avandoo is the app and game brand operated by Alligator IT & Transport GmbH, Bloch-Bauer-Promenade 20/18, 1100 Wien, Austria. The company is the website operator and the controller for the processing described as our own processing in this notice. Company contact details are shown below and in the Legal Notice. Electronic contact uses our support page with a human-verification check; requests sent to the company postal address do not require a CAPTCHA.

2. Website scope

This website presents our apps, their release status, support and legal information. Browsing does not require an account. We have no newsletter, website checkout, advertising network, Google Analytics, embedded YouTube player or social-media tracking widget. Linking to an external service is not the same as embedding its tracking code.

3. Hosting and security

Cloudflare Pages and its network deliver the website. Requests disclose technical data such as IP address, requested URL, time, browser headers and connection information to the infrastructure provider. The purpose is delivery, reliability and protection against abuse; our basis is Article 6(1)(f) GDPR, our legitimate interest in operating a secure website. We do not build visitor advertising profiles or store a separate visitor database. Cloudflare may maintain operational and security logs under its service policies.

To understand how visitors find Avandoo, we count successful page loads on the server. If the browser sends a referring site with the normal page request, we use it to classify the source. Shared links can also include a common source label such as facebook. Our EU-hosted Cloudflare statistics database stores only the date, source category and total count. The measurement uses no cookies, visitor identifiers or browser analytics scripts and stores no IP addresses or full referring URLs in the statistics database.

• Cloudflare Privacy Policy

4. Human verification

Selecting Email support loads Cloudflare Turnstile. It processes IP address, user-agent and technical browser/connection signals, including TLS characteristics, to detect bots. Our server checks the short-lived verification token before releasing an email link; it does not send a support message. This protects the requested contact function against automated abuse, based on Article 6(1)(f) GDPR. Cloudflare acts as processor for providing this protection and, according to its notice, as a separate controller for improving bot detection. This check is not an advertising consent request.

• Cloudflare Turnstile Privacy Addendum

5. Email support and legal enquiries

After verification, your own email application opens. Only if you send the email do we receive your address, name if supplied, message and any attachments you choose to include. We use them to answer questions, diagnose reported issues and manage related claims. Assistance relating to your use or purchase is handled under Article 6(1)(b) GDPR; general enquiries and abuse prevention under Article 6(1)(f), and statutory obligations under Article 6(1)(c).

Support email is routed through Cloudflare Email Routing to a Gmail mailbox managed for the company. Cloudflare and Google therefore handle the email in providing those services. Gmail is currently used; this notice does not claim that a Google Workspace account or business-only storage is in place. Do not send passwords, authentication codes, card details or unnecessary sensitive information. For requests without a browser check, you can write to the company postal address.

• Cloudflare Privacy Policy
• Google Privacy Policy

6. Recipients

Access is limited to the company personnel handling the relevant task and the hosting, security and email providers described above. Data may also be disclosed to professional advisers or authorities when necessary for a legal obligation or a specific claim. Namecheap is our domain registrar; registering a domain does not itself mean that each website visitor is sent to Namecheap. We do not sell the website visitor database or share support messages with advertising partners.

• Namecheap Privacy Policy

7. International processing

Cloudflare, Google and Apple operate internationally; depending on the service, data may be processed outside the EEA, including in the United States. Their published safeguards include adequacy decisions such as the EU–US Data Privacy Framework for covered transfers and standard contractual clauses where applicable. This is not a promise that every service processes data only in Europe. Use the linked provider notices for their relevant entities and safeguards, or contact us for information about safeguards relating to our processing.

• Cloudflare data processing and transfer safeguards
• Google data transfer safeguards
• Apple Privacy Policy

8. Retention

We keep correspondence while the enquiry is open and afterwards only where necessary for a related follow-up, an unresolved dispute or an applicable statutory obligation. Once those purposes cease, it should be deleted. Statutory business records are retained for their applicable legal period. We do not keep correspondence indefinitely simply for marketing.

Our support endpoint keeps salted, hashed IP-based request counters only in server memory. Entries expire after 10 minutes and are removed on a subsequent request or when the server instance ends. Turnstile tokens are single-use and valid for up to five minutes. These limits do not define Cloudflare’s own operational-log or signal retention, which is governed by its provider notices and applicable service settings.

• Cloudflare Privacy Policy

9. Cookies, required data and decisions

No advertising or analytics cookies are installed by our website code. Language selection is represented in the URL. The Cookie & Storage page explains security mechanisms and distinguishes the mobile app. Technical request data is needed to deliver the site; email details are needed only if you ask us to reply. We do not make solely automated decisions with legal or similarly significant effects about website visitors. Turnstile may automatically reject a support check; the company postal address remains available.

• Cookie & Storage information

10. Your rights and complaints

Depending on the applicable conditions, you may request access, rectification, erasure, restriction and portability of your personal data. You may object to processing based on legitimate interests for reasons relating to your situation. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

Contact us through the support link or the company postal address below. A postal request does not require a browser check. We normally respond within one month; the GDPR permits an extension in qualifying cases. We only request proportionate information needed to identify the relevant records. You may complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Wien, Austria, or another competent supervisory authority. You do not have to contact us first.

• Austrian Data Protection Authority — complaints

11. Changes and other apps

Each released app will have information describing its own actual practices. This website policy is not blanket consent for every Avandoo app. We update this notice when relevant services or processing change and obtain consent before introducing optional storage where legally required.