Privacy policy

We process technical data needed to deliver the site and the information you give us through chat, email and phone. If you accept advertising cookies, Meta Pixel also records page visits for advertising measurement. Chat messages go to an AI provider, which writes the answers and may keep a copy for up to 30 days. On our server, a chat is deleted 7 days after its last message or when you choose “Start a new chat”. If you post a time on the labyrinth's daily board, we keep the name and the time for 30 days and show them to everyone who opens the board. If you open an account, we keep your email and your game progress until you delete it, or two years after you last sign in. To ask about your data or exercise your rights, write to [email protected].

Responsible for your personal data (the “controller”):

• MAGNUS ZGR, Bulgaria. The company is being registered; its registration details will be added here once that is complete.
• Email: [email protected]
• Phone: +359 885 107 053

Unless another law is named, article numbers refer to the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR).

Visiting the site

All traffic to the site, including what you type into the chat, passes through a network that delivers and protects websites. It processes your IP address and the details of each page load (page, browser, time, approximate country) to deliver pages and block attacks.

Our server keeps no log of visits to this site. If something fails to load or a connection drops, its error log can record your IP address, approximate country, browser, the page and the page you came from; we use those entries only to fix faults and for security. To stop abuse of the chat, the server also counts how often each IP address uses it, in memory only, never on disk.

Legal basis: our legitimate interest in keeping the site working and safe from attacks and abuse (Art. 6(1)(f)).

The AI chat

We process the messages you type, when they were sent, and the page and language where you opened the chat. Your first message sets a cookie that links your browser to the conversation.

We store conversations on our server so you can pick them up later, and so we can read them and join in if we choose. To write an answer, the server sends the AI provider the recent messages (the last ten at most), the page address and language, and excerpts from our public pages. The provider does not receive your IP address or the name and email from the chat's contact form, but anything written in the messages, including a name or email, reaches it. It may keep this data for up to 30 days to check for abuse (longer only if the law requires it) and does not use it to train its models.

Please leave out sensitive information such as health or financial details and passwords.

Legal basis: if you ask for yourself, answering your questions before a possible contract (Art. 6(1)(b)); if you ask for a business, our legitimate interest in answering questions about our services (Art. 6(1)(f)).

“Talk to a person”

The chat asks for your name and email so we can reply in person. They are stored with the conversation, deleted with it and not sent to the AI provider. If nobody is available, your next messages, with your name and email, can be forwarded to our inbox so we can reply by email. Those emails stay in the inbox after “Start a new chat” and are kept like any email enquiry.

Legal basis: as for the chat above (Art. 6(1)(b) or (f)).

Email and phone enquiries

We process what you send or tell us: usually your name, contact details, company and what the project is about.

Legal basis: if you write for yourself, answering your enquiry before a possible contract (Art. 6(1)(b)); if you write for a business, our legitimate interest in answering business enquiries (Art. 6(1)(f)).

Clients

We keep the contact details of the client and of the people on its team we work with, plus project correspondence, quotes, contracts and invoices.

Legal basis: the contract (Art. 6(1)(b)); our accounting and tax obligations (Art. 6(1)(c)); and for the staff of a client company, our legitimate interest in performing the contract with their employer (Art. 6(1)(f)).

The labyrinth's daily board

The labyrinth game keeps your progress in your browser (see the browser storage list below), and nothing about your play reaches us unless you post a time on the daily board. When you press “Post my time”, your browser sends us the name you typed, the time, the day, the path your run took through that day's maze, and a random number it made up the first time you posted.

The server follows the path through the day's maze to check that the run was possible, then discards it. It stores the day, the name, the time and a one-way hash of the random number, so that a better time from the same browser replaces the old one, and it deletes each entry 30 days after its day. The board shows the name and the time to everyone who opens it. To stop abuse, the server counts how often each IP address posts to the board or reads it, in memory only, never on disk.

Legal basis: your consent, given when you post a time (Art. 6(1)(a)); you can withdraw it at any time by writing to us, and we remove your entry. For counting requests by IP address, our legitimate interest in protecting the board from abuse (Art. 6(1)(f)).

Accounts

An account is optional. You sign in with your email: we send a link that works once, within 15 minutes, and a cookie then keeps you signed in on that device for 30 days. We store your email address and what the account holds: the levels you have cleared with their times, stars and experience, the discount orbs you carried out, your daily runs, what you bought in the wardrobe, and a random code for your discount.

Each run you finish while signed in reaches us as the path you took through the maze. The server checks it and keeps only the result, never the path. Sign-in links and sessions are stored only as one-way hashes. To stop abuse, the server counts how often each IP address and each email address asks for a link, in memory only, never on disk.

Legal basis: providing the account you asked for (Art. 6(1)(b)); for the counts, our legitimate interest in protecting the sign-in from abuse (Art. 6(1)(f)).

• Content delivery and security network: a US company.
• Hosting provider: server in Germany (EU).
• AI model provider: writes the chat answers.
• Email provider: a US company serving EU users through its Irish company; it holds our mailbox.
• Email delivery service: a US company; it sends the sign-in links from our address and keeps each message for up to 30 days.
• Other players: the name and time you post on the labyrinth's daily board.
• Public authorities: only where the law requires it.

The network, the AI provider, the email provider and the email delivery service process data in the United States, outside the European Economic Area (EEA). The network, the email provider and the delivery service are certified under the EU-US Data Privacy Framework, which the European Commission has found to protect data adequately (Implementing Decision (EU) 2023/1795). The network also uses the Commission's Standard Contractual Clauses, and the AI provider transfers data under them (Implementing Decision (EU) 2021/914). You can ask us for a copy of the clauses.

The site uses browser storage for your preferences and for features you choose to use:

• mzgr_lang (cookie): set when you click the EN/BG switch; keeps your language for 1 year, and the year restarts with every page you open.
• __Host-magnus-visitor (cookie): set by your first chat message; links your browser to the conversation for 7 days; removed by “Start a new chat”.
• mzgr.theme (local storage): set when you use the light/dark switch; stays until you clear the site's data.
• __Host-mzgr-account (cookie): set when you sign in to your account; keeps you signed in on that device for 30 days from your last visit; removed when you sign out or delete the account.
• __Host-mzgr-signin (cookie): connects an email sign-in request to the browser that started it, so approval on another device can sign in the original browser. It expires after 15 minutes and is removed after completion or cancellation.
• mzgr.signin.wait (sessionStorage): keeps the pending email address, six-digit device code and expiry time in the requesting tab so you can refresh while waiting. It contains no email link or account session token. It is removed after sign-in, cancellation or closing the tab.
• mzgr.account (local storage): set when you sign in; says only that this browser is signed in, so the menu shows “Your account” instead of “Sign in”; removed when you sign out.
• mzgr.labyrinth.v1 (local storage): set when you play the labyrinth; keeps your levels, experience, discount orbs, wardrobe, sound and controls, your daily times and a random code for your discount, and once you post a daily time, the name you used and the random number for the board; stays until you clear the site's data.
• mzgr.invite (local storage): set when the invitation to play the labyrinth appears, once you have spent 90 seconds on the site; holds only the date before which it will not appear again (14 days later, or 60 days if you follow it to the game).
• mzgr.invite.t (session storage): counts the seconds you spend on the site in this tab, so the invitation appears after 90 seconds in all; removed when it appears or when you close the tab.
• magnus-character-crossing (session storage): set when you click a link while the animated chat character is on screen, so the animation continues on the next page, where it is removed.

Advertising cookies and your choice

Meta Pixel loads only after you choose “Accept cookies”. Our integration sends a page-view event to Meta for advertising measurement and personalisation. The pixel can process the page address, browser and device information, IP address and advertising identifiers. It may set advertising cookies, including _fbp and _fbc.

Choosing “Necessary only” keeps the pixel off. You can reopen the settings using “Cookies” in the footer and change your choice. Withdrawing consent revokes the pixel permission and removes the _fbp and _fbc cookies that this site can access; it does not undo information already sent to Meta.

The choice is saved in local storage as mzgr.marketing-consent.v1 until you change it or clear the site data. Meta receives advertising data only when this feature is enabled. Its handling of that data is described in Meta’s Privacy Policy and Cookies Policy.

On an English page, a script in your browser checks its language settings, and on the home page its time zone, to decide whether to show you the Bulgarian version. Nothing is stored; the only trace is your browser loading the Bulgarian page. The EN/BG switch overrides the check: choosing English turns it off, and choosing Bulgarian redirects any English page you open from elsewhere to its Bulgarian version.

The chat writes its answers automatically, but no decision with legal or other serious effects on you is made automatically.

The site and our services are meant for businesses and adults, not children.

For enquiries, the chat, the labyrinth's daily board and accounts, no: without contact details we cannot reply, without a name your daily time stays in your browser, and without an account the game keeps your progress in your browser alone. If you become a client, the law requires your name, address and registration or personal number on every invoice (Art. 6 of the Accountancy Act), so without them we cannot sign a contract with you.

You can ask us for access to your data and a copy, and for correction, erasure or restricted use. You can also get the data you gave us for a contract, or before one, in a machine-readable format (portability). Write to [email protected]; we reply within one month. Some rights have legal limits: we cannot erase an invoice the law requires us to keep, for example.

You can delete a chat from our server at once with “Start a new chat” in the chat options menu, in the browser where you started it; otherwise it is deleted automatically 7 days after its last message, within our one-month reply period.

To have your entry taken off the daily board before its 30 days are up, write to [email protected] with the day, the name and the time.

You can delete your account at once with the button at the end of your account page; everything on it goes immediately.

You can complain to the Bulgarian data protection authority, the Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД):

• Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
• Email: [email protected]
• Phone: +359 2 91 53 519
• Website: www.cpdp.bg

If you live or work in another EEA country, you can complain to the authority there. You can also go to court.

When the way we handle personal data changes, we update this page and its date.

Last updated: 29 September 2026