Privacy policy
Last updated: October 12, 2026
1. Data controller
The processing of personal data carried out through the thelastcommit.com website is performed by The Last Commit, a French simplified joint-stock company (société par actions simplifiée) with a share capital of €4,000, registered with the Versailles Trade and Companies Register (RCS) under number 130 940 141, with its registered office at 11 rue du Fer à Cheval, 78120 Rambouillet, France. For any question relating to your data: contact@thelastcommit.com.
2. Data collected
The website offers neither user accounts nor private areas. We only collect the data you send us through our forms — contact and project enquiry: name, email address, company and role where applicable, as well as the content of your message. For security purposes and to prevent automated submissions, the IP address and timestamp of the submission are recorded. Anonymised browsing data is measured only if you have consented to it. If you save a score in the site's hidden game (Merge Rush), we keep the nickname you choose, the score, the duration and outcome of the game, the site language and version, as well as information derived from your connection: the country, the type of device, the operating system and browser, and an encrypted, irreversible fingerprint of your IP address used to detect abuse. Your IP address itself is not stored with the score, and no account or e-mail address is required.
3. Purposes and legal bases
Your data is used to respond to your requests and prepare a possible business relationship (pre-contractual measures and legitimate interest), to manage and perform our services as well as invoicing (performance of the contract and legal and accounting obligations), to ensure the security of the website and prevent abuse (legitimate interest), and to measure website audience in order to improve it (your consent). The game nickname and score are only used to display the public leaderboard, at your request (you alone decide to save it).
4. Recipients and processors
Your data is processed by our team and by the technical providers strictly necessary to operate the website: Vercel Inc. (website hosting), Scaleway (servers located in France hosting our application infrastructure and database), Brevo (transactional email delivery), Google Ireland Ltd / Google LLC for Firebase Analytics (audience measurement, only with your consent) and Slack Technologies (internal notification of incoming requests). Your data is never sold, rented or transferred to third parties for advertising purposes.
5. Transfers outside the European Union
Our database is hosted in France. Some providers (Vercel, Google, Slack) are established in the United States or operate part of their infrastructure there. These transfers are governed by the European Commission's standard contractual clauses and, where applicable, by these providers' certification under the EU — United States Data Privacy Framework.
6. Retention periods
Requests that did not lead to a follow-up are kept for three years from the last contact. Client data is kept for the duration of the contractual relationship, then three years for prospecting purposes; accounting and contractual records are archived for ten years in accordance with legal obligations. Audience measurement data is kept for a maximum of thirteen months, and your cookie choice for six months. Game nicknames and scores are deleted automatically twelve months after they are saved, and the IP fingerprint stored with them after six months. IP addresses recorded when a form is sent are erased after one day.
7. Your rights
In accordance with the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set instructions regarding its fate after your death. You can exercise these rights at contact@thelastcommit.com; we respond within one month. If you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority, the CNIL (cnil.fr). To have a nickname removed from the leaderboard sooner, write to us at the same address with the nickname concerned.
8. Cookies and audience measurement
Only cookies strictly necessary for the website to work — remembering your language, theme and cookie choice — are set without consent. Audience measurement relies on Firebase Analytics (Google) and is enabled only with your explicit consent, in order to understand how the website is used and improve it. No advertising cookies, no cross-site tracking. You can accept, refuse or change your choice at any time from the footer ("Manage my cookie choices"). Without consent, no measurement cookie is set. With your consent to audience measurement, a “tlc_home” cookie remembers for 90 days which version of the home page you are shown (we are comparing two); it holds only the letter of that version and is removed if you withdraw your consent. Your best score and last game nickname are also kept in your browser's local storage, on your device only. Proof of your choice (version of the text shown, choice, language, date and an encrypted fingerprint of your IP address) is kept for thirteen months.
9. Security
The website is served exclusively over HTTPS. Access to our database is encrypted, restricted to authorised individuals and logged. We apply appropriate technical and organisational measures to protect your data against loss, alteration and unauthorised access.
10. Our social media accounts
The Last Commit publishes for its brands (The Last Commit, Vitef, Memojin, Aukilo, Happiner, JuryDay and Floweet) on social networks (Facebook, Instagram, Threads, X, Bluesky, Mastodon, TikTok, YouTube, LinkedIn, Pinterest, Discord and Telegram) from an internal tool. To check our posts, this tool keeps the platforms’ technical responses and the notifications they send us; these may contain the username, identifier and public text of a person who interacts with our accounts. Tokens, email addresses and phone numbers are removed from this data, which is then deleted automatically: 7 days after processing for notifications, and within 30 days at most for technical responses (24 hours for LinkedIn; nothing is kept for Pinterest). It is never used for prospecting or to train an artificial intelligence, and is never shared with any third party. Each platform remains responsible for the data you publish there, under its own privacy policy.