This Privacy Policy describes how Brus Lai AS ("we", "our", "us") collects, uses, and protects information across our products, applications, and this website. It applies to all services operated by Brus Lai AS unless a specific product publishes its own supplemental policy.
1. Who we are
Brus Lai AS is a Norwegian limited company (organisasjonsnummer 922 712 476), with registered office at Eidsvikvegen 26, 5302 Strusshamn, Norway. We act as the data controller for personal data processed across our products under EU/EEA data protection law (GDPR) and the Norwegian Personal Data Act.
Data protection inquiries: contact@bruslai.no
2. Scope
This policy applies to:
- The Brus Lai AS website at the domain on which this policy is published
- All mobile applications, games, and digital products developed and operated by Brus Lai AS, including (without limitation) Vexsort
- Any communications you initiate with us by email or through forms on our properties
3. The data we collect
We are committed to collecting the minimum data necessary to operate each product. The categories below describe the maximum scope of what we may collect across all our services. Specific products may collect only a subset — see the per-product sections further down.
3.1 Information you provide
- Contact information when you email us or use a contact form (e.g. your email address and the contents of your message)
- Any feedback, bug reports, or correspondence you send us
3.2 Information collected automatically
- Anonymous gameplay or usage statistics necessary to operate features such as leaderboards, ranks, and aggregate analytics
- Standard web server logs when you visit our website (IP address, browser type, referring page, timestamp). These logs are retained for a limited period for security and abuse prevention
3.3 Information stored on your device
- Score history, streaks, preferences, and other game state for our mobile applications. This data is stored locally on your device and is not transmitted to us
4. What we do not collect
Across all our products and websites, we do not collect your name, phone number, postal address, date of birth, precise location, contacts, photos, or any other personally identifiable information beyond what is described in Section 3.
5. How we use data
- To operate and improve our products and services
- To calculate global leaderboards, percentile rankings, and aggregate statistics
- To respond to bug reports and feedback you send us via email
- To respond to inquiries you send us
- To comply with legal obligations under Norwegian and EU/EEA law
We do not use your data for automated decision-making or profiling that produces legal effects.
6. Legal basis for processing (GDPR)
- Legitimate interests: operating our services, preventing abuse, calculating anonymous aggregate statistics
- Consent: where required for optional features such as push notifications
- Legal obligation: complying with applicable laws and regulatory requirements
7. Sharing and third parties
We do not sell your data. We do not share personal data with third parties for marketing purposes.
We use the following third-party processors to operate our infrastructure. Each processes data only on our behalf, under contract, and only to the extent necessary to deliver their service:
- Supabase (Supabase, Inc.) — database and backend infrastructure used to store and serve anonymous gameplay statistics for Vexsort. See Supabase's privacy policy at supabase.com/privacy.
- Expo (Expo, Inc.) — over-the-air application updates for our mobile applications. Expo may process IP addresses and basic technical metadata for security and abuse prevention. See Expo's privacy policy at expo.dev/privacy.
- GitHub Pages (GitHub, Inc.) — static hosting for this website. Standard web server logs may be processed by GitHub for security and abuse prevention.
- Google Fonts (Google LLC) — typography served on this website. When you visit our site, your browser requests font files from Google's servers, which may log your IP address. See Google's privacy policy at policies.google.com/privacy.
We may disclose data if required by law, court order, or a binding government request, or to protect the safety, rights, or property of Brus Lai AS, our users, or the public.
8. International transfers
Some of our service providers operate outside the EU/EEA. Where this is the case, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses to ensure your data continues to receive equivalent protection.
9. Data retention
We retain anonymous gameplay scores and aggregate statistics for up to 12 months, after which they are deleted or further anonymised. Server logs are kept for up to 30 days. Email correspondence is retained for as long as reasonably necessary to address your inquiry.
Data stored locally on your device can be cleared by uninstalling the app or through your device's app storage settings.
10. Your rights
Under GDPR and the Norwegian Personal Data Act, you have the right to:
- Request access to data we hold about you
- Request correction of inaccurate data
- Request deletion of data associated with you or your device
- Object to or restrict certain processing
- Receive your data in a portable format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet)
To exercise these rights, contact contact@bruslai.no. We will respond within one month.
11. Children
Our products are suitable for general audiences and are not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Cookies and similar technologies
This website uses only essential cookies required for basic functionality. We do not use cookies for advertising, analytics, or cross-site tracking. Our mobile applications do not use cookies.
13. Security
We use industry-standard technical and organisational measures to protect data, including encryption in transit (HTTPS) and access controls on backend systems. No method of transmission or storage is completely secure; we will notify affected users and relevant authorities in the event of a personal data breach as required by law.
14. Per-product disclosures
The following sections describe data collection specific to individual Brus Lai AS products.
14.1 Vexsort (mobile game)
Data submitted to our servers: When you complete a puzzle, the puzzle number, your number of moves, and an anonymous random device identifier (a 32-character string generated when you first open the app) are submitted to Supabase. This identifier lets us deduplicate scores per device but is not linked to your name, email, or any account.
Data stored only on your device: In-progress puzzle state, score history, streak, your sound, haptic, and notification preferences, and the anonymous device identifier described above.
Third parties: Anonymous gameplay scores are stored on infrastructure operated by Supabase, Inc. JavaScript updates to the app are delivered by Expo, Inc. (see Section 7). No names, email addresses, or other directly identifying information are shared.
Advertising: No advertising or third-party analytics are present in the current version of Vexsort. If this changes in a future release, we will update this policy and notify users via an in-app message before the change takes effect.
15. Changes to this policy
We may update this policy from time to time. Material changes will be flagged with a revised "last updated" date and, where appropriate, an in-app notice or email to anyone who has previously contacted us. Continued use of our products after a change indicates acceptance of the revised policy.
16. Contact
Brus Lai AS
Eidsvikvegen 26, 5302 Strusshamn
Norway
Org. nr. 922 712 476
contact@bruslai.no