GooseUp Biometric and Liveness Notice
Effective date: 5 November 2026
How we use facial information to verify Cashouts
Some Cashouts require Face Liveness to confirm that a live person is present or Full KYC to verify your identity. This notice explains what information we use, who handles it, how long it is kept, and your choices. We ask for your consent before capturing or processing your facial information. You may decline by selecting “Not now.” We require verification only where permitted by law. Section 7 explains how your choice affects your Cashout.
Everplay Games Ltd. operates GooseUp. In this notice, “we,” “us,” and “Everplay” mean Everplay Games Ltd. We use Bureau, Inc. (“Bureau”) to provide identity-verification and fraud-prevention services for Cashouts.
Bureau captures a selfie or liveness video of your face through GooseUp. It may measure your facial features or create digital representations of them, such as templates, embeddings, or vectors. For Full KYC, Bureau compares the photograph on your ID with your selfie. Everplay receives and stores selfie images and verification results, including liveness scores and, for Full KYC, face-match scores. Everplay does not receive or store Bureau’s facial measurements or biometric templates. In this notice, “Biometric Information” means information described here that is protected as a biometric identifier or biometric information under applicable law. Depending on the law and how the information is generated or used, this may include facial measurements, digital representations, and identifying results or scores. Photographs and video are not, by themselves, covered by every biometric law. The use, disclosure, and security protections in this notice apply to all facial information described here. Each state-specific destruction rule applies to the information protected by that state’s law.
Full KYC (“know your customer”) uses images of your government-issued ID and the information on it, including your date of birth. Bureau checks the ID and returns the images and extracted identity information to Everplay. Verification may also use device and network information, security signals, current and previous verification results, payout information, and Cashout records. These records may contain both Biometric Information and other personal information. The GooseUp Privacy Policy explains how long we retain the other personal information. Biometric Information within those records remains subject to this notice’s protections and destruction rules.
Everplay and Bureau use this information to confirm that a live person is present and, when Full KYC is required, verify your legal identity. We also use it to authenticate and process your Cashout, prevent identity misuse and rewards fraud, protect GooseUp, investigate disputes concerning verification or your Cashout, and comply with applicable law. For Washington users, these uses are limited to the purposes in Section 8.
Bureau processes facial information only for your requested Cashout verification and the related fraud, security, or dispute review described in this notice. Our cloud hosting providers and Bureau’s hosting and database providers may process it only to support those services and where permitted by law. We do not sell, lease, trade, or otherwise profit from facial information or authorize Bureau to do so. We do not use it or authorize Bureau to use it for advertising, targeted advertising, unrelated profiling, model training, or one-to-many face matching.
With your authorization and where permitted by law, Bureau receives the facial captures submitted through GooseUp and provides Everplay with selfie images and verification results. For Full KYC, Bureau also provides Everplay with ID images, extracted identity information, and face-match results. Bureau does not provide Everplay with its facial measurements or biometric templates. Everplay and Bureau may disclose information to their hosting and database service providers only as described above. Every disclosure must comply with each applicable law’s restrictions.
When Illinois law applies, we disclose your biometric identifiers and biometric information without your consent only to complete a financial transaction you request or authorize; as required by state or federal law or municipal ordinance; or under a valid warrant or subpoena issued by a court with authority to do so.
Where Texas’s biometric disclosure restrictions apply, we disclose your biometric identifiers only to complete a financial transaction you request or authorize; as required or permitted by a federal or state statute other than the Texas Public Information Act; or to or from a law enforcement agency for a law enforcement purpose in response to a warrant.
If you are a Colorado resident, we disclose your biometric identifiers only with your consent, to complete a financial transaction you request or authorize, to a processor as necessary for the purpose to which you consented, or as required by state or federal law.
If more than one law applies, we comply with each law’s disclosure restrictions.
The periods below describe how long Everplay and Bureau currently keep information used for verification. The period depends on who holds the information and what it contains. Applicable state law may require earlier destruction of information it protects as biometric identifiers or biometric information. Those destruction requirements apply to completed, failed, and abandoned checks, including protected information in service-provider copies and backups.
|
Information |
How long it is kept |
|
Selfie and ID images held by Everplay |
Everplay retains the selfie and ID images it receives for no more than seven days. The state-specific rules below may require earlier destruction where the images contain information protected by the applicable biometric law. |
|
Selfie and liveness captures and ID images held by Bureau |
Bureau keeps these captures and images for no more than 30 days from collection. The state-specific rules below require earlier destruction of protected biometric information where they apply. |
|
Facial measurements, templates, embeddings, and protected identifying results or scores |
The applicable state-specific destruction rules below govern this information, including protected information within retained verification records. Keeping a verification result for reuse does not override an applicable destruction deadline. |
|
Other identity and Cashout records |
We retain other identity and Cashout records as described in the GooseUp Privacy Policy, subject to applicable recordkeeping, fraud-prevention, dispute, and legal requirements. Verification results and scores protected as biometric identifiers or biometric information under applicable law remain subject to the corresponding destruction requirements and this notice’s use, disclosure, and security protections. |
We permanently destroy biometric identifiers and biometric information when the original purpose for collecting or obtaining them has been met, or within three years after your last interaction with us, whichever comes first. We may keep the information when a valid warrant or subpoena issued by a court with authority to do so requires it.
Where Texas’s biometric destruction requirements apply, we destroy biometric identifiers within a reasonable time after the purpose for collecting them ends, and no later than one year after it ends. If another law requires us to keep a document or instrument connected to the biometric identifier for longer, we destroy the identifier within a reasonable time and no later than one year after that legal requirement ends.
We delete biometric identifiers at the earliest of these times: when the original purpose for collecting them has been met; 24 months after your last interaction with us; or as soon as reasonably feasible, and within 45 days, after our review finds that keeping them is no longer necessary, adequate, or relevant to the stated purpose. We conduct that review at least annually. We may extend the 45-day period by up to 45 more days when reasonably necessary because of the complexity and number of identifiers to be deleted. This extension does not extend an earlier deletion deadline.
If more than one biometric retention rule applies, we follow the earliest required destruction deadline. We retain information beyond that deadline only if every applicable law permits it.
We use reasonable safeguards appropriate to the sensitivity of facial information. We store, transmit, and protect it with reasonable care consistent with industry standards and at least as carefully as other confidential and sensitive information. We require Bureau to meet the same standards. Only authorized personnel and systems that need the information for the purposes described in this notice may access it.
You may decline verification, stop a check, or withdraw consent. An incomplete, failed, or unavailable check may leave your Cashout pending or prevent payment, but only where we may lawfully require verification. For Colorado residents, we will not refuse a Cashout solely because you decline the use of a biometric identifier unless that use is necessary to provide the Cashout. Declining, stopping, or failing a check does not by itself establish fraud or cause you to lose valid Coins. Separate reversal, enforcement, and account-deletion rules under the GooseUp Terms of Service and Rewards Program Rules may still apply, as may restrictions imposed by law. For questions about an incomplete check or Cashout, email privacy@everplay.gs.
You may withdraw consent in GooseUp under Profile > Data Controls > Withdraw Biometric Consent, or by emailing privacy@everplay.gs. We will stop processing that relies on your consent as required by applicable law. Withdrawing consent and completing deletion are separate steps. We will arrange deletion of the affected facial information, including Biometric Information, held by Everplay and Bureau under Section 5 and applicable law, and confirm when deletion is complete. Withdrawal does not undo completed processing or, by itself, close your account or cancel valid Coins. Where applicable law gives you these rights, you may request access to, correction of, or deletion of your information, or appeal our decision on a privacy request. Send your request to the same email address. Do not send an ID by ordinary email. The GooseUp Privacy Policy explains your rights and how to exercise them.
For Washington users, we use the information described in Section 2 to authenticate requested Cashouts, detect and prevent rewards fraud, identity theft, and unauthorized activity, and investigate related fraud or security incidents. Bureau processes the information on our behalf for those purposes, subject to this notice’s use, disclosure, security, and destruction restrictions. Contact privacy@everplay.gs with questions or to exercise applicable privacy rights as described in Section 7 and the GooseUp Privacy Policy.
This notice supplements the GooseUp Privacy Policy and any applicable notice at collection. It describes the facial information used for Cashout verification, its purposes, recipients, and retention. Under California law, biometric information used to uniquely identify you is sensitive personal information. The GooseUp Privacy Policy and any applicable notice at collection explain how other personal information collected during verification is used and retained, and describe your California privacy rights.
Everplay Games Ltd.
Ewropa Business Centre, Level 3-701
Triq Dun Karm, Birkirkara, BKR 9034, Malta
Privacy contact: privacy@everplay.gs