GooseUp Privacy Policy — United States

GooseUp Android App and Connected Portfolio Games

Version: 1.0.0 | Effective date: 4 September 2026 | Last updated: 4 September 2026

This Privacy Policy is available at: https://everplay.gs/PrivacyGooseUp.html

This United States Privacy Policy explains how Everplay Games Ltd. ("Everplay,” "we,” "us,” or "our") collects, uses, discloses, retains, and protects personal information through the GooseUp Android application and the rewards features that connect GooseUp with certain Portfolio Games (together, the “Services"). It applies only to your use of the Services in the United States.

1. Scope

This Policy covers the GooseUp Android application and Everplay’s receipt and use of qualifying Portfolio Game events and related app, device, and network information when a Portfolio Game participates in the GooseUp rewards program.

GooseUp is a free Android rewards app funded by advertising and intended for adults. You do not need to buy anything or subscribe to use GooseUp or earn Coins.

Everplay Games Ltd. is the controller for the processing described in this Policy. Each Portfolio Game has its own privacy notice for its standalone features and data practices, whether or not GooseUp is installed. That notice governs the Portfolio Game’s standalone collection and use of information; this Policy governs only the GooseUp rewards-related processing described here.

2. Information We Collect

The information we collect depends on how you use GooseUp, whether you join the rewards program, whether you request a Cashout, and the settings and permissions available on your device.

Identifiers and device information. We collect an internal user ID assigned by Everplay; Google Advertising ID (GAID); Android ID (ANDROID_ID); other device and security identifiers; device model and manufacturer; operating system and app version; network type; and signals about device or app security, integrity, or possible compromise. The identifier we use depends on the feature and purpose described below.

Everplay uses the internal user ID to maintain your rewards profile, recognize you when you return, administer Coins and Cashouts, support internal analytics and operations, and perform separate fraud and security checks. We may link it to device identifiers and related activity to keep rewards consistent, analyze and secure the Services, prevent fraud, and process deletion requests. A regular GAID reset is an advertising choice; it does not, by itself, cancel valid Coins or delete your rewards profile.

App and gameplay activity. We collect how you use the App and connected games, including app interactions, sessions, timestamps, gameplay progress, completed qualifying activities, eligible advertising events, and other events identified in the Rewards Program Rules. For the rewards program, a connected Portfolio Game may send qualifying events and related app, device, and network information to Everplay even if GooseUp is not installed, is closed, or is running in the background. GooseUp must be installed on the same device only for us to credit Coins for a qualifying event; it does not need to be open or running in the foreground.

We may also keep records of incomplete, abandoned, failed, or reversed qualifying activity to administer rewards, answer support questions, and protect the Services. Verification attempts are described in Section 8.

Rewards and transaction information. We collect Coin balances, credits, debits, expirations, earning history, reward eligibility, Cashout requests, Cashout status, amounts, dates, and records of your interactions with the rewards program.

A Cashout uses 100% of the balance in your wallet at the moment you start it. You cannot choose a smaller amount or make a partial Cashout. We collect the balance used for the request and related records to calculate, review, and complete the Cashout.

Advertising and attribution information. We collect or receive ad impressions, completed ads, ad interactions, campaign and install information, attribution events, and related app, device, network, and measurement information.

AppLovin and Adjust may collect through their services GAID, when available; identifiers they create; IP and network information; device and app information; campaign, install, and attribution information; and app or ad interaction data. Everplay does not send its internal user ID to AppLovin or Adjust and configures those services not to receive it. Beyond the advertising and measurement information described above, Everplay does not intentionally provide other device or security identifiers to AppLovin or Adjust for advertising or attribution purposes.

Approximate location and network information. We collect your IP address, an approximate location or region inferred from it, network type, connection information, and related information. We use this information for service operation, analytics, advertising delivery and measurement, security, fraud prevention, and regional eligibility or other regional controls.

Communications. If you contact us through a support or privacy channel, we collect the name and contact details you provide, the contents of your message, attachments or supporting information, and our correspondence with you.

Cashout and payout information. When you request a Cashout, we collect the identifier for your payout or payment account and other information needed for the payout method shown in the App. The information depends on the method and provider selected for the transaction.

We may also collect records about transactions, matching payments, payout status, and communications with payment providers. We may collect state or other tax information when required by law.

Verification, identity, and tax information. Face Liveness or Full KYC starts only after you actively start a Cashout. Everplay may use Cashout and rewards records, payout activity, and security, fraud, and eligibility checks to determine whether a Cashout may proceed without verification or requires Face Liveness or Full KYC.

Face Liveness and Full KYC are different checks. Face Liveness checks whether a live person is present when the check occurs. Full KYC verifies your legal identity and may include a government-issued ID, a selfie or liveness information, a phone number, and other approved information, depending on the verification flow.

We collect verification outcomes, dates, reasons for requesting verification, identity information, and tax information needed to administer Cashout, prevent fraud, satisfy eligibility requirements, or comply with law.

Biometric and liveness information. Section 8 describes the biometric and liveness information that may be collected during an active Cashout, including the purposes, Bureau’s role, consent, retention, and consequences of declining or failing verification.

Risk and security assessments. Everplay and Bureau may create security and fraud assessments from device and network information, usage patterns, verification information, and transaction information. These assessments help protect rewards, make Cashout decisions, secure the Services, and prevent fraud.

Bureau may conduct separate device-security and fraud checks during use of the Services. In limited-purpose security, authentication, fraud-prevention, Face Liveness, and Full KYC flows, Bureau may receive the internal user ID and only relevant device, network, usage, security, verification, and fraud signals. Bureau does not receive the internal user ID for advertising or attribution and is not used for advertising.

3. Sources of Information

We collect information from the following sources, depending on how you use the Services:

• From you: information you provide in the App, during Cashout or verification, or in a support or privacy request.

• From your device and the App: identifiers, device and app information, app interactions, sessions, security signals, and the permissions or choices available on the device.

• From connected Portfolio Games: qualifying game events, ad events, campaign or install information, and related information used for the GooseUp rewards integration.

• From advertising and measurement providers: information collected through AppLovin and Adjust, including identifiers they create and information about ads, campaigns, and installs.

• From Bureau: device security, verification, authentication, liveness, and fraud signals or results from the relevant Bureau service.

• From internal systems and other providers: rewards, analytics, operations, payout, security, and service records created or maintained in connection with the Services.

4. How We Use Information

We use information for the following purposes, as applicable to the feature or activity involved:

• Operate, provide, maintain, troubleshoot, and secure GooseUp and its connected rewards features, including receiving qualifying Portfolio Game events and related information and deciding whether activity qualifies for Coins.

• Maintain your rewards profile, recognize you when you return, calculate and credit Coins, administer Cashouts, and apply the Terms.

• Perform internal analysis and reporting, improve data quality and the Services, and monitor operations.

• Deliver, measure, and attribute advertising and app campaigns and support related ad operations, subject to the choices and opt-outs described below.

• Detect, investigate, prevent, and respond to fraud, abuse, manipulation, unauthorized access, security incidents, and other threats to the Services.

• Authenticate users, conduct Cashout verification, perform Face Liveness or Full KYC when required, confirm eligibility, and support payout processing.

• Answer questions, provide support, handle privacy requests, investigate disputes, and keep appropriate records.

• Comply with legal obligations, respond to lawful requests, protect rights and property, and establish, exercise, or defend legal claims.

• Create aggregated or de-identified information and use it for service analytics, security, reporting, and other lawful business purposes when it cannot reasonably be used to identify you.

GDPR legal bases. Where the GDPR applies, we rely on the following legal bases, as applicable to the processing involved: (i) performance of a contract under Article 6(1)(b) for operating GooseUp, administering rewards and Cashouts, and providing related services; (ii) compliance with legal obligations under Article 6(1)(c) for tax, regulatory, identity-verification, and other legally required processing; (iii) legitimate interests under Article 6(1)(f) for service operations, security, fraud prevention, support, internal analytics, and establishing, exercising, or defending legal claims; and (iv) consent under Article 6(1)(a) where processing is based on consent, including certain non-essential advertising or measurement processing and biometric or liveness processing where applicable.

Legitimate interests. Where we rely on Article 6(1)(f) GDPR, our legitimate interests include keeping the Services secure and reliable, preventing fraud and abuse, supporting internal analytics and operations, handling support matters, and establishing, exercising, or defending legal claims. We balance those interests against your rights and freedoms and use this basis only where the processing is necessary and proportionate.

5. Disclosures and Recipients

We disclose information to the recipients described below when reasonably needed for the purposes in this notice, at your direction, or as permitted or required by law.

Advertising and measurement disclosures. Section 2 describes the information AppLovin and Adjust may collect through their services. We disclose certain identifiers, app activity, information about ad interactions, approximate location, and attribution information to advertising and measurement providers for ad delivery, measurement, attribution, and related operations. Depending on the arrangement and applicable law, these disclosures may be treated as a sale, sharing, or targeted advertising.

• AppLovin Corporation: helps select and deliver ads and measure advertising and provides related app technology. AppLovin may receive the advertising information described in Section 2 for its services and may disclose information to network partners through its services.

• Adjust: measures installs, sessions, and campaign events and provides mobile attribution and related measurement.

• Bureau Technologies, Inc.: provides device security, fraud prevention, authentication, Face Liveness, Full KYC, verification, and related security processing. Bureau’s limited-purpose role and identifier disclosures are described in Section 2. Bureau is not an advertising provider.

• Internal analytics and operational providers: Snowflake, Bruin, and Domo help us store and organize information, prepare it for analysis, check data quality, and create internal reports and dashboards. They support internal analytics and operations and are not advertising providers.

• BugSnag: crash reporting, diagnostics, app stability, and release-health monitoring when used by a connected Portfolio Game.

• Payout, hosting, security, and communications providers: we disclose the information needed for the Cashout method shown in the App to its payout provider and to providers supporting hosting, infrastructure, security, support, or communications.

• Authorities and other recipients: courts, law enforcement, regulators, tax authorities, professional advisers, insurers, or other persons when required or permitted by law, to protect rights and safety, or in connection with a corporate transaction.

A provider or other recipient may have its own privacy notice describing information it collects directly and how it uses that information independently of Everplay.

Some recipients or providers may be located outside the European Economic Area. Where the GDPR applies, any transfer of personal data outside the EEA will be made only where permitted under Chapter V GDPR and subject to an applicable safeguard or other lawful basis for the transfer. The safeguard may depend on the recipient and circumstances; further information may be requested from the privacy contact in Section 17.

6. Advertising Choices and Statutory Opt-Outs

GooseUp is funded by advertising. You may still see ads after opting out of targeted or personalized advertising, but they may be less relevant to your interests.

Some advertising and measurement disclosures may be treated as a sale, sharing, or targeted advertising under applicable state law. An Android device setting is separate from a statutory opt-out. Changing that setting does not, by itself, submit a statutory opt-out request to Everplay or require Everplay or a recipient to stop all other processing.

• Submit a statutory opt-out request using the statutory opt-out and privacy-choice method listed in Section 17.

• Use Android’s available advertising settings to reset GAID or turn off ad personalization. These settings change advertising on your device; they are not, by themselves, Everplay’s complete statutory opt-out.

A regular GAID reset is not prohibited and does not, by itself, cancel valid Coins or delete your rewards profile. It may affect how advertising or attribution recognizes your device. Resetting, spoofing, or manipulating an identifier to obtain additional rewards or evade controls, especially together with other evidence of manipulation, may violate the Terms and support fraud enforcement.

An advertising opt-out does not automatically delete information needed for rewards administration, Cashout, security, fraud prevention, verification, support, or legal compliance. Use the privacy rights and deletion procedures below for those requests.

7. Retention

We keep information only as long as reasonably needed for the purposes described in this Policy. We consider your active rewards relationship, service operations, security and fraud risks, Cashout and payout needs, legal obligations, disputes, recordkeeping, and legal claims.

How long we keep information depends mainly on what it is and why we need it:

• Rewards profile, identifiers, app activity, and game events: while needed to operate the Services, administer Coins and Cashouts, resolve disputes, prevent fraud, and satisfy legal obligations.

• Cashout, payout, payment, and tax records: while needed to complete and match transactions and to satisfy payment, tax, recordkeeping, dispute, or other legal obligations.

• Verification, identity, and biometric or liveness materials: while needed for the applicable verification, security, fraud-prevention, dispute, and legal purposes. Bureau’s retention and destruction are governed by its applicable terms and law.

• Support, privacy-request, fraud, security, and appeal records: while needed to respond, document the request or review, protect the Services, prevent repeated abuse, and satisfy legal or dispute-related needs.

If information is subject to a legal hold, dispute, fraud or security investigation, payment or tax obligation, or other preservation requirement, Everplay may retain it until that requirement ends. Backups may retain information for a limited period while they are overwritten or securely removed through ordinary processes.

When information is no longer needed, Everplay deletes it or anonymizes it so that it is no longer reasonably associated with an identifiable person, subject to the exceptions described in this notice.

8. Biometric and Liveness Notice

This section applies only when you actively start a Cashout that requires Face Liveness or Full KYC. Neither check starts outside an active Cashout.

Categories collected. Depending on the required check and verification settings, the process may collect a real-time facial image or liveness video, facial features or mapping information, selfie information, information from a government-issued identity document, phone information, and verification results.

Purposes. Face Liveness checks whether a live person is present at the time of the check. Full KYC verifies legal identity. Everplay uses the applicable result to authenticate a Cashout, prevent fraud and identity misuse, protect the Services, and confirm eligibility where required.

Bureau processing. Bureau processes the facial, liveness, identity, device-security, and fraud information needed for the Cashout verification and security flow in connection with Everplay’s Services. Bureau’s limited-purpose processing and identifier disclosures are described in Section 2. Bureau is not used for advertising.

Consent where required. Before collecting biometric or liveness information, Everplay will provide the notice required by applicable law and obtain affirmative consent where applicable law requires it. Where facial features or mapping information are processed as biometric data under the GDPR, Everplay relies on explicit consent under Article 9(2)(a) GDPR together with the applicable Article 6 legal basis. You may withdraw consent at any time by contacting hello@everplay.gs. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal and may mean that a Cashout requiring verification cannot be processed.

Everplay does not sell biometric or liveness information and does not use it for advertising or targeted advertising. We do not use it to build advertising profiles.

Retention and destruction. Everplay keeps verification information only as long as needed for the purposes in this notice and applicable law. Bureau’s retention and destruction follow its applicable terms and law; Everplay does not promise that Bureau deletes biometric or liveness information immediately.

If you decline. You may choose not to provide biometric or liveness information. If the Cashout you requested requires that verification, the Cashout may remain pending or may not be processed until the required verification is completed.

A failed or abandoned verification is not, by itself, a fraud finding. It may leave the Cashout pending or unavailable, prevent payout, or require further review as described in the Terms and the App.

Residents of states with biometric privacy laws may have additional rights regarding notice, consent, access, deletion, destruction, retention information, or other biometric processing. Requests may be submitted using the privacy contact and procedures in Section 14; applicable state law controls the scope of those rights.

9. Security and Automated Fraud Assessment

Automated fraud and security assessment. Everplay uses automated tools, including Bureau’s device security and fraud tools, to review information about device and app security, network activity, session and gameplay patterns, identifiers, verification results, payout activity, and other security signals. These tools may inform security and Cashout decisions. A regular GAID reset is not, by itself, a fraud finding.

Based on security, eligibility, fraud, and other applicable checks, a Cashout may proceed, require verification, remain pending while an issue is addressed, or be denied. These checks may also support restrictions, suspension, or termination under the Terms.

If you believe a rewards, Cashout, or fraud-enforcement action was wrong, you may request human review through support@everplay.gs. This address is only for rewards, Cashout, and fraud-enforcement reviews, including review of an automated assessment; it is not a privacy-rights channel. Everplay will review the request in good faith and notify you of the outcome within 30 days after receiving it. Where the GDPR applies, if a decision is based solely on automated processing and produces legal or similarly significant effects, you may request human intervention, express your point of view, and contest the decision through this process, subject to applicable law. Everplay may keep confidential security methods and other abuse-prevention information private, and a review request does not guarantee a particular outcome.

Everplay uses administrative, technical, and physical safeguards reasonably designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Access to information is limited to personnel, systems, and providers that need it for the purposes described in this notice or as otherwise permitted by law.

10. Deletion and Rewards-Profile Consequences

Uninstalling GooseUp or a Portfolio Game is not a deletion request. Uninstalling an app may stop that app from collecting new information. If you uninstall GooseUp, Everplay cannot credit Coins for qualifying events while it is uninstalled, but a separately installed connected Portfolio Game may still send qualifying events or related information to Everplay. Uninstalling an app does not automatically delete information already held by Everplay or its providers. To request deletion, use the process in Section 14.

After we verify a deletion request, we disconnect the device identifiers associated with your previous rewards profile from that profile, and delete or anonymize those identifiers, subject to the exceptions below.

We ask relevant providers to delete or anonymize information where appropriate, subject to their roles and lawful retention requirements. If you return after a verified deletion, Everplay creates a new rewards profile and internal user ID and does not reconnect you to the deleted profile.

Deletion does not require Everplay to delete information that must be retained for fraud prevention, security, payment or payout processing, tax obligations, disputes, legal claims, legal holds, or other legal obligations. Retained information remains subject to applicable protections and is deleted or anonymized when the retention need ends.

A verified deletion request closes your GooseUp rewards profile and cancels any unredeemed Coins. A pending Cashout is cancelled or otherwise handled as provided in the Terms and applicable law; review the Terms before requesting deletion.

To request deletion, use the privacy contact listed in Section 17 with the subject line “Deletion Request.” The request process and verification requirements in Section 14 also apply.

11. U.S. Privacy Rights Available Nationally

Everplay makes the rights in this section available to U.S. residents nationwide, subject to applicable law, statutory exceptions, and verification requirements. This does not mean that a particular state law applies to every user or every processing activity.

Depending on where you live and what the law provides, you may request:

• Access or know: confirmation whether Everplay processes information about you and access to, or information about, the categories and specific pieces of information we maintain, where applicable.

• Correction: correction of inaccurate information Everplay maintains about you.

• Deletion: deletion of information Everplay maintains about you, subject to the exceptions described in this notice.

• Portability: a copy of information in a portable format where applicable and required by law.

• Opt-out: opting out of disclosures that constitute a sale or sharing, targeted or cross-context behavioral advertising, and other advertising uses where those rights apply.

• Sensitive information choices: limitation of the use or disclosure of sensitive information, or consent and withdrawal treatment, where applicable law provides that right or requires that treatment.

• Profiling choices: opting out of certain profiling in furtherance of decisions producing legal or similarly significant effects, where applicable law provides that right.

• Non-discrimination: not receiving discriminatory treatment for exercising a privacy right, subject to lawful differences connected with the value of a service or other applicable exception.

These rights are subject to exceptions, including information needed to complete a transaction, provide a requested service, protect security, detect or prevent fraud, comply with law, resolve disputes, or protect Everplay’s or another person’s rights.

GDPR rights. Everplay is established in Malta, and the GDPR applies to the processing described in this Policy. You may request access to your personal data, rectification or erasure of it, or restriction of its processing, and may receive a portable copy of certain personal data processed by automated means where applicable. You may object to processing based on legitimate interests and may withdraw consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing before withdrawal. You may object at any time to processing for direct marketing, including related profiling, and we will stop that processing. You may have rights regarding solely automated decisions that produce legal or similarly significant effects, including human intervention, the opportunity to express your point of view, and the ability to contest the decision. These rights are subject to applicable limitations and exceptions. For an automated rewards, Cashout, or fraud-enforcement assessment, use the human-review process in Section 9; for other privacy-rights requests, use the privacy contact in Section 17.

12. California Disclosures

This section applies to California residents to the extent the CCPA, as amended by the CPRA, applies to Everplay’s processing. It supplements the other sections of this notice; it does not assert that the CCPA applies to every user or activity.

Categories collected. In the preceding 12 months and currently, Everplay may collect the following California categories, depending on your use of the Services:

• Identifiers: internal user ID, GAID, ANDROID_ID, other device and security identifiers, IP address, contact details (including a phone number when provided for contact or verification), and payout identifiers. We use these, as applicable, for rewards-profile administration, service operation, internal analytics, security and fraud prevention, advertising and measurement, Cashout, and support.

• Internet or other electronic network activity: app and game interactions, sessions, gameplay, qualifying Portfolio Game events and related information, ad impressions and interactions, campaign and install information, and Cashout activity. A connected Portfolio Game may send qualifying events and related information even when GooseUp is not installed or open; GooseUp must be installed only for Coin crediting. We use this information for service operation, rewards administration, advertising and measurement, attribution, security, and fraud prevention.

• Geolocation: approximate location inferred from your IP address and network information, used as applicable for service operation, regional eligibility, advertising and measurement, security, and fraud prevention.

• Commercial, financial, and transaction information: Coin balances, rewards activity, Cashout requests, payout information, transaction status, and related records, used to administer rewards, process Cashout, match transactions, provide support, and comply with law.

• Sensitive personal information: biometric or liveness information, information from a government-issued identity document, and tax information when collected in an active Cashout verification flow or as otherwise needed for Cashout, security, eligibility, or legal compliance. We do not use these categories for advertising.

• Inferences: rewards, eligibility, security, fraud-risk, and service-use inferences derived from the information above, used for rewards integrity, Cashout decisions, security, and fraud prevention.

The sources, purposes, and recipient categories for this information are described in Sections 3-5, subject to the limits below. A Portfolio Game’s separate privacy notice governs its standalone collection and use; this Policy covers Everplay’s rewards-related use of qualifying events and related information when the game participates in the GooseUp rewards program.

For California residents, Everplay’s advertising and measurement disclosures to AppLovin and Adjust, as described in Sections 2 and 5, may include GAID where available, provider-generated identifiers, IP address and approximate location, app and game activity, ad interactions, campaign, install, and attribution information. Everplay does not send its internal user ID to AppLovin or Adjust and configures those services not to receive it. Beyond the advertising and measurement information described in Sections 2 and 5, Everplay does not intentionally provide other device or security identifiers to those providers for advertising or attribution purposes. AppLovin may disclose information through its services to network partners, and Adjust provides mobile measurement and attribution. Depending on the facts and applicable law, these disclosures may be “sharing” for cross-context behavioral advertising and may be a “sale” under California law if the statutory definition is met. California residents may use the statutory opt-out and privacy-choice method identified in Section 17; Android advertising settings alone are not a complete statutory opt-out.

Everplay does not use sensitive personal information, including biometric or liveness information, for advertising or targeted advertising. We use it only for the Cashout, verification, security, fraud-prevention, eligibility, support, and legal purposes described in this Policy. Where California law provides a right to limit use or disclosure of sensitive personal information, submit that request through Section 14.

Rewards program; not a financial incentive for personal information. Everplay provides Coins and Cashout as compensation for qualifying activity under the Terms. The rewards program is not offered in exchange for your consent to collect, use, sell, or share personal information, and participation is not conditioned on consenting to a sale or sharing. We do not assign a value to personal information for this program. Participation is voluntary and subject to the Terms; the amount of Coins or Cashout depends on qualifying activity and applicable program rules.

California residents may exercise applicable rights through the request, verification, authorized-agent, and appeal procedures in Section 14.

California residents may also request information about disclosures of personal information to third parties for those parties’ direct-marketing purposes, to the extent that right applies. Submit the request through Section 14 with the subject line “California Direct Marketing Request”.

13. Rights Available Under Other U.S. State Laws

Residents of other states may have additional or different rights depending on the applicable law, including access, correction, deletion, portability, opt-out of sale or targeted advertising, limitation or consent treatment for sensitive data, and opt-out of certain profiling.

Where applicable law requires consent before processing sensitive data, Everplay will obtain the required consent or provide the treatment required by that law. State law may also provide additional biometric, appeal, complaint, or deletion protections.

The request, verification, authorized-agent, appeal, response, and non-discrimination procedures in Section 14 apply to requests under other state laws, except to the extent a state’s law requires a different procedure or deadline.

14. Requests, Verification, Appeals, and Authorized Agents

To submit a privacy request, use the privacy contact listed in Section 17 with the subject line “Privacy Rights Request.” Identify the right you wish to exercise, the state in which you reside, and whether the request concerns GooseUp, a Portfolio Game, or both.

Please provide enough information for Everplay to understand and verify your request. Do not send a Social Security number, identity document, or other highly sensitive information by ordinary email unless Everplay provides a secure method and requests it.

We may verify your identity or authority before completing a request. The level of verification depends on the request, the sensitivity of the information, and the risk of unauthorized disclosure, deletion, or change. If we cannot verify a request, we may deny it or ask for additional information permitted by law.

You may use an authorized agent where applicable law permits. The agent must provide proof of authority, and Everplay may verify the agent’s identity and contact you directly to confirm the request.

If Everplay denies or limits a request, you may appeal under the procedures in this Section by using the privacy contact listed in Section 17 with the subject line “Privacy Rights Appeal” and including the original request and the reason for the appeal. Everplay will review the appeal and respond within the period required by applicable law.

Everplay will respond to requests and appeals within the time required by applicable law and may extend a response where the law permits. Everplay will not discriminate against you for exercising a privacy right.

The rewards, Cashout, and fraud-enforcement review process described in Section 9 is separate from privacy requests. Use support@everplay.gs only for those reviews, including human review of an automated assessment; use the privacy contact and process in this Section for privacy rights.

15. Age Requirement

GooseUp and its rewards program are intended only for people age 18 and older. People under 18 may not use GooseUp or participate in its rewards program. Everplay does not knowingly collect personal information through GooseUp from anyone under 18. If you believe this has occurred, use the privacy contact and request procedures in Section 14.

A separately distributed Portfolio Game may have different age requirements and its own privacy notice for standalone use. That notice and those requirements govern the Portfolio Game’s standalone experience; this Policy applies only to the GooseUp rewards-related processing described here.

16. Changes to This Policy

Everplay may update this notice to reflect changes to the Services, information practices, legal requirements, or user choices. The revised notice will show its effective or last-updated date. Where required by law, we will provide additional notice or obtain any required consent.

17. Contact

For privacy questions, privacy-rights requests, deletion requests, complaints, or questions about this notice, contact:

Everplay Games Ltd.

Registered address: Ewropa Business Centre Level 3-701, Triq Dun Karm, Birkirkara, BKR 9034, Malta

Registration number: C 116697

Privacy contact: hello@everplay.gs

Policy URL: https://everplay.gs/PrivacyGooseUp.html

Statutory opt-out and privacy-choice method: in-app control at Settings > Privacy > Do Not Sell or Share My Personal Information, or email hello@everplay.gs with the subject line “Privacy Request.”

Universal opt-out signals, including Global Privacy Control (GPC): GooseUp is an Android application and does not receive browser-based opt-out preference signals such as GPC. To submit a statutory opt-out, use the in-app control or email address identified above.

For rewards, Cashout, or fraud-enforcement review, contact support@everplay.gs. This address is only for those reviews; it is not the general privacy contact.

If the GDPR applies to you, you may lodge a complaint with the Information and Data Protection Commissioner (IDPC) in Malta at https://idpc.org.mt, without limiting any right to complain to another supervisory authority available under applicable law.