Privacy Policy — Everplay Limited
GooseUp App and Portfolio Games
Version 2 | Last Updated: [DATE]
This Privacy Policy is available at: [PRIVACY POLICY URL]
This Privacy Policy explains how Everplay Limited ("Everplay", "we", "us", "our") collects, uses, stores, shares, and protects personal data in connection with the GooseUp application and all portfolio games made available by Everplay from time to time (together, "our Apps"). Please read it carefully before downloading or using any of our Apps.
This policy is structured in four parts:
· Part A — General provisions applicable to all users, written in accordance with the General Data Protection Regulation (GDPR). If you are located outside the European Economic Area, the GDPR framework still describes our practices; where additional rights exist for your jurisdiction, see Parts B and C.
· Part B — Additional provisions for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA).
· Part C — Additional provisions for residents of Virginia, Colorado, Connecticut, Texas, and other US states with comprehensive privacy legislation.
· Part D — Facial Mapping Notice and Consent Policy, applicable when identity verification is required at cashout.
PART A — GENERAL PROVISIONS (ALL USERS)
This Privacy Policy covers the personal data processing activities of Everplay Limited in connection with:
· The GooseUp App — a rewards and cashout application available on the Android platform.
· The Portfolio Games — the portfolio of mobile games made available by Everplay from time to time, including games available within or alongside the GooseUp App ("Portfolio Games"). The specific titles in this portfolio change dynamically; this policy refers to them collectively.
Everplay Limited is the sole data controller for all personal data processing described in this policy. There is no joint controllership arrangement with any third party in respect of the data described herein.
This policy uses terminology as defined in Article 4 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), including "personal data", "processing", "controller", "processor", and "data subject". References to "GDPR" in this policy are to the EU GDPR unless the context otherwise requires.
Important notice for California residents: Please also read Part B of this policy, which describes your rights and our obligations under the CCPA/CPRA.
Important notice for residents of Virginia, Colorado, Connecticut, Texas, and other covered US states: Please also read Part C of this policy for jurisdiction-specific rights.
Important notice regarding facial mapping and biometric data: If you initiate a cashout above the applicable verification threshold, please also read Part D of this policy before proceeding.
The data controller for all personal data processing described in this Privacy Policy is:
Everplay Limited
[ADDRESS]
Malta
Registration Number: [REGISTRATION NUMBER]
Email: [EMAIL]
Everplay has not appointed a formal Data Protection Officer at this stage. All data protection matters — including rights requests, queries, and complaints — should be directed to:
Email: [EMAIL]
We endeavour to respond to all data protection enquiries within 30 days of receipt.
2. Data Collection When Using Our Apps
The sections below describe, for each distinct use scenario, what personal data we collect, for what purposes, and on what legal basis under the GDPR.
Our Apps operate on the Android platform. They do not require users to create an account or log in using a social network or email-based identity system. Where user identification is required — for example, to track rewards across sessions or across Portfolio Games — we use the Google Advertising ID (GAID) or the Google App Set ID as device-level pseudonymous identifiers.
2.1 Access to and Storage of Information on Your Device
When you install and use any of our Apps, certain software development kits (SDKs) embedded within those Apps may access device-level information or store data on your device. This is a standard feature of how mobile applications function and is common to virtually all Android applications.
Some of this access is strictly necessary for the functioning of the App — for example, reading device identifiers to maintain session continuity or storing app state locally. This strictly necessary access is carried out on the basis of our legitimate interests in providing a functional, stable, and secure application, pursuant to Article 6(1)(f) GDPR, and where applicable on the basis of performance of a contract with you pursuant to Article 6(1)(b) GDPR.
Other types of device access — including access for the purposes of behavioural advertising, ad personalisation, and cross-app tracking — are carried out only with your consent pursuant to Article 6(1)(a) GDPR. Where applicable, we will request your consent through an in-app consent interface before enabling such processing.
2.2 Information Collected During Download
When you download any of our Apps from the Google Play Store, download-related data is collected and processed by Google LLC as operator of the Google Play Store. This processing is governed by Google's own privacy policies and terms of service, over which Everplay has no control.
Everplay receives only anonymous and aggregated download statistics from Google Play (for example, total install counts by country). This data does not identify individual users and does not constitute personal data for Everplay's purposes.
2.3 Data Collected When Using Portfolio Games Without GooseUp
This section applies when a user downloads and plays a Portfolio Game directly from the Google Play Store, without having GooseUp installed on the same device.
In this scenario, Everplay and its service providers collect the following data:
· Device and technical data: internal device identifier, operating system version, device model and manufacturer, mobile network type, and app version.
· Access and session data: IP address, approximate country of access derived from IP, time and date of access, session start and end times, and session duration.
· Ad engagement data: advertisements served within the app, ad impressions, ad completions, ad interaction events — collected and processed via the AppLovin SDK.
· Basic fraud risk indicators: device integrity signals (including whether the device is rooted or emulated) and IP-based risk signals processed by Bureau for the purpose of detecting and preventing fraud in the ad delivery process.
Purposes: to deliver the app's core functionality; to serve advertisements and generate ad revenue; to carry out basic fraud prevention and ensure the integrity of the ad delivery process; and to compile aggregate usage analytics.
Legal basis:
· App functionality and ad delivery: Article 6(1)(b) GDPR — performance of the contract between you and Everplay constituted by your acceptance of our Terms of Service.
· Fraud prevention and security: Article 6(1)(f) GDPR — legitimate interests of Everplay and our advertising partners in preventing fraud and maintaining the integrity of the advertising ecosystem.
Service providers involved:
· AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA (ad mediation and delivery).
· Amazon Web Services, Inc., USA (cloud infrastructure and hosting).
· Bureau Technologies, Inc., USA (basic device-level fraud risk scoring).
2.4 Additional Data Collected When Using GooseUp
This section applies in addition to Section 2.3 when a user has GooseUp installed and plays Portfolio Games through or alongside the GooseUp App.
In this scenario, GooseUp and the Portfolio Games together collect and process the following additional personal data:
· Advertising Identifier: The Google Advertising ID (GAID) or Google App Set ID is used as a persistent pseudonymous identifier to link your activity across GooseUp and the Portfolio Games. This identifier enables Everplay to maintain a unified rewards profile for you across apps.
· Game progress data: levels completed, milestones reached, in-game achievements, Success Points earned, and coins credited to your GooseUp balance as a result of in-game activity.
· GooseUp activity data: daily challenges completed, consecutive daily activity streaks, total reward balance, and reward transaction history.
· Cross-app rewards profile: the above data, linked to your Advertising ID, forms a unified profile that GooseUp uses to calculate, display, and administer your earned coin balance and to determine your eligibility for rewards and cashout.
The Advertising ID functions as a pseudonymous identifier: it does not directly identify you by name, but it can be linked to your device and, in conjunction with other data, may allow identification of an individual. We treat it as personal data accordingly.
Purposes: to track and credit coin earnings from Portfolio Game activity to your GooseUp account; to administer the rewards programme; to enable cashout eligibility assessment; and to provide you with a coherent cross-app user experience.
Legal basis: Article 6(1)(b) GDPR — performance of the contract with you constituted by your acceptance of the GooseUp Terms of Service, under which we are obligated to track and administer your earned rewards.
Service providers involved:
· AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA (progress tracking, coin crediting, and ad mediation via the AppLovin SDK).
· Amazon Web Services, Inc., USA (cloud infrastructure and hosting).
When you request a cashout of your coin balance via GooseUp, we collect and process the following data:
· Payment account identifier: your PayPal email address or PayPal/Hyperwallet account identifier, as provided by you, which is transmitted to PayPal, Inc. or Hyperwallet Systems Inc. for the purpose of executing the payment. Everplay does not collect or store payment card numbers or bank account details.
· Cashout transaction records: records of each cashout request, including the amount, date, status, and associated Advertising ID, retained for user reference and to satisfy legal and regulatory obligations.
Legal basis: Article 6(1)(b) GDPR — performance of the contract with you under the GooseUp Terms of Service, pursuant to which Everplay is obligated to process valid cashout requests.
Additional verification at certain thresholds: For cashout requests above certain thresholds (described in Section 6 of the GooseUp Terms of Service), additional verification steps are required before a cashout can be processed:
· SMS OTP verification: Your mobile phone number is collected and used solely to send a one-time passcode (OTP) via SMS for identity verification purposes. This is processed by Twilio Ireland Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, Ireland. Your phone number is not used for marketing purposes.
· Identity document and liveness verification: A government-issued identity document (such as a national identity card, passport, or driver's licence) and a real-time liveness scan (facial verification) are collected for the purpose of identity verification. This data is processed by Bureau Technologies, Inc., USA, acting as Everplay's data processor. The collection and processing of facial and biometric data is described further in Section 2.6 and in Part D of this policy.
Legal basis for verification: Article 6(1)(b) GDPR — performance of the contract; Article 6(1)(c) GDPR — compliance with legal obligations, including anti-fraud obligations applicable to payment processing.
IRS Form 1099-K compliance: Where your cumulative cashouts in a calendar year equal or exceed USD $600, US tax law requires Everplay to file an IRS Form 1099-K. For this purpose, we collect your:
· US Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN).
This information is stored securely, subject to strict access controls, and is used solely for the purpose of IRS compliance. It is shared with tax authorities and tax reporting service providers only to the extent required by applicable US tax law.
Legal basis: Article 6(1)(c) GDPR — compliance with legal obligations under applicable US tax reporting law.
2.6 Facial Mapping and Liveness Detection
At certain cashout thresholds communicated within the App, GooseUp requires you to undergo a liveness and identity verification process before your cashout request can be processed. This process involves the collection and processing of facial mapping data, which constitutes biometric data and special category personal data under Article 9 GDPR.
What is collected: When you initiate the verification process, GooseUp requests access to your device camera. You will be asked to perform a short liveness gesture (such as turning your head or blinking). The following data is collected:
· A real-time facial scan or short liveness video.
· Facial mapping points derived from the scan that are mathematically unique to your face.
Purposes for which this data is processed:
· To verify that you are a live human being and not a photograph, video recording, or digital artefact (liveness detection).
· To verify your identity against the government-issued document submitted as part of the KYC process.
· To detect and prevent fraudulent activity, including attempts by one individual to create or use multiple reward profiles.
· To confirm that you meet the minimum age requirement (18 years of age) to receive cashouts.
Who processes this data: Bureau Technologies, Inc., USA, acts as Everplay's data processor for all facial mapping and liveness detection processing, under a Data Processing Agreement meeting the requirements of Article 28 GDPR. Everplay instructs Bureau on the purpose and scope of processing; Bureau carries out the technical processing on Everplay's behalf.
Retention: Everplay does not retain facial mapping data after verification is complete. Bureau deletes all facial mapping data following the completion of the verification process (whether successful or unsuccessful), in accordance with Bureau's data retention policy and applicable law. Everplay retains only a record of the verification outcome (pass or fail) and the date of verification.
Legal basis: Article 6(1)(a) GDPR (explicit consent) in conjunction with Article 9(2)(a) GDPR (explicit consent for special category data). Explicit consent is requested within the App at the point of initiating the verification process and must be freely given before camera access is activated.
Effect of not consenting or withdrawing consent: Consent to biometric processing is voluntary. However, if you do not provide consent, or if you later withdraw your consent, Everplay will be unable to complete the cashout verification process and your cashout request will not be processed.
Withdrawal of consent: You may withdraw consent at any time by contacting [EMAIL]. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.
Notice for Illinois, Texas, and Washington residents: If you are a resident of Illinois, Texas, or Washington, the collection and use of your facial data is also governed by applicable state biometric privacy laws, including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington's biometric privacy provisions. Please see Part D, Section 5 of this policy for further information.
GooseUp may request your permission to send push notifications to your device. Push notifications are opt-in: we will only send them if you have granted permission through your Android device settings.
Where you have opted in, push notifications may contain:
· Updates on your reward balance and recent coin earnings.
· Streak reminders and daily challenge prompts.
· Promotional offers and information about new Portfolio Games or GooseUp features.
· App update notifications.
Legal basis: Article 6(1)(a) GDPR — consent, given through your opt-in action.
Withdrawal: You can withdraw consent to receive push notifications at any time by adjusting the notification settings for GooseUp in your Android device settings. Withdrawal will not affect the lawfulness of notifications sent prior to withdrawal.
2.8 Support and Contact Inquiries
When you contact Everplay for support or with a general inquiry (for example, by emailing [EMAIL]), we collect and process:
· Your name (if provided).
· Your email address.
· The content of your message and any supporting documentation you provide.
· Correspondence in the course of handling your inquiry.
This data is retained for the duration of handling your inquiry and for 12 months following its resolution, to allow us to address any follow-up questions and maintain a record of our responses.
Legal basis: Article 6(1)(f) GDPR — legitimate interests in handling and documenting customer inquiries and protecting Everplay in the event of a dispute. Where the inquiry relates to the pre-contractual or contractual relationship between you and Everplay, the legal basis is Article 6(1)(b) GDPR.
2.9 Automated Decision-Making and Fraud Detection
GooseUp and the Portfolio Games use automated fraud detection and scoring systems to identify patterns indicative of prohibited conduct, including but not limited to: artificially inflating coin earnings, abuse of the rewards system, use of bots or automation tools, account farming, and other forms of fraud or manipulation.
How automated fraud scoring works: The fraud detection system, operated by Bureau Technologies, Inc. on Everplay's behalf, processes the following signals to generate a fraud risk score:
· Device integrity signals (e.g., whether the device is rooted or emulated).
· Advertising ID and App Set ID patterns (e.g., unusual patterns of ID reset or cross-device activity).
· Behavioural and engagement data (e.g., session patterns, game interaction patterns).
· Session characteristics (e.g., unusually short or uniform sessions).
· IP address analysis (e.g., VPN or proxy use, data centre IP ranges).
· Network type and device metadata.
Consequences of automated assessment: Based on the fraud risk score generated, you may be:
· Partially or fully excluded from earning coins for a period.
· Prevented from accessing cashout functionality.
· Permanently excluded from the rewards programme in cases of confirmed severe fraud.
These outcomes are described in detail in Section 8 of the GooseUp Terms of Service. They may be triggered automatically, without prior human review, where the automated system identifies a risk above a defined threshold.
Legal basis: Article 6(1)(b) GDPR — performance of the contract with you (including enforcement of the GooseUp Terms of Service, Section 8, which prohibits fraudulent conduct); and Article 22(2)(a) GDPR — the automated decision is necessary for the entering into or performance of a contract between you and Everplay.
Your right to contest: If you believe you have been incorrectly affected by an automated fraud decision, you have the right to request human review of the decision by contacting us at [EMAIL] with the subject line "Automated Decision Review". We will investigate and respond to such requests within 30 days.
Service provider: Bureau Technologies, Inc., USA (device intelligence, behavioural analysis, and automated fraud scoring).
3. Data Transfer and Recipients
We do not sell your personal data to third parties, nor do we share it for purposes other than those described in this policy.
We share personal data with the following categories of recipients:
Data processors (acting on Everplay's instructions under Article 28 GDPR Data Processing Agreements):
· AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA — ad mediation, ad delivery, coin progress tracking, and ad attribution SDK. Data Processing Agreement in place. Standard Contractual Clauses (Art. 46(2)(c) GDPR, 2021 EU SCCs, Controller-to-Processor module) govern the transfer of personal data to this US-based entity.
· Amazon Web Services, Inc. (AWS), USA — cloud infrastructure, hosting, and data storage for all Everplay backend systems and user data. Data Processing Agreement in place. Standard Contractual Clauses govern the transfer.
· Bureau Technologies, Inc., USA — device intelligence, identity verification (KYC), liveness detection, biometric processing, and automated fraud scoring. Data Processing Agreement in place, incorporating specific provisions for special category (biometric) data. Standard Contractual Clauses govern the transfer.
· Twilio Ireland Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, Ireland — SMS OTP delivery for cashout verification. Data Processing Agreement in place. As an EEA-based entity, no additional transfer mechanism is required for EU/EEA data subjects; for non-EEA data subjects, Standard Contractual Clauses apply as applicable.
· PayPal, Inc., 2211 N 1st St, San Jose, CA 95131, USA — payment processing for cashout transactions. Data Processing Agreement or equivalent data sharing arrangement in place. Standard Contractual Clauses govern transfers.
· Hyperwallet Systems Inc., USA — alternative payout processing for cashout transactions. Data Processing Agreement or equivalent arrangement in place. Standard Contractual Clauses govern transfers.
Authorities and regulators:
Where required by applicable law or by a binding order of a competent authority, we may disclose personal data to law enforcement, tax authorities (including the US Internal Revenue Service in connection with Form 1099-K reporting), regulatory bodies, or courts. We will, where legally permissible, notify you of any such disclosure.
International data transfers:
Our primary service providers (AppLovin, AWS, Bureau, PayPal, Hyperwallet) are located in the United States. The United States does not benefit from an EU adequacy decision in all respects. Transfers of personal data to these US-based processors are protected by the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR (the 2021 EU SCCs, Controller-to-Processor module). Copies of our Standard Contractual Clauses are available upon request to [EMAIL].
We retain personal data for no longer than is necessary for the purposes for which it was collected. The following retention periods apply:
· App activity, session, and rewards data (Portfolio Games without GooseUp): retained for the duration of your active use of the App, and for 2 years following your last recorded session, after which it is deleted or anonymised.
· GooseUp rewards profile, cross-app activity data, and coin balance history: retained for the duration of your active use of GooseUp, and for 2 years following your last recorded session.
· Payout and cashout records (transaction history): retained for 7 years from the date of the transaction, in compliance with applicable tax and financial record-keeping obligations.
· Facial mapping and liveness data: Everplay does not retain this data after verification is complete. Bureau deletes facial data following the completion of each verification event. Everplay retains only the verification outcome and date.
· KYC identity documents (ID scans and associated data): retained for the duration of your active user relationship and for 5 years following termination of that relationship, in compliance with applicable anti-money laundering and identity verification legal obligations.
· SSN / ITIN (collected for IRS Form 1099-K compliance): retained for the minimum period required under applicable IRS regulations and US tax law, currently 3 years from the filing deadline of the relevant tax year, unless a longer period is required by law.
· Phone number (collected for SMS OTP verification): retained only for the duration of the verification session; not retained after verification is completed.
· Support inquiries and correspondence: retained for 12 months following resolution of the inquiry.
· Fraud-related data and fraud risk scores: retained for the period necessary to prevent repeated fraudulent conduct and to establish, exercise, or defend legal claims — typically 5 years following identification of the fraud incident, subject to any applicable limitation periods.
· Push notification consent records: retained for the duration of your consent and for a period of 3 years following withdrawal of consent, for legal compliance purposes.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identified or identifiable individual.
Please note: Uninstalling the GooseUp App or a Portfolio Game from your device does not automatically delete your personal data held on Everplay's systems. To request deletion of your data, please submit an erasure request to [EMAIL] in accordance with Section 6 below.
5. Cookies and Similar Technologies (SDKs and Advertising Identifiers)
Our Apps do not use browser cookies, as they are native Android applications rather than websites or web-based applications.
However, our Apps and the SDKs embedded within them use functionally similar technologies to identify devices, track activity, and serve personalised content, including:
· Google Advertising ID (GAID): A resettable identifier assigned by Android to each device, used for ad targeting, attribution, and (within GooseUp) as a cross-app user identifier for rewards tracking. You can reset your GAID or opt out of ad personalisation in your Android device settings (Settings > Privacy > Ads). Important: Resetting your GAID while using GooseUp may result in the permanent loss of your coin balance, as Everplay cannot link your new GAID to your previous rewards profile. Please refer to Section 4.3 of the GooseUp Terms of Service before resetting your GAID, as coin balances linked to a reset GAID are permanently forfeited.
· Google App Set ID: A resettable identifier scoped to the set of apps from a single developer, used as a supplementary identifier for session tracking and fraud prevention. It is not used for advertising.
· AppLovin MAX SDK: Embedded in our Apps for ad mediation, ad delivery, and attribution. The AppLovin SDK may read the GAID, device identifiers, and interaction data to serve targeted advertisements and track ad performance.
· Bureau SDK: Embedded in GooseUp for device intelligence, fraud scoring, and (at applicable cashout thresholds) KYC and biometric verification. Accesses device integrity signals, IP address, network data, and (at verification points) the device camera.
Legal basis for SDK processing:
· SDKs used for strictly necessary app functionality, fraud prevention, and contract performance: Article 6(1)(b) and Article 6(1)(f) GDPR.
· SDKs used for ad personalisation, behavioural tracking, and cross-app targeting: Article 6(1)(a) GDPR — consent. Where required, consent is requested via an in-app consent mechanism before this processing commences.
Managing SDK and identifier settings: You can reset your GAID or opt out of personalised advertising at any time through your Android device settings. Note that opting out of personalised advertising does not stop ads from being displayed; you will continue to see ads, but they will not be tailored to your inferred interests.
If you are located in the European Economic Area, or if you are otherwise entitled to rely on the GDPR, you have the following rights in relation to your personal data. These rights are not absolute and are subject to applicable exemptions and limitations under the GDPR and applicable national law.
All requests to exercise your rights should be sent to: [EMAIL]
We will respond to all requests within 30 days of receipt. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day period.
We do not charge a fee for exercising your rights, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to act on the request.
6.1 Right of Access (Article 15 GDPR)
You have the right to obtain confirmation from us as to whether we are processing personal data about you and, if so, to receive a copy of that personal data together with information about:
· The purposes of the processing.
· The categories of personal data being processed.
· The recipients or categories of recipients to whom the personal data has been or will be disclosed.
· The envisaged storage period or the criteria used to determine it.
· The existence of your right to request rectification, erasure, restriction, or objection.
· The right to lodge a complaint with a supervisory authority.
· Any available information on the source of the data if not collected directly from you.
· The existence of automated decision-making, including profiling.
6.2 Right to Rectification (Article 16 GDPR)
You have the right to obtain the rectification of inaccurate personal data concerning you without undue delay. Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.
6.3 Right to Erasure ("Right to be Forgotten") (Article 17 GDPR)
You have the right to request that we erase personal data concerning you without undue delay in the following circumstances:
· The personal data is no longer necessary in relation to the purposes for which it was collected or processed.
· You withdraw consent on which the processing is based and there is no other legal basis for the processing.
· You object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object pursuant to Article 21(2) GDPR.
· The personal data has been unlawfully processed.
· The personal data must be erased to comply with a legal obligation.
This right does not apply where processing is necessary for compliance with a legal obligation, or for the establishment, exercise, or defence of legal claims. In particular, payout records and KYC documents subject to statutory retention obligations cannot be erased prior to expiry of the applicable retention period.
Please note: Uninstalling our Apps does not constitute an erasure request. To request erasure, please email [EMAIL] with the subject line "Erasure Request".
6.4 Right to Restriction of Processing (Article 18 GDPR)
You have the right to request that we restrict the processing of your personal data in the following circumstances:
· You contest the accuracy of the personal data, for the period necessary to allow us to verify its accuracy.
· The processing is unlawful and you oppose erasure and request restriction instead.
· We no longer need the personal data but you require it for the establishment, exercise, or defence of legal claims.
· You have objected to processing pursuant to Article 21(1) GDPR pending verification of whether our legitimate grounds override your interests.
Where processing has been restricted, we may continue to store the data but will not process it further except with your consent, for the establishment, exercise, or defence of legal claims, for the protection of the rights of another person, or for reasons of important public interest.
6.5 Right to Data Portability (Article 20 GDPR)
Where processing is based on your consent (Article 6(1)(a) GDPR) or on performance of a contract (Article 6(1)(b) GDPR), and the processing is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
6.6 Right to Withdraw Consent (Article 7(3) GDPR)
Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Withdrawal of consent to certain processing activities (for example, facial mapping for identity verification or push notifications) may affect your ability to access specific features of the App.
6.7 Right to Object (Article 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data that is based on our legitimate interests (Article 6(1)(f) GDPR), including profiling based on those provisions. Upon receipt of your objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.
You also have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling carried out for direct marketing. Where you object to processing for direct marketing, we will cease that processing immediately.
6.8 Rights in Relation to Automated Decision-Making (Article 22 GDPR)
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where such automated decision-making is necessary for the entering into or performance of a contract between you and Everplay (Article 22(2)(a) GDPR). In such cases, you have the right to obtain human intervention, to express your point of view, and to contest the decision. Please see Section 2.9 for details of how to contest automated fraud decisions.
6.9 Right to Lodge a Complaint (Article 77 GDPR)
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.
As Everplay is established in Malta, the lead supervisory authority is:
Information and Data
Protection Commissioner (IDPC)
Level 2, Airways House, High Street, Sliema SLM 1549, Malta
Website: https://idpc.org.mt
Email: idpc.info@gov.mt
You also have the right to seek an effective judicial remedy against a controller or processor, or against a supervisory authority.
7. Necessity of Providing Personal Data
The provision of personal data is not legally required in all cases, but may be necessary to access specific features of our Apps:
· Basic app functionality and ad delivery: Certain technical data (device identifiers, session data) is collected automatically as a necessary function of how mobile apps operate. This data cannot be withheld without discontinuing use of the App.
· GooseUp rewards and cross-app tracking: The use of your Advertising ID (GAID) as a cross-app identifier is necessary for the functioning of the rewards programme. Resetting your GAID will result in loss of your coin balance.
· Cashout processing: Provision of a PayPal account identifier is necessary to receive a cashout payment. We cannot process a payment without a valid recipient identifier.
· Verification at cashout thresholds: Provision of your phone number, government-issued identity document, and (where applicable) facial mapping data is required to complete cashout verification above applicable thresholds. Failure to provide this information will result in inability to process your cashout request.
· IRS Form 1099-K: Provision of your SSN or ITIN is required by US law for cumulative cashouts of USD $600 or more per calendar year. Failure to provide this information may prevent cashout processing above this threshold and may result in withholding obligations under US tax law.
· Push notifications: Entirely voluntary; declining permission has no impact on app functionality.
8. Automated Decision-Making and Profiling — Summary
As described in detail in Section 2.9, Everplay and its service provider Bureau operate automated systems that analyse device, behavioural, and network data to generate fraud risk scores. These scores may result in automated decisions that restrict your ability to earn coins or access cashout functionality.
These automated decisions are made on the basis of Article 22(2)(a) GDPR, as they are necessary for the performance of the contract with you.
Pursuant to Article 22(3) GDPR, you have the right to:
· Obtain human review of any automated decision that significantly affects you.
· Express your point of view in relation to the decision.
· Contest the decision.
To exercise these rights, contact [EMAIL] with the subject line "Automated Decision Review". We will investigate and provide a response within 30 days.
Beyond fraud scoring, Everplay may use aggregated and anonymised App usage data to understand user engagement patterns and improve our Apps. This activity does not constitute profiling of identified individuals for the purposes of Article 4(4) GDPR.
PART B — ADDITIONAL PROVISIONS FOR CALIFORNIA RESIDENTS (CCPA/CPRA)
This Part B applies to residents of the State of California and supplements the information in Part A. In the event of any conflict between Part B and Part A as applied to California residents, Part B prevails.
References in this Part B to "personal information" have the meaning given in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), rather than the GDPR definition of "personal data" used in Part A.
1. Personal Information We Collect — California Categories
The CCPA/CPRA requires us to disclose the categories of personal information we collect, the purposes for which we collect it, and whether we sell or share it. We do not sell personal information in the traditional sense (exchanging data for money). However, certain disclosures of personal information to advertising partners for the purpose of cross-context behavioural advertising may constitute "sharing" under the CCPA/CPRA.
The following categories of personal information are collected about California residents who use our Apps:
Identifiers
This includes: device identifiers (internal device ID), Google Advertising ID
(GAID), Google App Set ID, IP address, and (at cashout) PayPal email address or
account identifier.
· Collected from: the App directly and via embedded SDKs.
· Purposes: app functionality, rewards tracking, ad delivery, fraud prevention, payment processing.
· Shared with advertising partners (AppLovin and ad network partners) for targeted advertising: Yes — constitutes "sharing" for cross-context behavioural advertising under CCPA/CPRA.
Internet or Other
Electronic Network Activity Information
This includes: session data, time and duration of use, ad impression and
interaction data, game progress data, coin earning activity, GooseUp rewards
activity, and fraud risk scores derived from behavioural patterns.
· Collected from: the App directly and via embedded SDKs.
· Purposes: app functionality, rewards tracking, ad delivery, fraud prevention, analytics.
· Shared with advertising partners for targeted advertising: Yes (ad interaction and engagement data shared with AppLovin).
Geolocation Data
This includes: approximate geolocation derived from your IP address (country
and, where determinable, region level). We do not collect precise GPS or fine
geolocation data.
· Collected from: IP address, automatically.
· Purposes: fraud prevention, regional compliance, ad targeting.
· Shared with advertising partners: Yes (approximate location shared with AppLovin for regional ad targeting).
Inferences
This includes: fraud risk scores generated by Bureau from device, behavioural,
and network signals; inferences about user engagement levels and reward
programme participation.
· Collected from: derived by Everplay and Bureau from App usage data.
· Purposes: fraud prevention, rewards integrity.
· Shared with advertising partners: No.
Sensitive Personal
Information
The following categories of sensitive personal information (as defined by the
CCPA/CPRA) are collected in specific limited circumstances:
· Biometric data (facial mapping and liveness data): collected only when you initiate a cashout above the applicable verification threshold. Processed by Bureau; not retained by Everplay after verification. Collected for identity verification and fraud prevention purposes only. See Part D for full details.
· Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN): collected only when cumulative cashouts reach USD $600 in a calendar year, solely for IRS Form 1099-K compliance. Not shared with third parties for commercial purposes.
· Phone number: collected for SMS OTP verification at applicable cashout thresholds. Not used for marketing. Not retained after verification.
We do not sell or share sensitive personal information for any purpose other than as specified above.
No collection from minors: We do not knowingly collect personal information from users under the age of 13. Our Apps are intended for users aged 18 and over. We do not sell or share the personal information of users under 16.
You have the right to request that we disclose to you:
· The categories of personal information we have collected about you.
· The categories of sources from which your personal information is collected.
· The business or commercial purposes for which we collect, sell, or share personal information.
· The categories of third parties with whom we disclose personal information.
· The specific pieces of personal information we have collected about you.
You have the right to request that we delete personal information we have collected from you, subject to certain exceptions. We may decline to delete personal information that we are required to retain under applicable law, or that is necessary to complete the transaction for which it was collected, to detect or prevent security incidents, fraud, or illegal activity, or to comply with legal obligations.
You have the right to request that we correct inaccurate personal information we maintain about you.
2.4 Right to Opt-Out of Sales and Sharing
You have the right to direct us to stop selling or sharing your personal information for cross-context behavioural advertising.
To opt out, you may:
· Adjust your ad personalisation preferences within the App (via in-app settings, where available).
· Reset or opt out of your Google Advertising ID in your Android device settings (Settings > Privacy > Ads).
· Email [EMAIL] with the subject line "CCPA Opt-Out Request".
We will process opt-out requests within 15 business days of receipt. Following a valid opt-out, we will not sell or share your personal information for cross-context behavioural advertising unless you subsequently provide explicit authorisation.
2.5 Right to Limit Use of Sensitive Personal Information
You have the right to direct us to limit the use and disclosure of sensitive personal information to purposes that are reasonably necessary and proportionate to providing our Apps and services. We do not use sensitive personal information (including biometric data and SSN/ITIN) for any purpose beyond those described in this policy and do not use it to draw inferences about you unrelated to the specific purpose of collection.
2.6 Right to Non-Discrimination
We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices, provide a different level or quality of service, or suggest that you will receive a different level of service as a result of exercising your privacy rights.
2.7 Exercising Your California Privacy Rights
To submit a rights request under the CCPA/CPRA:
· Email [EMAIL] with the subject line: "CCPA Rights Request".
· Describe the nature of your request (e.g., right to know, deletion, correction, opt-out).
· Provide sufficient information for us to verify your identity and locate your records. Because we do not maintain traditional user accounts, verification may require you to provide the email address associated with your cashout or the Advertising ID associated with your device.
Response timeframe: We will acknowledge receipt of your request within 10 business days and will respond substantively within 45 calendar days of receipt. If we require additional time, we may extend the response period by a further 45 calendar days, in which case we will notify you of the extension and the reason.
Authorised agents: You may designate an authorised agent to submit a request on your behalf. We will require the authorised agent to provide written authorisation signed by you, and we may contact you directly to verify your identity and confirm the agent's authority.
Identity verification: We are required to verify your identity before processing certain rights requests to prevent fraudulent disclosure or deletion of your personal information. The level of verification required depends on the sensitivity and nature of the request.
2.8 California "Shine the Light"
Under California Civil Code Section 1798.83 ("Shine the Light"), California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. Everplay does not disclose personal information to third parties for their direct marketing purposes. You may, however, submit a request for confirmation to [EMAIL] with the subject line "Shine the Light Request". We will respond within 30 days of receipt.
PART C — ADDITIONAL PROVISIONS FOR OTHER US STATE RESIDENTS
This Part C applies to residents of the following US states that have enacted comprehensive consumer privacy legislation: Virginia (Virginia Consumer Data Protection Act, VCDPA), Colorado (Colorado Privacy Act, CPA), Connecticut (Connecticut Data Privacy Act, CTDPA), Texas (Texas Data Privacy and Security Act, TDPSA), and any other US state that enacts comprehensive privacy legislation applicable to Everplay's processing activities. This Part C supplements Part A and, where applicable, Part B.
References to "personal data" in this Part C have the meaning given by the applicable state privacy law.
Residents of the Covered States have the following rights in relation to their personal data processed by Everplay:
You have the right to confirm whether Everplay is processing personal data about you, and to access that personal data.
You have the right to request deletion of personal data you have provided to Everplay or that Everplay has collected about you. Certain exemptions apply, including data retained for legal compliance, fraud prevention, and the establishment or defence of legal claims.
You have the right to correct inaccurate personal data that Everplay maintains about you.
1.4 Right to Opt-Out of Sale and Targeted Advertising
You have the right to opt out of:
· The sale of your personal data.
· The processing of your personal data for targeted advertising (including cross-context behavioural advertising).
· Profiling in furtherance of solely automated decisions that produce legal or similarly significant effects (where applicable under your state's law).
To opt out:
· Adjust your Google Advertising ID settings on your Android device (Settings > Privacy > Ads).
· Email [EMAIL] with the subject line: "State Privacy Opt-Out Request" and specify your state of residence.
We will process opt-out requests within 15 business days of receipt.
If we decline to take action on your rights request, you have the right to appeal that decision. To appeal, email [EMAIL] with the subject line: "Privacy Rights Appeal" and include the details of your original request and our response. We will respond to appeals within 60 days of receipt. If your appeal is denied, we will provide information about how to contact the relevant state attorney general or privacy authority to submit a complaint.
You may designate an authorised agent to exercise your rights on your behalf. We will require written authorisation from you before acting on an agent's request.
To submit a rights request under this Part C, email [EMAIL] with the subject line: "State Privacy Rights Request" and include your state of residence and the nature of your request.
No discrimination: We will not discriminate against any resident of a Covered State for exercising their privacy rights under applicable state law.
Sensitive data: The processing of sensitive data categories (including biometric data and SSN/ITIN) is described in Part A (Sections 2.5 and 2.6) and Part D of this policy. Where required by applicable state law, we will obtain your consent before processing sensitive personal data.
Recordkeeping: Everplay maintains records of rights requests received and our responses as required by applicable state privacy laws. These records are retained for a minimum of 24 months from the date of the request.
Targeted advertising: Everplay engages in targeted advertising (cross-context behavioural advertising) through its advertising partners, primarily AppLovin. You may opt out of this processing at any time as described in Section 1.4 above.
Data minimisation and purpose limitation: Everplay processes personal data only to the extent necessary for the purposes described in this policy. We do not process personal data for purposes that are not compatible with those described herein without obtaining your consent.
PART D — FACIAL MAPPING NOTICE AND CONSENT POLICY
This Part D explains how Everplay Limited collects, uses, stores, and protects facial mapping and biometric data in connection with the identity verification process within the GooseUp App.
This section is applicable only when you initiate a cashout request above the applicable verification threshold communicated within the App. In that circumstance, GooseUp will ask you to complete an identity verification process using your device camera, which involves the capture and automated analysis of your facial image.
The identity verification technology used by Everplay is provided by Bureau Technologies, Inc. ("Bureau"), which acts as Everplay's data processor for this purpose. Bureau's liveness detection and identity verification technology is used to confirm your identity, verify that you are a live human being, and prevent fraud.
By proceeding with facial verification, you are giving Everplay and Bureau your explicit consent to collect and process your biometric and facial mapping data as described in this Part D. This consent is voluntary; see Section 4 for the consequences of not consenting and how to withdraw consent.
2. Collection of Facial Mapping Data
When this data is collected: Facial mapping data is collected only when you initiate the cashout verification process within GooseUp at or above the applicable verification threshold. You will be prompted to allow camera access and provide explicit consent before any data is captured.
How data is captured: GooseUp will request access to your device camera. You will be asked to perform a short, guided liveness gesture (such as moving your head, blinking, or following an on-screen prompt). During this process, the following data is captured and transmitted to Bureau for processing:
· A short real-time facial scan or liveness video captured via your device camera.
· Facial geometry and mapping points derived mathematically from your facial image, which are unique to you as an individual.
Purposes for which this data is processed:
· Liveness detection: to confirm that you are a live human being present at the time of verification, and not a photograph, video recording, or synthetic digital image.
· Identity verification: to confirm that the face captured matches the government-issued identity document submitted as part of the KYC process at the same cashout event.
· Fraud prevention: to detect attempts to use multiple identities, to impersonate another person, or to circumvent the verification process.
· Age verification: to support confirmation that you are at least 18 years of age and therefore eligible to receive cashouts.
Who processes this data: Bureau Technologies, Inc., USA, processes facial mapping data as Everplay's data processor pursuant to a Data Processing Agreement that complies with Article 28 GDPR. Bureau processes this data solely on Everplay's instructions and for the purposes described above. Bureau does not use your facial mapping data for any other commercial purpose.
Everplay's role: Everplay is the data controller. Everplay instructs Bureau on the purposes and scope of processing. Everplay does not itself perform facial recognition or biometric analysis; this processing is performed entirely by Bureau's systems.
Everplay: Everplay does not retain facial mapping data or liveness images after the verification process is complete. Following verification, Everplay retains only a record of the verification outcome (pass or fail) and the date and time of verification.
Bureau: Bureau processes and retains facial mapping data only for the period necessary to complete the verification process and comply with its own legal obligations. Bureau deletes facial mapping data in accordance with its data retention policy and applicable law. For further information about Bureau's data retention and security practices, please refer to Bureau's privacy policy.
Data transmission: All facial mapping data is transmitted between your device and Bureau's servers using industry-standard encryption protocols (TLS/HTTPS). Everplay does not receive or store the raw facial image or facial mapping data.
Security measures: Bureau applies technical and organisational security measures appropriate to the sensitivity of biometric data, consistent with applicable law and industry standards.
Consent: Before accessing your device camera for facial verification, GooseUp will display an explicit consent notice explaining what data will be collected, by whom, and for what purposes. Facial data will not be collected until you have affirmatively consented.
Voluntariness: Consent to facial mapping is entirely voluntary. You are not required to complete facial verification. However, as verification is a condition of processing cashout requests above the applicable threshold, declining to consent will prevent Everplay from processing your cashout request for the relevant transaction.
Withdrawal of consent: You may withdraw your consent to the collection and processing of facial mapping data at any time by contacting [EMAIL]. Please note:
· Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.
· Once facial data has been collected for a verification event and transmitted to Bureau, withdrawal cannot undo that specific processing event. Withdrawal will, however, prevent further facial data collection for future verification events.
· Withdrawal of consent may prevent you from accessing cashout functionality for transactions requiring verification.
5. State-Specific Biometric Provisions
Everplay recognises that certain US states have enacted specific laws governing the collection and use of biometric data. The following provisions apply to residents of those states:
Illinois — Biometric Information Privacy Act (BIPA):
· Facial data is collected only for the limited purposes of identity verification, liveness detection, and fraud prevention as described in this Part D.
· Facial data is not collected for any commercial purpose unrelated to those functions.
· Facial data is not sold, leased, traded, or otherwise profited from.
· Facial data is not disclosed to third parties other than Bureau acting as Everplay's data processor, and to the extent required by law or legal process.
· Facial data is deleted upon completion of the verification process, consistent with the retention requirements of BIPA.
· A written policy for the retention and destruction of biometric identifiers is maintained by Everplay and available upon request to [EMAIL].
Texas — Capture or Use of Biometric Identifier Act (CUBI):
· Facial data is collected only with your informed consent and for the limited purposes described in this Part D.
· Facial data is not sold or otherwise disclosed to third parties for commercial purposes.
· Facial data is destroyed within a reasonable time following the purpose for which it was collected — specifically, upon completion of the verification event.
Washington — Biometric Privacy Provisions:
· Facial data is collected only for the specific purposes of identity verification and fraud prevention as described in this Part D.
· Facial data is not enrolled into any biometric surveillance system.
· Facial data is not used for advertising or other commercial purposes.
· Facial data is retained only for the duration of the verification process and is deleted upon completion.
· Requests relating to your biometric data under Washington law may be submitted to [EMAIL].
For all state-specific biometric rights requests, or to request a copy of Everplay's biometric data retention and destruction schedule, please contact [EMAIL] with the subject line: "Biometric Data Request — [Your State]".
Updates to This Privacy Policy
Everplay reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the features and functionality of our Apps. The current version of this policy will always be available at [PRIVACY POLICY URL].
Where we make material changes to this policy, we will notify you by posting a notice within the GooseUp App or, where required by applicable law, by seeking your renewed consent. The "Last Updated" date at the top of this policy reflects when the most recent version was published.
We encourage you to review this Privacy Policy periodically. Your continued use of our Apps following the posting of an updated Privacy Policy constitutes your acknowledgment of and agreement to the updated terms to the extent permitted by applicable law.
For all data protection and privacy matters, including rights requests, complaints, and queries about this policy, please contact:
Everplay Limited
[ADDRESS]
Malta
Registration Number: [REGISTRATION NUMBER]
Email: [EMAIL]
For complaints that we have not resolved to your satisfaction, you have the right to contact the Information and Data Protection Commissioner (IDPC) of Malta at https://idpc.org.mt, or the supervisory authority in the EU member state of your habitual residence or place of work.
This Privacy Policy was prepared for Everplay Limited and applies to all versions of the GooseUp App and the Portfolio Games published by Everplay Limited. It does not apply to any third-party websites, applications, or services linked to or from our Apps, which have their own privacy policies.