1. Introduction & Scope

Betzy collects, stores, and processes personal data as necessary to operate the Betzy Platform, comply with legal obligations, and protect the integrity of the sweepstakes promotion. This Data Protection & Privacy Policy describes our technical and organizational measures for protecting that data.

By registering for or using the Betzy Platform, you consent to the collection and processing of your personal data as described in this Policy and the full Privacy Policy.

2. Categories of Data Collected

3. Purpose of Data Processing

We process personal data for the following purposes:

• Account creation, authentication, and management.
• KYC identity and age verification, and ongoing AML/CFT compliance screening.
• Processing Gold Coin purchases and Sweeps Coin redemptions.
• Detecting, preventing, and investigating fraud, cheating, and account abuse.
• Sending transactional and account-related communications.
• Complying with IRS tax-reporting obligations (Form 1099-MISC, W-9/W-8).
• Improving the Platform through analytics and diagnostic data.
• Enforcing our Terms of Service and legal agreements.

4. Data Storage & Security Measures

Betzy implements industry-standard technical and organizational security measures to protect your personal data:

• Transport Layer Security (TLS 1.2 or higher) for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data at rest, including financial information and government ID data.
• Principle of Least Privilege (PoLP): system access is granted only to personnel who require it for their specific role.
• Multi-Factor Authentication (MFA) required for all administrative access to production systems.
• Pseudonymization and anonymization of data where technically feasible to reduce exposure risk.
• Regular vulnerability scanning and annual penetration testing by qualified third-party security firms.
• Employee background checks and mandatory security-awareness training.

5. Data Sharing & Third-Party Processors

Betzy does not sell your personal data. We share data only with:

• KYC/identity-verification vendors — for government-ID and liveness-check processing.
• Payment gateway providers — for processing purchases and redemptions (PCI-DSS compliant).
• Cloud hosting providers — for data storage and platform infrastructure.
• Email and messaging platforms — for transactional and support communications.
• Law enforcement and regulatory authorities — when required by law, court order, or regulatory request.
• AML/sanctions screening providers — for ongoing compliance screening.
• Apple Inc. and Google LLC — as platform operators for app distribution and in-app purchase processing (see our Privacy Policy Section 10 for details).

All third-party processors are bound by data-processing agreements requiring them to implement adequate security measures and to process data only as directed by Betzy.

6. Data Retention Policy

Betzy retains personal data as follows:

• Active accounts: personal data is retained for the lifetime of the account.
• Closed accounts: regulatory-required records (KYC/AML) are retained for a minimum of 5 years after account closure, in compliance with BSA requirements.
• Tax records: retained for 7 years after the relevant tax filing period.
• Server logs and analytics: retained for 12–24 months.
• Biometric data: retained for the period required by applicable state law (not exceeding 3 years from collection or 1 year after last use).

After the applicable retention period, data is securely deleted or irreversibly anonymized.

7. Your Rights & Controls

You have the following rights with respect to your personal data:

• Right of Access: request a copy of the personal data we hold about you.
• Right to Correction: request that inaccurate or outdated data be corrected.
• Right to Deletion (Right to be Forgotten): request deletion of your personal data where we no longer have a legal basis to retain it. Note that AML/BSA obligations may require us to retain certain financial records for up to 5–7 years.
• Right to Opt Out: opt out of marketing communications at any time by using the unsubscribe link in any marketing email or by contacting support@betzy.fun.
• Account Deletion: to delete your account and request data erasure, email privacy@betzy.fun or use the 'Delete Account' function in the app or website settings.

To exercise any of these rights, contact us at privacy@betzy.fun. We will respond to verifiable requests within 30 days.

8. Incident Response & Breach Notification

In the event of a data breach, Betzy's incident-response plan includes:

• Immediate containment and investigation upon detection.
• Assessment of the scope, nature, and risk level of the breach.
• Notification to affected users and relevant regulatory authorities within 60 days of discovery, or sooner where required by applicable law (e.g., GDPR requires notification within 72 hours).
• Guidance to affected users on recommended steps to protect themselves.
• Post-incident review and remediation to prevent recurrence.

9. Policy Updates & Contact

This Policy may be updated from time to time to reflect changes in our practices, technology, or applicable law. We will post the updated Policy on the Platform with a revised date. Your continued use of the Platform constitutes acceptance of the updated Policy.