2.1 Information You Provide to Us

• Account registration details: full legal name, date of birth, email address, username, and password.
• Contact information: phone number, mailing address.
• Communications: messages you send to our support team, responses to surveys, and contest entries.
• Sweepstakes entries and redemption requests.

2.2 Identity & Biometric Verification Data

To comply with our Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations, we collect:

• Government-issued photo identification (e.g., driver's license, passport, national ID card).
• Selfie or liveness-check image for facial matching.
• Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN) for tax-reporting purposes.
• Biometric identifiers (facial geometry data) generated during liveness verification, subject to applicable state biometric privacy laws including the Illinois Biometric Information Privacy Act (BIPA).

2.3 Payment & Financial Information

• Bank account details (for ACH transfers), debit/credit card information, digital-wallet identifiers, or cryptocurrency wallet addresses used for purchases or redemptions.
• Transaction history: amounts, dates, methods, and statuses of all purchases and redemptions.
• Financial documentation submitted for Enhanced Due Diligence (EDD) (e.g., bank statements, tax returns).

Full payment card numbers are processed directly by PCI-DSS Level-1-certified payment processors and are not stored on our servers.

2.4 Automatically Collected Information

When you use the Platform (website or mobile app), we automatically collect:

• Device identifiers: IP address, device type, operating system version, browser type and version, mobile hardware model.
• Mobile advertising identifiers: Apple Identifier for Advertisers (IDFA) on iOS devices; Google Advertising ID (GAID/AAID) on Android devices. You may limit ad tracking in your device settings.
• Push notification token (if you grant notification permissions) — used only to send you account and promotional notifications.
• App usage data: pages and screens viewed, features used, time spent, in-app actions, game sessions, and session timestamps.
• Location data: country and state/region derived from IP address. We do not collect precise GPS location without explicit consent.
• Log data: server request logs, error logs, referral URLs, and crash reports.
• Performance data: app load times, crash diagnostics, and analytics events collected via third-party analytics SDKs.

2.5 Information from Third Parties

• Identity and fraud-screening results from KYC/AML verification providers.
• Sanctions and Politically Exposed Person (PEP) screening results from compliance data providers.
• Geolocation and IP-reputation data from IP-intelligence providers.
• Referral or affiliate information if you arrived via a partner link.

2.6 Sensitive / Special-Category Data

We collect sensitive data only to the extent required by law or necessary for the service:

• Government ID numbers (SSN/ITIN) — for IRS tax-reporting obligations.
• Biometric data — for identity verification (see Section 2.2).
• Financial account information — for processing purchases and redemptions.

5.1 Service Providers

We share data with third-party vendors who provide services on our behalf, including cloud hosting, payment processing, email delivery, customer support tooling, analytics, and fraud prevention. These vendors are contractually bound to process data only as directed by us and may not use it for their own purposes. See Annex B for the current sub-processor list.

5.2 Identity Verification Provider

We share government ID images and liveness-check data with our contracted KYC/identity-verification provider solely to verify your identity and age. This provider is prohibited from using the data for any other purpose.

5.3 Mobile Application Platform Operators

If you access the Platform through an application distributed via the Apple App Store or Google Play Store, Apple Inc. and Google LLC may collect certain technical and financial data related to your device and in-app purchases in accordance with their own privacy policies. Apple and Google are independent data controllers for their own data collection. We are not responsible for their data practices.

5.4 Legal / Regulatory Disclosures

We may disclose personal information to courts, regulators, law enforcement agencies, or other governmental authorities when required by law, subpoena, court order, or regulatory investigation; to enforce our legal rights; or to protect the safety of our users or the public.

5.5 Business Transfers

In the event of a merger, acquisition, asset sale, reorganization, or insolvency proceeding, personal information may be transferred to the successor entity, subject to the same protections described in this Policy.

5.6 With Your Consent

We may share data for other purposes with your explicit prior consent.

8.1 EEA / UK / Switzerland

If you are in the EEA, United Kingdom, or Switzerland, you have the following rights under GDPR / UK GDPR:

• Right of Access — obtain a copy of your personal data.
• Right to Rectification — correct inaccurate data.
• Right to Erasure ("Right to be Forgotten") — request deletion of your data where we no longer have a legal basis to retain it.
• Right to Restriction — ask us to pause processing while a dispute is resolved.
• Right to Data Portability — receive your data in a machine-readable format.
• Right to Object — object to processing based on legitimate interests or direct marketing.
• Rights in Relation to Automated Decision-Making — not to be subject to solely automated decisions that produce significant legal effects, without human review.
• Right to Lodge a Complaint — with your local data protection authority.

8.2 California (CCPA / CPRA)

California residents have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

• Right to Know — categories and specific pieces of personal information collected, the business purposes for collection, and the categories of third parties with whom it is shared.
• Right to Delete — request deletion of personal information, subject to legal exceptions (e.g., AML/BSA obligations).
• Right to Correct — request correction of inaccurate personal information.
• Right to Opt Out of Sale / Sharing — we do not sell or share personal information for cross-context behavioral advertising.
• Right to Limit Sensitive Data Use — limit the use and disclosure of sensitive personal information.
• Right to Non-Discrimination — we will not deny services or charge different prices because you exercised a CCPA right.

To submit a verifiable consumer request, see Section 8.4 below. California residents may also designate an authorized agent to submit a request on their behalf.

8.3 Other U.S. States

Residents of Colorado, Connecticut, Virginia, Texas, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and port their personal data, and to opt out of certain processing. Contact us at privacy@betzy.fun to exercise these rights.

8.4 How to Exercise Your Rights — Including Account & Data Deletion

To exercise any of the above rights, including requesting deletion of your account and all associated personal data, contact us at:

We will respond to verifiable requests within 30 days (extendable by 60 additional days where reasonably necessary). For requests submitted through a mobile application, you may also use the in-app "Delete My Account" function if available, which initiates the same process. We may need to verify your identity before processing a deletion request; AML/BSA retention requirements may prevent immediate deletion of certain financial records.

If you are unsatisfied with our response, you may lodge a complaint with your relevant supervisory authority (EEA/UK) or state Attorney General (U.S.).

10.1 Apple App Store

• The Betzy app is available on iOS devices via the Apple App Store. Apple Inc. is not a sponsor of, and is not affiliated with or responsible for, the Betzy sweepstakes promotion.
• Apple and the Apple logo are trademarks of Apple Inc., registered in the U.S. and other countries.
• In-app purchases processed through the Apple App Store are subject to Apple's App Store Terms and Conditions and Apple's privacy policy. Apple may collect technical and payment data in connection with those purchases. Contact Apple Support for billing inquiries related to App Store purchases.
• You may disable IDFA-based advertising tracking at any time via iOS Settings → Privacy & Security → Tracking.
• To delete your Betzy account and all associated data, email privacy@betzy.fun or use the "Delete Account" function within the app.

10.2 Google Play Store

• The Betzy app is available on Android devices via the Google Play Store. Google LLC is not a sponsor of, and is not affiliated with or responsible for, the Betzy sweepstakes promotion.
• Google Play and the Google Play logo are trademarks of Google LLC.
• In-app purchases processed through Google Play are subject to Google Play's Terms of Service and Google's privacy policy. Contact Google Play Support for billing inquiries related to Play Store purchases.
• You may reset or opt out of interest-based advertising using the Google Advertising ID (GAID) via Android Settings → Google → Ads.
• To delete your Betzy account and all associated data, email privacy@betzy.fun or use the "Delete Account" function within the app.

10.3 Push Notifications

If you grant notification permissions, we may send you push notifications regarding account activity, sweepstakes results, promotions, and responsible-gaming reminders. You may disable push notifications at any time in your device Settings without affecting your ability to use the Platform.

10.4 Mobile Analytics & Crash Reporting

Our mobile apps use analytics and crash-reporting SDKs (such as Firebase Analytics and Crashlytics, or equivalent services) to help us diagnose technical issues and improve app performance. These collect anonymized or pseudonymized usage events, crash logs, and device diagnostic information. No individually identifiable data is shared with these providers beyond what is described in this Policy and their own terms.