Privacy Policy

1. Brands and website visitors

What we collect:

• Account: your email address (to send sign-in links), and the email addresses of teammates you invite.
• Brand details: brand name, website, logo, colours, prizes and the other answers you give in the setup form and the builder.
• Billing: your plan, billing period, invoice amounts and payment status. Our payment provider, Stripe, collects your card and billing details; we never see or store full card numbers.
• Messages: what you send us when you email support or ask for a setup call.
• Technical data: your IP address and browser details, used briefly for security, sign-in and rate limits, and error reports if something breaks.
• Attribution: the ad or campaign link that first brought you to our site (the first_touch cookie, see Cookies), copied onto your account when you sign up.
• Usage: if you agree to optional cookies, how you use our website and dashboard (see Cookies).

Our free tools (the conversion calculator and the wheel spinner) run in your browser. We do not store what you type into them.

We use this data to run your account, bill you, help you, keep SpinLoop secure, send service emails and, with your consent, measure and improve our site and ads. For visitors in the EU and UK, our lawful bases are the contract with you, our legitimate interest in security and service emails, and your consent for optional cookies.

2. Players of brand games

When you play a game on a brand's website, the brand decides what is collected and why. The brand is the controller and SpinLoop is its processor (in US state law terms, its service provider). Contact the brand first about your data; we will help them answer you.

A game collects your email address, a phone number if the brand asks for it and you give it, your consent choice with the exact consent wording you saw, the page you played on and the page before it (referrer), campaign tags in the link (utm), your browser type, your country (worked out from your IP address; we do not store the IP address with your entry), a hashed device signal used only to stop abuse, and the prize you got.

Your IP address is used for a few minutes to limit repeated plays, and it goes to Cloudflare Turnstile, which checks that you are not a bot.

The brand receives all of this in its dashboard and exports, and can send it to its own tools (for example its email platform) by webhook. We email you the code you won on the brand's behalf. We never sell player data, share it for advertising or use it for our own marketing.

The game stores a small value in your browser's local storage so it does not show you the same game again too soon. It loads no third-party scripts apart from Cloudflare Turnstile.

3. Cookies

Our own website and dashboard use these cookies:

• Necessary: sign-in session, your selected brand and your cookie choice (sl_consent, 6 months).
• Attribution: first_touch remembers the ad or campaign link that first brought you here, for 30 days. It stays on our site and is not shared with ad networks. We don't set it for visitors from the EU, EEA, UK or Switzerland.
• Product analytics (optional): PostHog, to see which pages and features are used. Form fields are masked in session recordings.
• Ad measurement (optional): Google Ads, Meta Pixel and TikTok Pixel, to measure which ads lead to sign-ups and purchases. We use Google Consent Mode, which starts as denied.

Optional cookies and pixels only load after you say yes in the cookie banner. You can change your choice at any time with the Your privacy choices link at the bottom of every page. We never put our pixels inside the games we run on brands' websites.

4. Do we sell your data?

We never sell personal data for money. If you accept ad measurement cookies on our own website, Google, Meta and TikTok receive information about your visit, which some US state laws call selling or sharing for targeted advertising. You can say no in the cookie banner, or later with Your privacy choices.

We honour Global Privacy Control. If your browser sends a GPC signal, we treat it as a no to ad measurement on our website, even if you click Accept all. Player data from brand games is never sold or shared for advertising.

5. Who receives data

Brands receive the data of players of their own games (see section 2). We also use these service providers, who process data for us under contract.

We may also share data if the law requires it, to protect people or SpinLoop from harm or fraud, or with a buyer if our business is sold (they must keep the promises in this policy).

6. Where your data is

We are based in India. Our service providers store data in the United States. Our team accesses it from India to run and support SpinLoop. SpinLoop is offered to businesses in the United States. Where data does leave the EEA or UK, transfers use the EU standard contractual clauses and the UK addendum, as set out in our DPA.

7. How long we keep data

• Brand account and brand details: while the account is open, then deleted within 30 days of closing it.
• Billing records (invoices and payments): as long as tax and accounting law requires, currently up to 8 years.
• Player leads, with their play and consent record: 24 months, then deleted automatically. Sooner if the brand deletes them, and within 30 days after the brand's account closes.
• Webhook delivery logs: deleted with the lead they belong to.
• Analytics events in our own database: 24 months, then deleted automatically.
• IP addresses used for rate limits: minutes. They are not stored with leads.
• Cookies: sl_consent 6 months, first_touch 30 days, sign-in for as long as you stay signed in.
• Support emails: as long as we need them to help you, and no longer than 3 years.

Deleted data can stay in encrypted database backups until those backups expire, within 30 days.

8. Your privacy rights

Wherever you live in the US, and whether or not your state's privacy law applies to us yet, you can ask us to: tell you what personal data we have about you and give you a copy in a portable format; correct it; delete it; and stop any selling or sharing for targeted advertising. People in the EU and UK can also object to some uses and withdraw consent. Email support@getspinloop.com.

We answer within 45 days. If we need more time, we will tell you why and take up to 45 more days. We may ask you to confirm your identity, for example from the email address we have.

Someone you authorise can ask for you. We may ask them for your signed permission and ask you to confirm your identity with us directly.

If we say no, we tell you why, and you can appeal by replying to our answer. We reply to an appeal within 45 days. If we still say no, you can contact the Attorney General of your state. We will never charge you more, give you a worse service or otherwise treat you differently for using these rights.

We don't collect sensitive personal information as state laws define it (such as government ID numbers, account logins, precise location, health or biometric data), and we don't use personal data for profiling that has legal or similarly significant effects.

California notice: in the last 12 months we collected identifiers (such as email address and, for players, a hashed device signal), commercial information (plans and payments), internet activity (pages visited and how the site is used) and approximate location (country). We disclosed them for business purposes to the service providers listed in section 5. With consent, visit information went to ad networks, which counts as sharing for targeted advertising. We did not sell personal data for money.

Players: the brand controls your game data, so contact the brand first. If you contact us, we pass the request on and help the brand answer. You can also complain to your state attorney general or your data protection authority.

9. Children

SpinLoop is for businesses, and brands may not run games aimed at children. We do not knowingly collect personal data from anyone under 16. If you think a child gave us data, email us and we will delete it.

10. Security and breaches

We use encryption in transit, row-level access controls so each brand only sees its own data, signed webhooks, rate limits and least-privilege access to production systems. No system is perfectly secure. If a breach affects your personal data, we will tell you, and the brand where it concerns players, as the law requires.

11. Changes and contact

When this policy changes, we update the date at the top, and we email account owners about significant changes. Contact: Quixta Ventures LLP, Bengaluru, Karnataka, India. Email: support@getspinloop.com.