Privacy and Cookie Policy

Looking after your information

Security measures We have security measures that are intended to protect any Personal Information or other sensitive information under our control from loss, misuse, or alteration. Though we cannot guarantee that loss, misuse, or alteration of information will never occur, we use reasonable efforts to prevent it. Sending or storing information on the Internet is not 100% secure, so we can’t guarantee the security of any information you share with us. To the fullest extent permitted by applicable law, we do not accept liability for unintentional disclosure.

We’ll tell you if your privacy is at risk We may send you emails or other messages about security, privacy, and account management. If we learn about an incident that may qualify as a data breach under the law, we will notify you in accordance with the law.

How long we keep your information We may keep your Personal Information for specific purposes as long as we need it to fulfill those purposes, sometimes even if you’ve stopped using Flippy’s Services. When we no longer require your Personal Information, we will de-identify or delete the information. Here are the reasons we may need to keep your information:

For resolving problems We keep billing information and transaction histories so that we can resolve billing disputes or inquiries. We keep user account history to solve any customer service issues and to provide, improve, and develop our service.

To make our services safer We may keep information if it will help us make our Service safer and more secure, such as to stop bad actors who try to misuse Flippy.

For legal reasons We may keep information for legal reasons, like establishing legal defenses, conducting audits, pursuing legitimate business purposes, enforcing our agreements, exercising our rights, or complying with legal obligations.

Where we store your information Flippy is based in the United States. We send information we collect from you to our secure servers in the U.S. where we store and use it. This storage is necessary for us to process the information. We may also transfer information that we collect from you to our other offices and to the third parties mentioned in Section 4 of this Policy – these might be outside your region. Our agents or contractors may also use your information. The data protection laws of the U.S. or other countries may not be equivalent to those where you live. Wherever we transfer your Personal Information, we will take reasonable steps to ensure that your privacy rights continue to be protected. If required by applicable legislation, we rely on a valid international data transfer mechanism to enable cross-border data transfers.

Privacy Policy Changes and Updates

We update this Privacy Policy at times, so you should review this page regularly. We always publish the date of the latest version at the bottom of this page. If we make any major changes, we will let you know by email (if we have your email address or a parent’s or legal guardian’s email address) or by showing a prominent notice on this website or in the app prior to the change becoming effective. If required by law, we will obtain your consent or the consent of a parent or legal guardian if any of these changes involve new material uses of your Personal Information not previously disclosed in this Privacy Policy.

Additional information based on where you live

If you are a California resident Your Rights as a Data Subject In accordance with California law, you may have the following rights: Access to/Portability of Personal Information. You can receive a copy of categories of Personal Information and specific pieces of Personal Information we have collected, used, disclosed, sold, or shared about you in the past 12 months, consistent with legal requirements. Residents also have the right to request the categories of Personal Information disclosed for a business purpose, the categories of sources from which their Personal Information was collected, our business or commercial purposes for collecting their Personal Information, and the categories of third parties to whom we disclosed their Personal Information. In addition, you may have the right in some cases to receive or have your electronic Personal Information in a portable format or transferred to another party. Correction. You can request correction of your Personal Information where it is inaccurate or incomplete. In some cases, we may provide self-service tools that enable you to update your Personal Information or we may refer you to the controller of your Personal Information who is able to make the correction. Deletion. You can request we delete Personal Information we collect from you, subject to certain exceptions prescribed by law. Restriction of or Objection to processing. You can request restriction or object to the processing of your Personal Information, and you have the right to opt in or opt out of the sale or sharing of your Personal Information to third parties, if applicable, where such requests are permitted by law. Please note that, in the case of California residents, we do not currently sell or share Personal Information, as those terms are defined under the California Consumer Privacy Act and the California Privacy Rights Act. For that reason, we do not currently offer a mechanism for California residents to opt out of the sale or sharing of Personal Information. We have no actual knowledge of selling or sharing the Personal Information of minors under 16 years of age. Non-discrimination. You have the right to not receive discriminatory treatment by exercising your privacy rights. We do not discriminate against California residents who exercise their privacy rights. Please note that some of these rights can be exercised by updating your account within the Services, or you can contact us as set forth in Section 1 above for other requests. We will process such requests in accordance with applicable laws. To protect your privacy, we will take steps to verify your identity before fulfilling your request so that we can ensure you are the owner of the account making the request. Our California resident consumer request metrics for the previous year can be found here. For additional information related to your rights under California law, including information related to California retention periods, how you can exercise your rights, and more, please visit our full Flippy CPRA Privacy Policy.

US States State consumer privacy laws may provide their residents with additional rights regarding our use of their personal information.

California Additional information for California residents can be found in the “If you are a California resident” section of this Privacy Policy, above. Please also visit our CPRA Privacy Policy.

Colorado, Connecticut, and Virginia State laws provide residents in Colorado, Connecticut, and Virginia with certain rights, including the rights to: Confirm whether we process their personal information. Access, correct, and delete certain personal information. Receive copies of their data in a portable format. Opt out of processing of Personal Information for targeted advertising, sales of their data, and profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise any of these rights, please complete the Customer Support Form. To appeal a decision regarding consumer rights, please contact us at contact@Flippy.com. Please note that we may maintain and use de-identified data, as defined under applicable law, without attempting to re-identify the data.

If you live in the European Economic Area (EEA), the United Kingdom (UK) or Switzerland Categories of Personal Information and Data Processing Purposes In the course of visiting our websites and apps, and/or using our services and products, we may process the following Personal Information subject to the legal bases mentioned below:

Setting up a Flippy account Username and password to create your account. The basis for processing this personal data is Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”). Email addresses and other information you provide us with for added verification and/or to enable certain features. The bases for processing this personal data are Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”) and f (“legitimate interest”) GDPR. Flippy has a legitimate interest in providing a safe and secure service, especially to protect children. If you choose to provide a phone number, we will use the phone number for security and account access purposes, which will allow you to log in via mobile and recover a lost or forgotten password. You authorize your wireless carrier to use or disclose information about your account and your wireless device, if available, to Flippy or its service provider for the duration of your business relationship, solely to help them identify you or your wireless device and to prevent fraud. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. b GDPR (“performance of a contract”) and f (“legitimate interest”) GDPR. We have a legitimate interest in enabling you to use our services via your mobile device, ensuring security, and preventing fraud. Additionally, with your explicit and informed consent, we may use your phone number to recommend you as a friend to others using Flippy. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. a GDPR (“consent”).

Asking questions or getting technical support Information relating to contacting our customer service, e.g., when you report a problem, submit questions, concerns, or comments. We may process your email address, your name, and information relating to your inquiry or concern in order to respond to your communications, fulfill your requests, or provide other customer support. This processing activity is based on your consent according to Article 6 sec. 1 sent. 1 lit. a GDPR and/or Article 6 sec. 1 sent. 1 lit. b GDPR (“performance of a contract”), depending on the initial purpose for contacting our customer support.

Using Flippy Features Information relating to your use of or interaction with third-party plug-ins, e.g., social plugins from Google, Facebook, or Twitter. When you use these features, certain information from your social media accounts may be accessed by or shared with Flippy, and likewise, certain information about your use of Flippy may be posted to your profile on those platforms. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. a (“consent”). If you use your Flippy credentials to sign in to a third-party website or service, and later delete your Flippy account, you may lose access to such third-party websites or services. When you request or agree to voice-based services from Flippy, we may collect, process, and store your voice recording to provide services and to improve our voice-related services. We may use your voice recording for purposes such as training and improving our filter technology to increase safety on our platform, except that we will not engage in training or product improvement with private server voice chat recordings of EEA users. The bases for processing this personal data are Article 6 sec. 1 sent. 1 lit. a (“consent”) GDPR. We further have a legitimate interest, Article 6 sec. 1 sent. 1 lit. f (“legitimate interest”) GDPR, to provide moderation and increase the safety of our voice-related services. When you request or agree to location-based services (users 13 years old and older), we may collect and track geolocation information so that we can offer services that depend on us knowing where you are. Examples are check-in, or personalizing content or advertising. We collect this information by using an identifier on your device or browser so that we can recognize you each time you return. To stop us from collecting your location information, you can update your device settings, stop using the service, or uninstall our mobile apps. The basis for processing this personal data is Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”). If you join our experiences on a VR platform, we will collect your physical movement information in order to replicate your movement in the experience. This information is only used to provide the service and is not stored. The bases for processing this personal data are Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”). If you join a virtual event hosted by a Creator, data such as your username, email, and Flippy user ID may be shared with the third-party platform that hosts events. Such data is used to allow you to log in to the experience. Your activity during a Creator Event is subject to the third-party platform’s privacy policy as well as the Flippy Community Standards. The bases for processing this personal data are Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”) to join an event and f (“legitimate interest”) GDPR to ensure the security and integrity of our service. Information required for additional features that require the use of your camera or upload content that contains your Personal Information. If you decide to use these features and upload content that requires the use of your camera or upload content that contains your Personal Information, we will collect, process, and store that content only for as long as needed to accomplish the purpose of the feature. The bases for processing this personal data are Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”). For more information, please refer to the Flippy Facial Animation Privacy Policy. Information required for other features or activities, which may be available to our users other than children. We may offer other features or activities on our services from time to time, and you may be able to submit or upload Personal Information in connection with such features. The data being collected for such features and their intended uses will be evident at the time of data collection. The basis for processing this personal data is Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”). If you opt-in to the Contact Importer feature, you consent to sharing with Flippy the first and last names and phone numbers of your contacts in your address book on your mobile phone, either at the time you register for our service or otherwise. We do so to help you connect with your friends on our service. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. b GDPR (“performance of a contract”). Interacting with our experiences. To improve your experience and ensure safety, we collect information about how you interact with the services and we connect this information with your account. For example, we may collect information from a user's game state to detect violations of our terms and to improve our ability to detect such violations; collect information from your search history to give you similar recommendations; share information like your username and transaction details with the UGC creator or subsequent owners if you acquire a limited item, purchase, share, trade, or otherwise engage in a transaction involving UGC. The bases for processing this personal data are Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”) and f (“legitimate interest”). We may use data collected from your interaction with our experiences for safety purposes on the basis of Article 6 sec. 1 sent. 1 lit. f (“legitimate interest”).

Competitions, promotions, and research When you respond to or participate in voluntary research or surveys or studies. These surveys may collect information about your likes and dislikes, experience interests and habits, general hobbies and interests, and other lifestyle information or preferences. These surveys may ask for Personal Information. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. b GDPR (“performance of a contract”). Information relating to your participation in contests, competitions, sweepstakes, giveaways, prize draws, or other promotions that we may run on our Service or sponsor from time to time. We may process certain contact information (such as your name, email address, and/or phone number) for prize fulfillment purposes, as well as other information or content needed for the specific promotion. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. b GDPR (“performance of a contract”).

Advertising To market our services, inter alia, via social media platforms in order to bring new users to our websites and to maintain and increase our user base, we may process Personal Information such as IP addresses, information on users’ browsers or operating systems, including language settings, regional location information, and usernames or user IDs. The legal basis for the processing of this data is Flippy’s legitimate interest in maintaining our user base, bringing new users to our websites, and informing (potential) users about interesting events, Art. 6 sec. 1 sent. 1 lit. f GDPR (“legitimate interest”). When you choose to create an Ad Account, we may collect additional information for your account (such as name, email, address, business information, etc.) in order to create an account. The basis for processing this personal data is Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”). We may also retain transaction details and purchase and payment history. The legal basis for processing these personal data is our legitimate interest in being able to resolve subsequent disputes and inquiries, Article 6 sec. 1 sent. 1 lit. f GDPR (“legitimate interest”).

Other purposes for collecting your information Login information, which may include your IP address, device type, username, password, date and time of your visit, information on your browser version, information on your operating system, including language settings, MAC addresses, and User ID. We will process this information to provide you with our Service. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”) and lit. f (“legitimate interest”) GDPR. It is in our legitimate interest to guarantee the Services’ stability and security. Account information, e.g., information such as your name, username, login and password details, regional location information, user-generated content, contact details that you choose to provide to us, and other Personal Information that are used for participating in the Service we are offering. We process this information to provide our Services to you. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. b GDPR (“performance of a contract”).

Cookies and similar technologies We use cookies. Some of these cookies are necessary for the basic functioning of the website and therefore cannot be deactivated. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. b GDPR (“performance of a contract”) and Art. 6 sec. 1 sent. 1 lit. f GDPR (“legitimate interest”) because we have a legitimate interest in guaranteeing the Services’ stability and security. We will use optional cookies only if you have previously consented to such use. When you visit our website with an EEA IP address, a cookie banner will appear asking you for your consent. You can manage your choice by clicking on “manage cookie preferences” in the cookie banner. We will save your choices in the form of a cookie. This cookie has a limited effective period of one year. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. a GDPR (“consent”). In addition, you can also manage cookies using your browser settings. For further information on cookies and similar technologies, see Section 3 above.

On our corporate websites or in job applications Information relating to a job application made by you, like your name, email address, employment details, CV, resume, or other details of your employment history sent by you. We will process this information to process and respond to your job application. If you engage with Flippy in an immersive space for prospective employees, such as the Flippy Career Center, such a space may be recorded in order to provide the experience. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. b GDPR (“necessary for entering into an employment contract with us”).

Automated Decision-Making Please note that we do not use your Personal Information for automated decision making which produces legal effects concerning you or similarly significantly affects you.

Personal Information of Children and Parental Consent Please note that when users under the age of 13 register for the Service, their account is automatically set to privacy-protective settings by default. This means that these users will not have access to certain features, such as social media plug-ins, some forms of third-party advertising, and certain types of notification alerts. When a child creates an account on Flippy, we may process a username, password, birthdate. Separate from account creation, users may optionally provide a parent email address. We process this information to give the user access to the Service and to communicate with the parent about the child’s account (if a parent email was provided). For example, we may use the parent’s email to send an email notification about the child’s account and an invitation for the parent to review the account and update settings. We may use the birthdate the child provides when signing up for the Service to determine which features on Flippy the child should have access to and to determine when the child will turn 13 years old and can be given broader access to features on our Service. This processing activity is based on Article 6 sec. 1 sent. 1 lit. b GDPR (“performance of a contract”). In general, we will not use or share account information (including Personal Information) from a child’s account except for the permissible purposes stated in this Privacy Policy, and, if required by law, only with the prior verifiable consent of a parent or legal guardian (Article 6 sec. 1 sent. 1 lit. a and Article 8 sec. 1 GDPR).

Data Sharing Flippy may share users’ information, including Personal Information like billing information or usernames, with our third-party agents, contractors, or service providers who are hired to perform services on Flippy’s behalf. These providers may operate or support certain functions of the Service. Below is an illustrative list of functions for which we may use third-party service providers and the names of the providers we may use to perform these functions: Account Integrity and Security (e.g., Veriff, Persona, Arkose Labs) Analytics services (e.g., Google LLC) User Acquisition services (e.g., AppsFlyer) Community filtering and moderation services (e.g., CommunitySift) Customer support services (e.g., Zendesk) Surveys and promotions (e.g., Reach3) Social Media Log-in (e.g., SAP Customer Data Cloud) Billing services and payment gateway providers (e.g., Kount, Worldpay, PayPal, Incomm, Blackhawk, Google, Apple, Amazon, Windows Store, Xbox, PlayStation, Meta Quest, Xsolla) Hosting and content delivery network services (e.g., AWS, Equinix, CenturyLink, YouTube, Vimeo) The legal basis for this data transfer and processing activity is Article 28 of GDPR in conjunction with the data processing agreements we concluded with respective third-party agents. These agents and contractors are only allowed to use the information shared with them for the specific tasks they’ve been hired to do and consistent with this Privacy Policy, and for no other purposes. Flippy takes steps to ensure that all service providers with access to Personal Information are capable of protecting the information we share with them. Further, the creators of the experiences you use or content you interact with will have access to your username, display name, user ID, game metrics, UGC transaction details, and your regional location (which we base on your IP address). We do not share your IP address with the creators. We provide creators with the regional location of players to determine their player base and make sure their experiences meet the legal requirements of the country you live in. The legal basis for this processing activity is Article 6 sec. 1 sent. 1 lit. b (“performance of a contract”), Article 6 sec. 1 sent. 1 lit. c (“compliance with legal obligation”) in compliance with the respective EEA or Member State law, and lit. f (“legitimate interest”) GDPR. It is the creators’ legitimate interest to comply with non-EEA legal obligations.

Legal disclosure We may disclose Personal Information about you, including the content of your communications on the Service, to comply with legal processes, including court orders and subpoenas, served on our Service. In addition, we also may disclose Personal Information about you, including content, in response to a request from law enforcement agencies, regulators, or other public agencies (including schools or children's services), or if such disclosure may (i) prevent the instigation of a crime, (ii) facilitate an investigation related to public safety or protect the safety of a child using our Service, (iii) protect the security or integrity of our Service, or (iv) enable us to take precautions against liability or to protect our rights. The legal basis for such disclosure is Article 6 sec. 1 sent. 1 lit. c (“compliance with legal obligation”) in compliance with the respective EEA or Member State law and lit. f (“legitimate interest”) GDPR. It is our legitimate interest to comply with the legal requirements of U.S. law. Further, we have a legitimate interest in these purposes.

Storage and international transfer of your Personal Information Flippy is based in the U.S. Your Personal Information that we collect is sent to and stored on secure servers located in the United States of America. Such storage is necessary in order to process the information. Some of our agents and third-party service providers are located outside the European Economic Area, e.g., the United States. The data protection laws of the United States or other countries may not be as comprehensive or equivalent to those in your country of residence. Wherever we transfer your Personal Information, we will take reasonable steps to ensure that your privacy rights continue to be protected, e.g., conclude the EU Standard Contractual Clauses with third parties.

Your rights as a Data Subject If you are a user based in the European Economic Area, you may be entitled to exercise some or all of the following rights: Request (i) information on whether your Personal Information is retained and (ii) access to or duplicates of your Personal Information retained, including the purposes of the processing, the categories of Personal Information concerned, and the data recipients, as well as potential retention periods; Request rectification, removal, or restriction of your Personal Information, e.g., because (i) it is incomplete or inaccurate, (ii) it is no longer needed for the purposes for which it was collected, or (iii) the consent on which the processing was based has been withdrawn; Refuse to provide and – without impact on data processing activities that have taken place before such withdrawal – withdraw your consent to the processing of your Personal Information at any time; Object, on grounds relating to your particular situation, to the processing of your Personal Information, in case such processing is either based on our or a third party’s legitimate interests or on the performance of a task carried out in the public interest. In this case, please provide us with information about your particular situation. After the assessment of the facts presented by you, we will either stop processing your Personal Information or present you with our compelling legitimate grounds for ongoing processing; Object to the use of your Personal Information for direct marketing at any time; Request (i) to receive the Personal Information concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and (ii) to transmit those data to another controller without hindrance from our side. Where technically feasible, you shall have the right to have the Personal Information transmitted directly from us to another controller. You may (i) exercise the rights referred to above, (ii) pose any questions, or (iii) make any complaints regarding our data processing by contacting us under the contact details set out above in Sec. 1. Further, you may take legal action in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as lodge complaints before the competent data protection regulators.