Privacy Notice

Last updated: September 10, 2025

This Privacy Notice describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Website and/or Our software applications for mobile devices (iOS/ Android) and tells You about Your privacy rights and how the law protects You.

Data controller: SCRAMBLY SRL

Contact details: privacy@scrambly.io

Please read this Privacy Notice carefully before using our Service.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Notice:

• Account means a unique account created for You to access our Service or parts of our Service.
• Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest, or other securities entitled to vote for election of directors or other managing authority.
• Company (referred to as either "the Company", "We", "Us" or "Our" in this Privacy Notice) refers to Scrambly.io, SCRAMBLY SRL in Via della Zecca 1, Bologna, 40121, Italy.
• Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• Device means any device that can access the Service such as a computer, a cell phone or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service(s) means providing a marketplace for Users to discover and explore various products and services, where Users are rewarded for their engagement and participation.
• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Users means all users and others who access the Service.
• Website refers to Scrambly.io, accessible from https://scrambly.io
• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Account Data

While using Our Website and/or Our software application, We may ask You to provide Us with certain personal information that can be used to contact or identify You. Such information may include, but is not limited to:

• Email address
• First name and last name
• Display name
• Phone number
• Address, State, Province, ZIP/Postal code, City
• Financial information (such as your payment method, earnings, balance and withdrawals)
• Step count (if applicable)
• Usage Data (including data related to your purchases)
• Gender
• Date of birth
• Income
• Marital status
• Educational level
• Preferences

Legal basis: We process this Personal Data as necessary for the performance of a contract between You and Us (Article 6(1)(b) GDPR), including to provide and maintain Our Services, manage Your account and transactions.

Providing the above data is necessary for the performance of the contract between You and the Company. If You choose not to provide certain Personal Data, we may be unable to provide the Service or fulfill our contractual obligations to You.

Identity Verification Data

As part of the identity verification process, our KYC provider initially collects your ID document and selfie to verify your identity. From the verification data, we store your first name, last name, date of birth, and the issuing country of your document. Please note that our KYC provider may process your biometric information (a special category of Personal Data) for the purpose of performing facial matching as part of the identity verification process.

We use this information to detect duplicate accounts, prevent fraud and abuse, and verify consistency between your document and account country.

Legal basis: The processing is based on our legitimate interests (Article 6(1)(f) GDPR) in maintaining platform integrity and preventing misuse. In some cases, it may also be necessary for compliance with legal obligations (Article 6(1)(c) GDPR). For processing of biometric information we may rely on your explicit consent (Article 9(2)(a) GDPR).

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers, device Information, referral source, network information, and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device's unique ID, the IP address of Your mobile device, country of location, timezone, in-app purchases and their amounts, session information, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

We may also collect, store, and use information about apps or games installed on Your mobile device through Company or separately, either before or during the use of Service. This information is collected, stored, and used for targeting and personalization to improve user experience and personalization.

We may collect your device’s advertising identifiers (Google Advertising ID or Apple IDFA) for analytics purposes and to ensure accurate attribution through mobile measurement partners (MMPs) when you install apps or games promoted through our Service.

We use information about the time spent by Users in other apps and games to offer rewards to them for the time they spend playing certain games.

Additionally, we may collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.

Legal basis: We process this data based on our legitimate interests (Article 6(1)(f) GDPR) to operate, maintain, and improve the Service, enhance security, and personalize user experience. In some cases, processing may also be necessary for the performance of a contract (Article 6(1)(b) GDPR) with You.

Data Related to Your Purchases and Gameplay Data

We may process Your game-related data, including information about the installation of specific games or apps, in-game purchases, and in-game activity. This data is collected for the purposes of content personalization, reporting, attribution, and billing in relation to our business partners (e.g., game developers).

Legal basis: We process this data as necessary for the performance of a contract between You and Us (Article 6(1)(b) GDPR), including to provide and maintain Our Services, manage Your account and transactions and based on our legitimate interests (Article 6(1)(f) GDPR) in analyzing user behavior and personalizing content.

Newsletters through Your email

When You register and provide Your email address, We may use it to send you communications (such as newsletters) about special subscription offers, new features, and other news related to the Service. These newsletters help keep you informed with the latest updates about the Service, including the best price deals. The email address You provide may be transferred to an email marketing tool for optimizing and automating the email delivery process. You can unsubscribe or opt out of receiving emails from us at any time by using the unsubscribe link provided in each email. Your request to unsubscribe will be processed within a reasonable timeframe.

Legal basis: We rely on your consent (Article 6(1)(a) GDPR) to send you marketing communications.

Referrals

If You participate in Our referral program by inviting friends to use the Service, We may collect and process certain Personal Data related to You and the friends You refer, for the purpose of administering the referral program, tracking referrals, and providing any applicable rewards.

Legal basis: We process this data based on our legitimate interests (Article 6(1)(f) GDPR) in operating and improving the referral program.

Leaderboards

We may display Your name and rewards on our leaderboards to showcase user achievements and foster community engagement. You can opt out of any leaderboard or community features by contacting the Company. We also recommend that you do not include your personal information in your username, which can be displayed to other Users.

Legal basis: We process this information based on our legitimate interests (Article 6(1)(f) GDPR) to promote transparency and encourage participation within the Service.

Communication and Survey Data

When you contact our customer support team (e.g., via email or customer service software), or respond to a survey we send you, we may collect and store the content of your communications or responses, including any information you choose to provide, as well as metadata such as the date and time of the interaction. We process this data for the purpose of responding to your inquiries, improving our support services, evaluating customer satisfaction, and maintaining records for quality assurance and compliance purposes.

Legal basis: The processing of this data is based on our legitimate interests (Article 6(1)(f) GDPR) in providing effective customer support, gathering feedback to improve our services, and ensuring proper administration of our operations. In some cases, processing may also be necessary for the performance of a contract (Article 6(1)(b) GDPR) if your inquiry relates to your use of our services.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze Our Service. Please review our Cookie Notice for information about We use cookies and how to manage your cookie preference

Source of Data

In some cases we may collect Personal Data from third parties:

• Social networks: if you choose to sign up using your Google account, we may receive certain information about you, such as your name and email address.
• KYC providers: when you undergo identity verification, our KYC provider may share certain information with us, including data extracted from your identity document and the outcome of the verification.
• Game partners and analytical tools: we may receive your in-game information from our game partners and their analytical tools.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service, including monitoring the usage of our Service.
• To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.
• For the performance of Services: the development, compliance, and undertaking of services, described in Terms and Conditions Terms and Conditions with Us through the Service.
• To contact You: To contact You by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products, or contracted services, including the security updates, when necessary or reasonable for their implementation.
• To provide You with news, special offers, and general information about other services, and events that we offer that are similar to those that you have already purchased or enquired about unless You have opted not to receive such information.
• To manage Your requests: To attend and manage Your requests to Us.
• For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.
• For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns, and to evaluate and improve our Service, services, marketing and Your experience.
• For marketing purposes: to disseminate information about Our service, to send You notifications about upgrades and changes to Our service, and for advertising purposes.

Sharing of Your information

We may share Your personal information in the following situations:

• With Service Providers: We may share Your personal information with Service Providers to monitor and analyze the use of our Service, to provide customer support, operate the technical infrastructure needed to provide the Services and to contact You.
• For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
• With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Notice. Affiliates include Our parent company and any other subsidiaries, joint venture partners or other companies that We control or that are under common control with Us.
• With business partners: We may share Your information with Our business partners to offer You certain products, services or promotions.
• With other users: when You share personal information or otherwise interact in the public areas with other users, such information may be viewed by all users and may be publicly distributed outside.
• With Your consent: We may disclose Your personal information for any other purpose with Your consent.

We may engage the following third-party service providers in order to provide us with necessary infrastructure for delivery and improvement of our services:

Your rights as a User

All Users may exercise certain rights regarding their data processed by the Company (subject to applicable exceptions):

• Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
• Object to processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent.
• Access their Personal Data. Users have the right to learn if Personal Data is being processed by the Company, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Personal Data undergoing processing.
• Verify and seek rectification. Users have the right to verify the accuracy of their Personal Data and ask for it to be updated or corrected.
• Restrict the processing of their Personal Data. Users have the right to restrict the processing of their Personal Data. In this case, the Company will not process their Personal Data for any purpose other than storing it.
• Have their Personal Data deleted or otherwise removed. Users have the right to obtain the erasure of theirPersonal Data from the Company.
• Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.

To exercise any of the rights described above, You can contact us through privacy@scrambly.io. When you submit a request to exercise any of these rights, we may ask you to verify your identity before processing the request. This verification may include providing additional information reasonably necessary to confirm your identity and protect your data from unauthorized access.

We will respond to valid requests without undue delay and in any event within one month of receipt. Depending on the jurisdiction the response period may be longer.

How to opt out

You can opt out of certain advertising features through applicable device settings, such as the device advertising settings for mobile phones or ads settings in general.

In addition, You may follow the instructions provided by the Network Advertising Initiative and the Digital Advertising Alliance or other similar initiatives. Such initiatives allow Users to select their tracking preferences for most of the advertising tools.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Notice. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. Typically, if Your account has been inactive for more than 2 years, it will be deleted, except for any data we are legally required to retain to comply with applicable laws and regulations.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

Transfers of Your Personal Data

Your information, including Personal Data, is processed at the Company’s operating offices and may be transferred to and maintained on servers or computers located in countries outside of Your state, province, country, or other governmental jurisdiction. In such cases, the data protection laws in those countries may differ from those in Your jurisdiction.

Where Personal Data is transferred outside the European Economic Area (EEA) or other regions with adequate data protection laws, We ensure appropriate safeguards are in place, such as adequacy decisions adopted the European Commission or standard contractual clauses, to protect Your Personal Data and comply with applicable data protection laws.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Notice and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

In order to delete your Personal Data from the resources of third parties that we involve in the processing of Personal Data, we send a corresponding request for deletion/destruction.

You may delete Your information at any time by signing in to Your Account if you have one and visiting the account settings section that allows you to manage Your personal information. You may also contact Us to request access to, correct, or delete any personal information that You have provided to Us.

Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition, or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Notice.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public

Further information for Users in California, Colorado, Connecticut, Montana, Oregon, Texas, Utah, Virginia states

This part integrates with and supplements the information contained in the rest of the Privacy Notice and applies to all Users, who are residents in the following states: California, Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia.

For such Users, this information supersedes any other possibly divergent or conflicting provisions contained in the Privacy Notice. We collect the Personal Data, either directly or indirectly, from you when You use the Service.

Your privacy rights under US state laws

You may exercise certain rights regarding your Personal Data. In particular, to the extent permitted by applicable law, you have:

• the right to access Personal Data: the right to know. You have the right to request that we confirm whether or not we are processing your Personal Data. You also have the right to access such Personal Data;
• the right to correct inaccurate Personal Data. You have the right to request that We correct any inaccurate Personal Data We maintain about You;
• the right to request the deletion of your Personal Data. You have the right to request that We delete any of your Personal Data;
• the right to obtain a copy of your Personal Data. We will provide your Personal Data in a portable and usable format that allows You to transfer data easily to another entity – provided that this is technically feasible;
• the right to opt out from the Sale of your Data;
• the right to non-discrimination.

Additional rights for Users residing in California

In addition to the rights listed above common to all Users in the United States, as a User residing in California, you have

• The right to opt out of the Sharing of your Personal Data for cross-context behavioral advertising;
• The right to request to limit our use or disclosure of your Sensitive Personal Data to only that which is necessary to perform the services or provide the goods, as is reasonably expected by an average consumer. Please note that certain exceptions outlined in the law may apply, such as, when the collection and processing of Sensitive Personal Data is necessary to verify or maintain the quality or safety of our service.

Additional rights for Users residing in Colorado, Connecticut, Montana, Oregon, Texas and Virginia

In addition to the rights listed above common to all Users in the United States, as a User residing in Colorado, Connecticut, Montana, Oregon, Texas, and Virginia you have

• The right to opt out of the processing of your Personal Data for Targeted Advertising or profilingin furtherance of decisions that produce legal or similarly significant effects concerning you;
• The right to freely give, deny, or withdraw your consent for the processing of your Sensitive Personal Data.Please note that certain exceptions outlined in the law may apply, such as, but not limited to, when the collection and processing of Sensitive Personal Data is necessary for the provision of a product or service specifically requested by the consumer.

Additional rights for users residing in Utah

In addition to the rights listed above common to all Users in the United States, as a User residing in Utah, you have

• The right to opt out of the processing of your Personal Data for Targeted Advertising;
• The right to opt out of the processing of your Sensitive Personal Data. Please note that certain exceptions outlined in the law may apply, such as, but not limited to, when the collection and processing of Sensitive Personal Data is necessary for the provision of a product or service specifically requested by the consumer.

How to exercise your privacy rights under US state laws

To exercise the rights described above, You need to submit Your request to Us by contacting us via privacy@scrambly.io..

For Us to respond to Your request, we must know who You are. We will not respond to any request if We are unable to verify Your identity and therefore confirm the Personal Data in our possession relates to You. We will use any Personal Data collected from You in connection with the verification of Your request solely for verification and shall not further disclose the Personal Data, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.

If You are an adult, you can make a request on behalf of a child under Your parental authority.

How to exercise your rights to opt out

In addition to what is stated above, to exercise Your right to opt-out of Sale or Sharing and Targeted Advertising You can also use the privacy choices link provided in this Privacy Notice above.

If you want to submit requests to opt out of Sale or Sharing and Targeted Advertising activities via a user-enabled global privacy control, such as the Global Privacy Control (“GPC”), you are free to do so and we will abide by such request in a frictionless manner.

How and when we are expected to handle your request

We will respond to your request without undue delay, but in all cases within the timeframe required by applicable law. Should we need more time, We will explain to you the reasons why, and how much more time we need.

Should we deny your request, We will explain to you the reasons behind our denial (where envisaged by applicable law you may then contact the relevant authority to submit a complaint).

We do not charge a fee to process or respond to Your request unless such request is manifestly unfounded or excessive and in all other cases where it is permitted by the applicable law. In such cases, We may charge a reasonable fee or refuse to act on the request. In either case, We will communicate our choices and explain the reasons behind them.

Further information for Users in South Korea

This section supplements the main Privacy Notice and applies to all Users residing in South Korea, in accordance with the Personal Information Protection Act (PIPA).

The purposes and the data we collect are described in section “Collecting and Using Your Personal Data”.

Retention and Destruction of Personal Information

We retain personal information for the period necessary to fulfill the purposes outlined above, or as required by applicable law. Upon expiration of the retention period or fulfillment of the purpose, the data will be deleted without delay in a secure manner, unless continued retention is permitted or required under applicable law. Please review section “Retention of Your Personal Data” for additional information

Destruction method: Electronic files are permanently deleted using a secure method.

Provision of Personal Information to Third Parties

We do not provide your personal information to third parties without your prior consent, unless permitted by law. Where required by Korean law, we will obtain separate and specific consent for such disclosures.

Entrustment (Outsourcing) of Processing

We may entrust certain personal data processing operations to third-party service providers. The list of such service providers is provided in section “Sharing of Your information”. In such cases, we will ensure compliance with Korean laws by entering into proper data processing agreements.

Your Rights Under Korean Law

You have the following rights regarding your personal information:

• to access your personal information
• to request correction or deletion
• to request suspension of processing
• to withdraw consent at any time (where applicable)

You or your legal representative may exercise these rights by contacting us at privacy@scrambly.io. We will respond without undue delay in accordance with applicable law.

Children's Privacy

Our Service is not intended for children.

As such, we do not knowingly or intentionally gather personal information from children. The definitions of "child" and "children" in the context of data processing may vary depending on the applicable data protection laws and are determined on a case-by-case basis.

Generally, we consider individuals under the age of 16 to be "children" unless we have legal justification to regard someone under 16 as an adult, either in line with local data protection regulations or through direct parental consent provided to us.

If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from children without verification of parental consent, We take steps to remove that information from Our servers.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third-party's site. We strongly advise You to review the Privacy Notice of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Changes to this Privacy Notice

We may update Our Privacy Notice from time to time. We will notify You of any changes by posting the new Privacy Notice on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Notice.

You are advised to review this Privacy Notice periodically for any changes. Changes to this Privacy Notice are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Notice, You can contact us at privacy@scrambly.io.