Last Updated: May 15, 2026

IMPORTANT NOTICE: THIS PRIVACY POLICY (THIS "POLICY") MUST BE READ TOGETHER WITH THE TERMS OF SERVICE, THE SWEEPSTAKES RULES, THE RESPONSIBLE GAMING POLICY, AND THE GAME STATEMENT (TOGETHER, THE "INCORPORATED POLICIES"). BY ACCESSING OR USING OUR SERVICES (AS DEFINED IN THIS POLICY), YOU AGREE TO COMPLY WITH AND BE BOUND BY THIS POLICY AND THE INCORPORATED POLICIES.

This Policy is a legally enforceable agreement between Kernel Games Inc. (the "Company," "we," "us," or "our") and you (the "User," "you," or "your"). This Policy governs how you access, use, and interact with our digital products and offerings, including our official websites, mobile applications, online games, user profile systems, and all related features, tools, and additional services (collectively, the "Services"). Protecting the personal data collected through the Services is a key priority for us.

In this Policy, we describe the types of information we may collect, the reasons we process that information, when it may be disclosed or shared, and the rights that may be available to users under applicable data protection and privacy laws.

The Services are intended only for individuals who are twenty-one (21) years of age or older. We do not knowingly or intentionally collect or process personal information from individuals under 21. If we learn that we have collected information relating to a person under this age, we will take reasonable measures to delete or remove that information promptly.

1. Information We Collect

We may collect the following categories of information:

• Contact Information: Information such as your name, email address, telephone number, and mailing address.
• Account Information: Information linked to your account, including your user ID, password, and account verification status.
• Personal Information: Information such as your date of birth, age, gender, VIP level, and gameplay history.
• Transaction and Usage Information: Information concerning your purchases, redemptions, and your activity and interactions within the Services.
• Preference Information: Information relating to your preferences, including your selections regarding marketing communications and promotional offers.
• Location and Device Information: Technical information that may include your SIM card region, IP address, device settings, operating system, time zone, browser type, and device identifiers. Use of VPNs or similar technologies to access the Services is prohibited.

Additionally, some information may be collected automatically through SDKs and comparable technologies, including device identifiers, advertising identifiers, usage metrics, and analytics information.

We may also collect information you choose to provide when you create an account, use the Services, participate in promotional play, make purchases, contact customer support, or take part in gameplay activities.

NOTICE: In limited situations, we may collect or process certain types of sensitive personal information for purposes such as identity verification, security oversight, customer support, and preserving the integrity of our platform. This may include:

• Photographs: For example, selfies or images provided for identity verification.
• Video Recordings: For example, short videos used for liveness checks or identity verification.
• Audio Recordings: Including recordings created in connection with customer support communications.

Photographs, selfies, video recordings, and audio recordings are collected only where needed for identity verification and/or security-related purposes. If biometric processing is required, it is performed solely by authorized third-party identity verification providers. We do not create, store, or retain biometric identifiers or biometric templates.

This sensitive personal information is used only for security monitoring, identity verification, fraud prevention, and compliance with applicable laws and regulations.

2. How We Use Your Information

We process personal information for the following purposes:

• To deliver, operate, and maintain the Services;
• To set up, administer, and protect user accounts;
• To process transactions, purchases, and redemptions through the Services;
• To send communications related to the Services, including updates, notices, and promotional communications where permitted by applicable law;
• To identify, prevent, and investigate fraud, abuse, or other unauthorized or improper activity;
• To satisfy applicable legal, regulatory, and compliance requirements.

Where required by applicable law, the lawful bases for processing personal information may include your consent, processing necessary to perform a contract, our legitimate business interests, and/or compliance with legal obligations.

You may request deletion of your account and related personal information by emailing [email protected]. After we receive and verify a valid request, we will take reasonable steps to delete or deactivate your account. Once processed, your account will be deactivated and your access to the Services will end.

Even if your account is deleted or deactivated, we may keep certain information when needed for legitimate purposes, including:

• Compliance with legal and/or regulatory requirements;
• Fraud prevention and security monitoring;
• Dispute resolution;
• Enforcing this Policy and/or any Incorporated Policies.

3. Identity Verification (KYC) Information

To comply with applicable legal and regulatory requirements, help prevent fraud, and protect platform integrity, we may require users to complete an identity verification process commonly known as "KYC."

3.1 Types of Information We Collect

When identity verification is required, we may collect and/or process information needed to confirm your identity, which may include:

• Personal identity details (for example, your full name, date of birth, and nationality);
• Information contained in government-issued identification (including passports, driver's licenses, or national ID cards);
• Selfie images provided for identity verification;
• Residential address information and proof of address documents, where required;
• Device and account identifiers (including your user ID and related account details);
• Video, photo, and/or audio recordings created during identity verification calls or chats, where applicable.

We collect and process this information only for identity verification, fraud prevention, and compliance with legal and regulatory obligations.

3.2 Use of Your Information

Identity verification information may be collected and processed by authorized third-party verification providers and shared with us only for the purposes described below.

Such information may be used to:

• Meet legal and regulatory obligations;
• Detect and prevent fraud, money laundering, and other misuse of the Services;
• Confirm user eligibility to access the Services, including compliance with age restrictions.

3.3 Third-Party Verification Providers

We may use reputable third-party identity verification providers (for example, Sumsub or comparable providers) to complete identity verification for us. These providers may collect and process verification information as part of their services.

These providers are required by contract to implement appropriate protections for your personal information and may use such information only for identity verification and regulatory compliance.

3.4 Retention of Data

We retain identity verification information only as long as reasonably necessary to achieve the purposes described above, or for the period required by applicable law and regulation. Where feasible, we retain verification results or status outcomes instead of keeping full copies of identification documents.

We do not sell, rent, trade, or otherwise monetize biometric data. Any biometric information processed during verification is used only for identity verification and is retained only for the period needed to complete verification and comply with applicable legal requirements.

4. Geolocation and Location Limits

To satisfy applicable legal and regulatory obligations, access to the Services may be limited or restricted in certain jurisdictions. We may use information such as your IP address and device settings to estimate your approximate location.

Access to the Services is currently prohibited in the following territories: Alabama, California, Connecticut, District of Columbia, Indiana, Idaho, Louisiana, Maine, Michigan, Montana, Nevada, New Jersey, New York, and the State of Washington of the United States.

You are responsible for ensuring your use of the Services complies with the laws and regulations applicable where you reside. Using a Virtual Private Network (VPN) or similar technologies to bypass location restrictions is strictly prohibited and violates this Policy and the Incorporated Policies.

5. Geolocation and Device Verification Consent

To meet jurisdictional requirements and to prevent fraud or unauthorized access, we may collect, use, and process certain device-related and location-related information when you access or use the Services. This may include your IP address, GPS information, Wi-Fi or network signals, device identifiers, operating system details, browser or application configuration, and other technical indicators used to help confirm your location and protect the security and integrity of our platform. We may also use trusted third-party providers specializing in geolocation verification and fraud prevention to conduct these checks for us.

When you use the Services, we may use technologies designed to detect efforts to hide or modify your actual location or device environment. These methods may include detecting VPNs, proxy services, remote access solutions, virtual machines, emulators, or other similar tools intended to evade geographic or technical restrictions. If we cannot verify your location, or if we detect access from a restricted jurisdiction, certain features or functions of the Services may be restricted, suspended, or unavailable.

Any device and location information collected for compliance and fraud prevention will be processed in accordance with this Policy and retained only for as long as necessary to meet applicable legal, regulatory, and security requirements.

6. Detection of VPN, Proxy, and Circumvention

To maintain fair play and comply with legal requirements, using technologies intended to conceal, spoof, or manipulate your true location or device environment is strictly prohibited. These technologies may include VPNs, proxy servers, location-spoofing tools, emulators, or remote desktop applications.

We may monitor for the use of such tools or other circumvention methods. If we detect this activity, we reserve the right to take appropriate measures, including suspending your account or limiting your ability to redeem prizes or access certain Service features.

7. Third-Party Data Collection and Sharing

We do not sell your personal information. We may, however, share certain information with trusted third-party service providers who help us operate, maintain, and support our business. Such sharing is limited to what is necessary and is subject to confidentiality and data-protection requirements.

These providers may include identity verification providers (such as Sumsub), fraud detection and risk management providers, payment processors, cloud hosting and infrastructure vendors, and analytics and advertising partners.

All third-party service providers must, by contract, process personal information only on our behalf and only for the purposes we specify. They must also maintain suitable technical and organizational safeguards to protect your information.

8. Protection of Your Data

We use reasonable administrative, technical, and organizational measures designed to protect your personal information against unauthorized access, disclosure, alteration, or loss. These measures may include encryption and secure hosting environments. Payments are handled by certified third-party payment processors, and we do not store or retain complete credit card information.

No internet transmission method or electronic storage system can be guaranteed to be completely secure. Accordingly, we encourage you to use strong passwords and take appropriate measures to protect your account credentials.

9. How and When We Share Information

We do not sell your personal information. However, we may disclose certain information in limited situations where disclosure is necessary to operate the Services or to meet legal requirements. Such disclosures may include:

• Service Providers: Sharing information with trusted vendors or partners performing services for us (for example, hosting, customer support, and fraud prevention).
• Corporate Transactions: Disclosing or transferring information in connection with corporate activities such as mergers, acquisitions, restructuring, financing, or asset sales or transfers.
• Legal and Regulatory Compliance: Disclosing information when required to comply with laws, regulations, court orders, or lawful government requests.
• Protection of Rights and Safety: Disclosing information where necessary to protect the rights, property, or safety of the Company, our users, or others.

Third-party service providers receiving personal information are required by contract to use it only for authorized purposes and to maintain appropriate confidentiality and security protections.

10. Advertising, Analytics and SDKs

To enable advertising delivery, analytics, and performance measurement, we may work with third-party partners that use cookies, SDKs, and similar technologies to collect information about interactions with websites and applications. This information may be used to present relevant advertising and to evaluate marketing campaign performance. Where available, you may control cookie settings through your browser or device preferences.

We may also use third-party analytics and attribution tools (such as Google Analytics, Firebase, and AppsFlyer) to assess user engagement, measure campaign results, identify fraudulent activity, and improve Service performance and functionality. These partners may collect and process certain information through SDKs and related technologies in accordance with their own privacy policies.

We do not sell personal information for money. However, some disclosures for advertising or analytics may be treated as "sharing" under certain privacy laws. Where required by law, users may exercise the right to opt out of such sharing as provided by applicable local rules.

11. Links to the Third-Party

The Services may provide links to external websites or platforms for convenience or informational purposes. Those third-party services operate independently and are not controlled by us.

We are not responsible for the content, privacy practices, or policies of third-party services. We recommend reviewing the privacy policies of any external site or platform before submitting any personal information.

12. Legal and Safety Disclosures

We may disclose personal information when we reasonably believe disclosure is required to comply with applicable laws, regulations, legal process, or government requests. We may also disclose information as necessary to enforce this Policy and the Incorporated Policies, investigate suspected violations or misconduct, or protect the rights, property, or safety of the Company, our Users, or third parties.

13. Requests for Data Deletion

Where permitted by applicable law, users may request deletion of their personal information. Requests may be submitted by contacting: [email protected].

To protect security and verify legitimacy, we may require you to confirm your identity before we act on a deletion request. Verification may include confirming the registered email address and/or other account-related information. Requests will be evaluated and processed in accordance with applicable legal, regulatory, and operational obligations and within the timeframes required by law.

14. Protection of Children's Privacy

The Services are intended only for individuals who are 21 years of age or older. We do not knowingly collect personal information from individuals under 21.

If we learn that personal information from a person under 21 has been collected unintentionally, we will take reasonable steps to delete it promptly.

15. California Privacy Rights

This section applies only to individuals who reside in California. Under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the "CCPA"), California residents have specific rights regarding their personal information.

Information We Collect

For California residents, we collect the following categories of personal information:

• Identifier information (for example, IP address, device ID, email address, and online identifiers);
• Geolocation information (approximate location derived from IP address).

We collect this information directly from you, automatically through cookies and similar technologies, and from third-party analytics and advertising partners.

Why We Collect and Share Your Information

We use this information to operate and enhance our website, evaluate usage, and deliver advertising. We share this information with third-party analytics providers (for example, Google Analytics) and advertising platforms (for example, Meta and Google Ads) to support those activities. Under the CCPA, sharing for cross-context behavioral advertising is considered a "share" of personal information.

Your Rights

If you are a California resident, you have the right to:

• Know what personal information we collected about you, including categories of sources, business purposes, and the third parties with whom it was shared;
• Request deletion of your personal information, subject to certain exceptions;
• Request correction of inaccurate personal information we maintain about you;
• Opt out of the "sharing" of your personal information for cross-context behavioral advertising;
• Not be discriminated against for exercising any of these rights.

How to Exercise Your Rights

To submit a request to know, delete, or correct, contact us at [email protected]. We will verify your request using the information you provide (for example, your email address and/or device information) and will respond within the timeframes required by law.

An authorized agent may make a request on your behalf. We may require proof of your written authorization and may also verify your identity directly.

Opt-Out of Sharing

At this time, we do not offer a "Do Not Sell or Share My Personal Information" link within the Services. If you wish to opt out of sharing your personal information for cross-context behavioral advertising, please contact us at the email address above. We are evaluating options to provide a direct opt-out mechanism in the future.

16. Non-Confidential Submissions

Except where applicable law requires otherwise, any ideas, suggestions, feedback, or other materials you provide to us that are not subject to a confidentiality obligation may be used by the Company without restriction and without payment or compensation.

17. Contact Us

If you have questions, concerns, or requests related to privacy or data protection, contact us at: [email protected].