Privacy Policy

Article 1. Preamble and General Provisions

1.1. This Privacy Policy and Personal Data Processing Notice (the “Policy”) sets out the rules governing the collection, use, disclosure, storage, protection, and other processing of Personal Data in connection with the use of Flamezy digital services.

1.2. This Policy applies to Personal Data processing:

(a) when accessing and using the websites flamezy.io, webview.flamezy.io, app.flamezy.io and static.flamezy.io;

(b) when installing and using the Flamezy mobile application; and

(c) when using any features, integrations, or tools made available within such services (together, the “Services”).

1.3. This Policy extends to all categories of data subjects whose Personal Data are processed by the Company in the course of providing the Services, including users, website visitors, representatives of corporate clients or partners, and other persons whose data the Company obtains from Users.

1.4. By using the Services, the User consents to the terms of this Policy. If the User does not agree with any provision of the Policy, they must cease using the Services.

1.5. Where mandatory law requires separate consent for the processing of Personal Data (for example, processing of special categories of data or certain communication methods), the Company will obtain such consent from the User in the required form.

Article 2. Terms and Definitions

2.1. Personal Data – any information relating to an identified or identifiable natural person (“data subject”), including data such as name, contact information, user ID, as well as information about facts, events, and circumstances of an individual’s life that allow for their identification.

2.2. Processing of Personal Data – any operation or set of operations performed on Personal Data, whether or not by automated means (including collection, recording, systematization, storage, rectification, use, disclosure, erasure, etc.).

2.3. Company – the legal entity IBURGWALD LTD that processes Personal Data in the context of providing the Services (also referred to as “We”).

2.4. User – a natural person who uses the Flamezy Services and provides their Personal Data to the Company (also referred to as “You”).

2.5. Partners – third parties (companies or individual entrepreneurs) with whom the Company collaborates in the context of providing the Services (e.g., service providers, advertising partners, developers).

2.6. Cookies – small files placed on the User’s device that enable saving data about their actions and preferences while using the Services.

2.7. Other terms used in the Policy (such as “processor”, “third parties”, “confidentiality”) are interpreted in accordance with their generally accepted meaning in the context of personal data protection and applicable law.

Article 3. Personal Data Processing

3.1. Processing Principles. The Company processes Personal Data on a lawful and fair basis, adhering to principles of purpose limitation, data minimization, storage limitation, accuracy, integrity, and confidentiality.

3.2. Processing Purposes. Users’ Personal Data are processed for the following purposes: (a) providing and maintaining the Services (including account registration, authentication, saving preferences, and usage statistics); (b) communicating with the User, sending notifications and mailings (with separate consent where required); (c) handling User inquiries and support requests; (d) improving Service quality and developing new features based on usage analysis; (e) complying with legal requirements and enforcing the terms of service.

3.3. Legal Bases. The processing of Personal Data is carried out on the following bases: (a) necessity for the performance of a contract with the User (provision of Services under the user agreement); (b) consent of the data subject (for specific processing activities, e.g., sending marketing communications);

(c) compliance with legal obligations (e.g., retaining accounting records); (d) legitimate interests of the Company or third parties (e.g., fraud prevention, provided this does not override the User’s rights and freedoms).

3.4. Categories of Data. Depending on the purposes, the Company may collect the following categories of Personal Data: contact information (name, email address, phone number); account data (login, password, account ID); data on interactions with the Services (usage history, search queries, preferences); technical data (IP address, device information, cookies and other identifiers); data provided voluntarily by the User (e.g., profile information or communications with support).

3.5. Special Categories. The Company does not solicit special categories of personal data (such as information on racial or ethnic origin, political opinions, health, biometric data, etc.). The User agrees not to provide such data when using the Services. If in specific cases the processing of special categories of data is necessary, the Company will obtain explicit consent from the data subject and implement additional protective measures.

Article 4. Collection of Personal Data

4.1. Directly from the User. The primary volume of Personal Data is provided directly by Users when registering for and using the Services (for example, by filling out forms on the website or app, or contacting support).

4.2. Automatically Collected. When using the Services, certain data are collected automatically: technical information (IP address, device type, OS version, language, browser type), interaction data (access times, pages viewed, clicks). This data collection is carried out via tracking technologies (cookies, SDKs, pixels).

4.3. From Third-Party Sources. Where permitted by law, the Company may obtain Personal Data from public sources or partners (for example, updated contact details from databases if the User has consented for a partner to share information).

4.4. Data Updates. The User is responsible for providing accurate Personal Data and updating it in case of changes. The Company takes reasonable measures to maintain the accuracy and currency of data in its possession.

Article 5. Transfer and Disclosure of Personal Data

5.1. Data Processors. The Company may engage third-party organizations to process Personal Data on behalf of and under the instructions of the Company (“data processors”). In such cases, the Company enters into an agreement with these parties obligating them to process data strictly per the Company’s instructions and to ensure its protection. Processors are not permitted to use Personal Data for their own purposes.

5.2. Transfer to Third Parties. The Company does not disclose Personal Data to third parties except in the following cases: (a) with the User’s explicit consent for such transfer; (b) where the transfer is necessary for providing the Services (e.g., hosting providers, notification delivery services); (c) upon request from competent authorities in accordance with due legal procedure; (d) in connection with a corporate reorganization of the Company (e.g., merger or business sale, provided the recipient assumes obligations to adhere to this Policy).

5.3. International Transfer. If the processing of Personal Data involves transfer to a country outside the User’s residence, including outside the European Economic Area (EEA) or the United Kingdom, the Company will ensure that adequate measures are in place to protect the data subjects’ rights. In particular, data will only be transferred: (a) to countries recognized as providing an adequate level of data protection by relevant authorities; (b) on the basis of agreements incorporating standard data protection clauses approved by regulators; or (c) under other lawful transfer mechanisms provided by applicable law.

5.4. Mandatory Disclosure. Where the Company is required to disclose Personal Data by law, court order, or a governmental directive, such disclosure will be limited to the extent necessary to comply with the obligation, and the User will be notified of the disclosure (if such notification is permitted by law).

5.5. Aggregated Data. The Company may generate aggregated and anonymized data from Personal Data (e.g., usage statistics of the Services) and use it for analysis, business improvement, publications, or other purposes. Such data does not identify individual Users and is not considered personal data.

5.6. Attribution. To attribute app installs and links, including links to videos shared from the app, and to prevent fraud, the Company uses Adjust GmbH as a data processor; Adjust receives the advertising identifier, App Set ID, Google Play Install Referrer, the click on a shared link and technical device data needed to match them.

Article 6. Data Storage and Security

6.1. Retention Periods. The Company retains Personal Data no longer than necessary for the purposes for which it is processed, as outlined in this Policy, unless a longer retention period is required or permitted by law. Criteria for determining retention include: the duration of the User’s use of the Services, whether the User’s consent is in effect (where applicable), and mandatory retention periods under law (e.g., for accounting documents).

6.2. Data Deletion. Upon expiration of the retention period or fulfillment of the processing purposes, the Company will either delete the Personal Data or anonymize it so that the data subject is not identifiable. Certain data may be retained longer if it has been anonymized or if retention is necessary for compliance with a legal obligation or for the protection of the Company’s legitimate interests (e.g., resolving disputes).

6.3. Security Measures. The Company implements appropriate organizational and technical measures to protect Personal Data from unauthorized or accidental access, alteration, disclosure, destruction, or other unlawful actions. Such measures include, inter alia: access controls (Personal Data is accessible only to authorized personnel and processors), use of encryption and other security technologies where applicable, and regular review of security policies and procedures.

6.4. Incidents. In the event of a data breach or other incident that threatens data security, the Company will act in accordance with legal requirements – taking necessary steps to address the incident, mitigate potential harm, and prevent future occurrences. When required (for example, in the event of a serious breach that may pose risks to Users’ rights and freedoms), the Company will notify the relevant supervisory authority and the affected data subjects within the timeframes established by law.

6.5. Confidentiality. All Company employees who have access to Personal Data are obligated to maintain its strict confidentiality. Failure to adhere to these requirements may result in disciplinary action and legal liability as per the Company’s internal policies and applicable law.

Article 7. Cookies and Similar Technologies

7.1. Use of Cookies. As part of operating the Services, the Company may use cookies and similar technologies (e.g., pixel tags, local storage, SDKs) to ensure the functionality of the Services and to collect analytical and marketing information. Cookies may be both first-party (set by the Company) and third-party (set by the Company’s partners such as analytics or advertising services).

7.2. Types of Cookies. The Company uses the following categories of cookies: (a) strictly necessary cookies (to enable the Services to function, remember session data, User preferences); (b) analytics cookies (to gather statistics on Service usage); (c) functional cookies (to personalize the interface); (d) advertising cookies (to display targeted ads, if implemented). The specific list of technologies used may be updated as the Services evolve.

7.3. Cookie Management. The User can manage cookie preferences: (a) through browser settings, disabling some or all cookies (note: doing so may render certain Service features unavailable); (b) via a cookie banner/consent center interface, where made available; and/or (c) via device settings, where relevant to mobile identifiers and permissions.

7.4. Cookie Consent. The Company will obtain the User’s prior consent for setting non-essential cookies (e.g., analytics or advertising cookies) in accordance with legal requirements. By continuing to use the Services after the cookie notice is displayed (where such a setting is offered), the User consents to the use of cookies in accordance with this Policy.

7.5. A detailed inventory of Cookies/SDKs/Trackers is maintained by the Company as an internal compliance record and is not published.

Article 8. Data Subject Rights

8.1. Right of Access. The User has the right to request confirmation as to whether their Personal Data is being processed, and to obtain a copy of their Personal Data undergoing processing, as well as information about the processing conditions (purposes, data categories, recipient categories, retention periods, etc.).

8.2. Right to Rectification. If the User believes that any Personal Data relating to them is inaccurate or incomplete, they have the right to request the Company to correct such data without undue delay.

8.3. Right to Erasure. The User has the right to request the deletion of their Personal Data, for example, if the data is no longer necessary for the purposes for which it was collected, or if the User has withdrawn their consent (provided there are no other legal grounds for processing). The Company will comply with such requests except where retention of the data is required by law or necessary for the protection of legitimate interests (e.g., for handling legal claims).

8.4. Right to Restrict Processing. The User has the right to request the temporary suspension of processing of their Personal Data (other than storage) in the following cases: when the accuracy of the data is contested (for a period enabling the Company to verify it); when processing is unlawful but the User opposes erasure and requests restriction instead; when the data is no longer needed by the Company but the User needs it for the establishment, exercise, or defense of legal claims; when the User has objected to processing pending verification of whether the Company’s legitimate grounds override the User’s rights.

8.5. Right to Data Portability. With respect to data processed based on the User’s consent or for the performance of a contract, and by automated means, the User has the right to receive such Personal Data from the Company in a structured, commonly used, machine-readable format, and to request the transfer of this data to another controller, where technically feasible.

8.6. Right to Object. Where processing is carried out in the public interest or for the Company’s legitimate interests, the User has the right to object at any time to the processing of their Personal Data on such grounds. Upon receiving an objection, the Company will cease processing unless it demonstrates compelling legitimate grounds that override the interests, rights, and freedoms of the User, or for the establishment, exercise, or defense of legal claims.

8.7. Right to Withdraw Consent. If Personal Data processing is based on the User’s consent, the User has the right to withdraw their consent at any time by sending a notice to the Company. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

8.8. Right to Complain. If the User believes their personal data rights have been violated, they have the right to lodge a complaint with the competent supervisory data protection authority. For Users located in Cyprus, this is the Office of the Commissioner for Personal Data Protection of Cyprus. The User may also contact the supervisory authority of their place of residence or work (if within the EU/EEA or the UK).

8.9. Exercising Rights. To exercise their rights, the User can submit a request to the Company (contact details are provided in Article 23 of this Policy). The Company will review and respond to User requests within the timeframes established by applicable law (generally within one month), and free of charge, except in cases of abuse of rights (e.g., repetitive unfounded requests may result in a reasonable fee or refusal as permitted by law).

Article 9. Company Rights and Obligations

9.1. Company Obligations. The Company undertakes to: (a) process Personal Data strictly in accordance with this Policy and legal requirements; (b) inform the User about the processing of data upon request and provide legally required information; (c) ensure data security and take measures to prevent unauthorized access; (d) notify supervisory authorities and (where required) Users of personal data breaches in accordance with the law.

9.2. Company Rights. The Company has the right to: (a) request from the User only the Personal Data necessary for the stated purposes; (b) in the event of the User’s consent withdrawal or requests for deletion/restriction – retain the minimum necessary information about the User if required to protect the Company’s rights (for example, record of services provided or transactions completed); (c) update this Policy and improve data processing methods and processes, subject to the established procedure for informing Users.

9.3. Transfer of Rights. In the event of a reorganization of the Company, change of ownership, or other changes affecting the processing of Personal Data, the rights and obligations of the Company under this Policy may be transferred to a new controller, provided that the new controller complies with the provisions of this Policy and, if required by law, obtains all necessary consents from Users.

Article 10. Processing of Children’s Data

10.1. Age Restrictions. The Services are intended for Users aged 13 years and older (13+). The Company does not knowingly collect or process Personal Data of individuals under the age of 13 without proper parental or guardian consent.

10.2. Additional Measures. If the law of the User’s country of residence sets a higher age threshold for consent to personal data processing (e.g., 14, 15, or 16 years old), the Company will adhere to the applicable age requirement for those Users.

10.3. Discovery of Minors. If the Company becomes aware that it has collected Personal Data from a child under 13 (or an applicable higher age as required by mandatory law) without verifiable parental consent, the Company will take steps to discontinue processing and delete such Personal Data. Parents or legal guardians who discover that a child has provided their data to the Company without consent should contact the Company to initiate deletion of such data.

Article 11. Communications and Mailings

11.1. Service Notices. The Company may send Users informational messages related to the use of the Services (e.g., registration confirmations, technical or security notices). These messages are not promotional and are sent on the basis of the agreement for the provision of Services. The User cannot opt out of receiving such service communications, as they are an integral part of the Services.

11.2. Marketing Mailings. With the User’s separate consent, the Company may send them promotional and news materials about the Services, special offers, and other marketing information. The User has the right to unsubscribe from such communications at any time by using the opt-out mechanism included in each message or by contacting the Company with a request to stop.

11.3. Feedback. When the User contacts support or other Company contact points (e.g., via email), the Company processes the information provided by the User to respond to the inquiry, resolve an issue, or improve service quality. Conversations with Company representatives (e.g., via phone) may be recorded for quality assurance and analysis of requests.

Article 12. User Conduct

12.1. The Services are intended for Users aged 13 and over.

12.2. The User must provide accurate Personal Data when registering and using the Services. It is prohibited to impersonate another person or create an account on behalf of someone else without proper authorization.

12.3. In using the Services, the User must comply with applicable laws and refrain from actions that may infringe the rights and freedoms of third parties or cause harm to the Company (including not attempting to gain unauthorized access to others’ data, not distributing malicious software, and not engaging in activities that constitute fraud, harassment, distribution of illegal information, etc.).

12.4. In case of the User’s violation of the terms of this Policy or legal requirements, the Company may take necessary measures, including suspending or terminating access to the Services, deleting or blocking the account, and contacting law enforcement authorities if unlawful acts are detected.

Article 13. Confidentiality and Third Parties

13.1. Confidentiality. The Company treats all information about Users collected in the course of providing the Services as confidential (except for anonymized or publicly available information). The Company’s employees and processor partners are obligated to maintain the confidentiality of such data in accordance with contractual terms and internal policies.

13.2. Third-Party Links. The Services may contain links to third-party websites or services that are not controlled by the Company. This Policy does not apply to Personal Data processing on those external resources. The Company advises Users to review the privacy policies of any external sites they visit via links from our Services.

13.3. Interactions with Third Parties. If within the Services the User provides their data to third parties (for example, through integrated partner services), such data are processed under the terms of those third parties, and the Company is not responsible for the actions of those third parties with respect to Personal Data provided directly to them by the User.

Article 14. Jurisdictional Matters

14.1. Governing Law. The relationships related to personal data processing under this Policy are governed by the laws of the Republic of Cyprus, as well as directly applicable European Union regulations, including the General Data Protection Regulation (GDPR), to the extent of the Company’s activities within the EEA.

14.2. Cross-Border Operation. Since the Services are offered globally, the actual processing of Personal Data may take place in various jurisdictions. The Company ensures compliance with mandatory local data protection laws for relevant categories of Users (for example, Users from the EU/EEA, UK, USA, etc.).

14.3. Dispute Resolution. All disputes and disagreements related to Personal Data processing or this Policy shall be subject to preliminary resolution through negotiations between the User and the Company. The parties agree to make all reasonable efforts to reach an amicable solution.

Article 15. Changes to the Policy

15.1. The Company may revise and update this Policy periodically to reflect changes in data processing practices or legal requirements. The new version of the Policy comes into force upon its publication on the website, unless a different effective date is specified.

15.2. Material changes to the Policy (for example, changes in processing purposes, categories of data collected, or transfers to new categories of recipients) may additionally be communicated to Users via email or in-service notifications. Continued use of the Services after changes take effect signifies the User’s acceptance of the updated Policy.

15.3. The current version of the Policy is always accessible to Users via a permanent link on the Flamezy website. The Company retains previous versions of the Policy and will provide them upon request by the User or a supervisory authority.

Article 16. Contact Information

16.1. For any questions regarding this Policy or the processing of Personal Data, the User may contact the Company by sending an inquiry to the contacts provided below (Article 23).

16.2. When contacting the Company, the User should clearly outline their request so that the Company can respond appropriately (for example, specify which rights they wish to exercise or describe the issue). The Company may request additional information necessary to verify the User’s identity or clarify the request.

16.3. The Company will review the inquiry and provide a response within a reasonable time, and no later than the deadlines set by applicable law. The response will be provided in the same form as the inquiry was received, unless the User requests a different method.

Article 17. External Links

17.1. The Services may contain links to third-party websites and other resources. These links are provided for the convenience of Users and do not imply the Company’s endorsement or recommendation of those resources or their privacy practices.

17.2. The Company does not control the content of external websites and is not responsible for their privacy policies or practices. The User follows external links at their own risk. It is recommended to review the privacy policy of each website the User visits via a link from the Services.

Article 18. Liability

18.1. The Company is responsible for fulfilling its obligations regarding personal data protection in accordance with applicable law and this Policy. In case of violation of data protection requirements, the Company may be held liable as provided by law (fines, orders to remedy violations, etc.).

18.2. The User is responsible for:

(a) the accuracy of information they provide through the Services;

(b) ensuring they have a lawful basis to provide the Company with Personal Data of third parties (if the User discloses data of others to the Company, they must ensure they have proper consent or other legal grounds to do so).

18.3. Neither the Company nor its partners shall be liable for any indirect damages or lost profits incurred by the User in connection with the use of the Services or the processing of their Personal Data, except in cases expressly provided by law. The Company is also not responsible for the actions of third parties that are not its processors, to whom the User independently discloses their Personal Data.

Article 19. Dispute Resolution

19.1. Disputes and disagreements related to Personal Data processing or the operation of this Policy shall be resolved through negotiations between the User and the Company. The parties undertake to make all reasonable efforts to reach an agreement.

19.2. The User retains the right to lodge a complaint with the competent data protection authority (as indicated in clause 8.8) regardless of any negotiations with the Company. Such a complaint does not deprive the User of the right to judicial protection.

19.3. To the extent not involving public interests or mandatory legal requirements, the Company and the User may agree to submit a dispute related to Personal Data to alternative dispute resolution (e.g., mediation or arbitration), provided this does not contravene applicable law.

Article 20. Force Majeure

20.1. The Company shall not be liable for delays or failure to fulfill its obligations related to Personal Data processing if caused by circumstances of insurmountable force (force majeure), such as natural disasters, power or Internet outages, acts of war, riots, or other circumstances beyond the Company’s reasonable control.

20.2. The provisions regarding data subject rights (Article 8) remain in effect, and the Company will, to the extent possible, strive to minimize negative consequences of force majeure circumstances on the privacy of Users’ Personal Data.

Article 21. Policy Amendments

21.1. The Company has the right to amend this Policy. The current version of the Policy is published on Flamezy’s official website and marked with the date of the last update. Continued use of the Services after any changes indicates the User’s acceptance of the revised Policy.

21.2. Material changes may additionally be brought to the attention of Users (for example, by sending notifications to the User’s email or displaying a pop-up upon login). Users are encouraged to periodically check the “Privacy Policy” section of the website to stay informed of any changes.

Article 22. Final Provisions

22.1. This Policy takes effect on the Effective Date indicated above and remains in effect until it is amended or revoked in accordance with the established procedure.

22.2. If any provision of this Policy is held invalid, it shall not affect the validity of the remaining provisions. Any invalid provision will be replaced by a valid provision that most closely reflects the original intent and is permitted by applicable law.

Article 23. Company Details and Signature Block

23.1. Controller (Company): IBURGWALD LTD, Registration No.: HE 486085, registered address: Gianni Kranidioti & Pargas, 9, Flat/Office 102, 1065, Nicosia, Cyprus

23.6. Privacy contact: [email protected];

Schedule A. Extended Flamezy Data Matrix

This matrix explains the categories of data that may be processed in connection with Flamezy mechanics. It supplements the Privacy Policy and does not limit data-subject rights, legal bases or retention limits described in the main Policy.

A.1. Account and identity data

Account data includes user ID, email, phone number, username, language settings, country, age signals, registration history, security settings, consent records and login logs. These data are necessary to create an account, authenticate the user, protect against unauthorized access, communicate with the user and perform the contractual documentation.

Where KYC/AML or sanctions triggers arise, the Company may request additional identity information through its own process or a third-party vendor. Such checks are risk-based and do not mean that all users undergo full identity verification by default.

A.2. AI-training and interaction-quality data

Flamezy may process viewing data, session duration, reactions, ratings, choices, skips, rejections, comments, quality flags, error labels and other actions that support training or validation of AI models. These data may remain linked to an account while necessary for Rewards, anti-fraud checks, model quality or legal requirements.

The Company is not required to disclose all quality parameters, algorithmic weights or signals used to validate Watch Goal and AI-training sessions. Processing must remain purpose-limited, proportionate and aligned with the Platform functions.

A.3. Reward, FLAME, EZY and marketplace data

Reward data includes Watch Goal, Rewards, Reward Boxes, Streak Bonus, Multiplier/Multiplyer, EZY, FLAME Coin, virtual items, access to training a specific AI model, marketplace history, eligibility flags, recalculations, holds and disputed events. These records are used for contract performance, internal calculation, fraud prevention and record-keeping.

External wallet addresses, withdrawal addresses, transaction IDs, network fees and related risk signals may be processed where a user uses the relevant features. The Company does not request seed phrases or private keys and users must never provide them.

A.4. Technical, device and anti-fraud signals

Security and anti-abuse processing may include IP addresses, device identifiers, browser or app information, OS version, language, time zone, approximate location, session events, rate-limit events, CAPTCHA signals, integrity checks and behavioural patterns. These data help detect bots, device farms, multiple accounts, compromised accounts and referral abuse.

These signals should not lead to a solely automated material decision without legally required safeguards where those safeguards apply. A user may contact support or appeal if they believe a technical flag was incorrect.

A.5. Retention and deletion

Ordinary account data are retained while the account exists and for a reasonable period after closure where needed for claims, reporting, security or legal compliance. Reward, wallet-related, fraud, AML and marketplace records may be retained longer where necessary for investigations, calculation records, repeat-abuse prevention or responses to lawful requests.

Account deletion does not always mean immediate deletion of every log, backup copy, moderation record, complaint, fraud note or transaction trace. The Company applies access restriction, minimization and later deletion or anonymisation when the retention purpose ends.

Adjust keeps attribution data as long as needed for install attribution and fraud prevention, then deletes or anonymises it.

A.6. Contacts and rights

Data-subject requests should be sent to [email protected]. To speed up processing, the user should identify the account email or other account identifier, the specific right requested and enough information to verify identity.

Illegal-content notices or DSA notice-and-action matters, child-safety matters and moderation appeals should be sent to [email protected]. These channels may be handled by different teams but within a single data-protection and confidentiality framework.