Introduction

This Privacy Policy explains how Avafli, LLC (“Avafli,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information through the Avafli Engagement SDK (the “Platform”), including all sweepstakes, contests, daily streak mechanics, and promotional giveaways (“Giveaways”) operated through the Platform.

By using any application or website that integrates the Platform, or by participating in any Giveaway, you agree to this Policy. If you do not agree, do not use the Platform.

INFORMATION WE COLLECT

Information You Provide

Email Address  

Collected when you register for a Giveaway. If the host app pre-fills your email, consent is still captured only when you submit the form.

You may also use the Platform without providing an email, in which case entries and streaks are tracked against your device-only identity. You may add an email later to enable cross-device continuity and prize claim eligibility.

Age Confirmation (Dynamic Minimum Age / 18+ Default)
A yes/no confirmation that you meet the minimum age required by the host application (18+ default, where required by law or publisher rules), captured with a timestamp. We do not collect your date of birth.

‍Marketing Consent
‍Your explicit opt-in or opt-out preference for receiving marketing communications from the host app’s publisher. Consent text and timestamp are stored.

Avafli does not send marketing emails and does not use your email for marketing.

Publisher SMS Marketing (Optional)
Some publishers may offer the option to receive SMS marketing messages related to their apps, services, or promotions. If you choose to opt in, your mobile phone number and SMS marketing consent will be shared with that publisher, and the publisher’s own privacy policy will govern how they use your information.

Avafli does not send SMS marketing messages and does not use SMS numbers for any purpose other than winner verification unless you explicitly opt in to a publisher’s SMS program. SMS marketing is always optional and never required to enter or win any Giveaway.

Optional Profile Information  
First name, last name, and phone number may be passed by the host app or provided by you. Used for personalization and prize fulfillment. These fields are optional and encrypted at rest.

Phone numbers provided during profile setup are optional and used for personalization. Phone numbers provided during winner verification are required solely for prize fulfillment.

Winner Claim Information  
If you win, we collect your full name, mailing address, phone number, and any materials required for verification. Personal details are deleted after fulfillment; the claim record (without personal details) is retained for audit purposes.

Email Verification (Winner Verification Only):  

If you win a prize, we require verification of your email address before your claim can be processed. Email verification is not required to enter a Giveaway, participate in streaks, or opt in to publisher marketing. Unverified email addresses may participate normally but are excluded from prize claim until verification is completed.

SMS Phone Number (Winner Verification Only)
If you win a prize, you may be asked to provide a mobile phone number solely for winner verification purposes. SMS numbers are not used for marketing or notifications and are used only to confirm your identity before prize fulfillment.

Additional Information You Provide:
We may receive additional information you choose to provide when contacting our support team or communicating with us directly. This information is used solely to respond to your inquiry.

Information Collected Automatically

Device Identifiers – Device model, OS version, app version, and unique device identifiers.

Session Management, Cookies and Local Storage (Web SDK Only):  

‍Date of birth

Sweepstakes Entrants & Users: We do not use third-party or persistent tracking cookies for sweepstakes participants. Web-based user sessions are strictly temporary and terminate automatically upon closing your browser tab. Non-sensitive operational state (such as daily streak counters) is stored locally on your device via browser local storage to maintain session continuity between visits without storing personal identity.

B2B Publisher Dashboard: Account login for publishers accessing our administrative dashboard uses persistent, encrypted authentication tokens managed through Google Firebase Auth.

Do Not Track (DNT) Signals:
Our Platform does not alter its data collection practices or respond to browser Do Not Track (DNT) signals. Because we do not track users across third-party websites, apps, or online services over time, DNT signals have no operational function within our architecture.

IP Address & Network Telemetry:

Used upon entry for geographic eligibility verification, rate limiting, and fraud prevention. The raw IP address is immediately converted into an anonymized, salted cryptographic hash (SHA-256) and purged from active application memory. Raw IP addresses are never written to permanent database storage or application logs.

Time Zone – Used to determine daily reset windows and detect fraud.

Mobile Advertising Identifier (MAID):
Collected on mobile devices strictly and only if you grant explicit permission via your device’s operating system prompt (e.g., Apple App Tracking Transparency). If permission is denied or not requested, no advertising identifier is accessed, processed, or stored.

Usage Data – Entry timestamps, streak activity, milestones, and interactions.

Push Notification Tokens – Collected only if you opt in to push notifications.

Information We Do Not Collect

We do not collect:

Social Security numbers

Payment information

Precise geolocation

Contacts

Device content

Tax information for prizes valued at $600+ is collected only during fulfillment and never during everyday participation.

HOW WE USE YOUR INFORMATION

Giveaway Administration – Processing entries, tracking streaks, selecting winners, verifying eligibility, and fulfilling prizes.

Unverified Email Addresses:  
If you provide an email address that has not yet been verified, you may continue earning entries, building your streak, and be included in the prize draw. If you are selected as a potential winner, you must complete email verification before your prize claim can be processed.

Anti-Fraud & Security – Device fingerprinting, rate limits, velocity checks, IP hashing, and automated fraud detection.

First-Party Analytics & Operational Reporting:
We collect and analyze engagement metrics (such as daily active entries, streak milestones, and completion rates) using our internal database logging infrastructure. We do not use third-party analytics services (such as Google Analytics or Mixpanel) within our SDK or platform to track user activity.

Communications – Streak reminders, Giveaway updates, and winner notifications. Marketing communications are sent only with explicit consent.

Legal Compliance – Sweepstakes compliance, tax reporting, and regulatory obligations.

HOW WE SHARE YOUR INFORMATION

Giveaway Publishers

Publishers receive:

Aggregated analytics
Your email and consent record only if you explicitly opted in to marketingWinner information only if they fulfill the prize

If you opt in to publisher marketing, the publisher’s privacy policy will apply to their use of your email. Avafli does not send marketing emails.

SMS Marketing Opt‑Ins:
If you opt in to receive SMS marketing messages from a publisher, we share your mobile phone number and SMS marketing consent status with that publisher. Avafli does not send SMS marketing messages and does not use SMS numbers for any purpose other than winner verification unless you explicitly opt in to a publisher’s SMS program.

Publisher-Side Telemetry:
Publishers integrating the Avafli SDK into their host applications may choose to pass event data (e.g., entry completion or streak updates) into their own third-party analytics tools. The collection and processing of event data by a publisher’s third-party tools are governed solely by that publisher’s privacy policy.

Service Providers

We use third-party service providers (including Google Cloud, Firebase, Google reCAPTCHA Enterprise, Google Places API, and email delivery services) to support platform infrastructure, security, and prize fulfillment. These providers are contractually required to protect your data and use it strictly to deliver services to Avafli.

Hosting & Network Infrastructure:
Our web-based services and corporate communications are hosted using enterprise web infrastructure (including Webflow and Cloudflare). These infrastructure providers may automatically process basic technical headers, standard connection metadata, and raw IP addresses strictly for system delivery, load balancing, and network security (such as DDoS mitigation) in accordance with their respective privacy documentation.

Legal Requirements

We may disclose information if required by law or to protect rights, safety, or investigate fraud.

Business Transfers

Your information may transfer in the event of a merger, acquisition, or sale.

DATA SECURITY

We use industry-standard protections:

AES-256 encryption at rest

TLS encryption in transit

Role-based access controls

Audit logging

Automated anti-fraud systems

No method of electronic storage is completely secure.

DATA RETENTION

Active Giveaway Data – Retained for the duration of the Giveaway + 90 days.

Personal Data & Consent Records – Retained for up to 3 years after your last active interaction, after which raw identifiers are permanently deleted or irreversibly anonymized using cryptographic hashing for historical analytics.

Winner Claim Data – Deleted after fulfillment and audit requirements.

Aggregated Analytics – Retained indefinitely.

YOUR PRIVACY RIGHTS

Depending on your jurisdiction, you may have the following rights:

Right to Access (RTA)
Request a copy of the personal information we hold about you.

Right to Correction (RTC)R
Request corrections to inaccurate or incomplete personal information.

Right to Deletion / Right to Be Forgotten (RTD)

Request deletion of your personal information.
Deletion during an active Giveaway forfeits all entries and removes you from the drawing pool.  
Deletion permanently suppresses your prior identity; you may re-register later as a new entrant.

Right to Withdraw Consent (RTW)
‍Withdraw marketing consent at any time without affecting Giveaway eligibility.

Right to Data Portability (RDP)
Request your personal data in a structured, machine-readable format.

Right to Opt Out of Sale/Sharing (RTOS)
We do not sell or share personal information for cross-context behavioral advertising.

Right to Limit Sensitive Personal Information (RTLSPI)
We do not use sensitive personal information for profiling or advertising.

Right to Appeal (RTAp)
If we deny a privacy request, you may request an appeal. Instructions will be provided in our response.

How to Exercise These Rights
You may exercise your rights by:

‍Emailing info@avafli.com from the address associated with your entries

Using the in-app “Delete my data & stop participating” control
When this Privacy Policy is viewed inside an app powered by the Platform, built‑in controls allow you to Access My Data or Delete My Data & Stop Participating directly from within the experience.

Using the Access My Data or Delete My Data links provided in this Policy (if displayed)

We verify identity before processing requests.
‍We respond within 30 days (or as required by law).

A verified deletion request:

Permanently removes your personal information

Ends participation

Forfeits entries

Suppresses re-registration of the same identity

Allows future participation as a new entrant

CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

California residents have additional rights:

Right to know categories of data collected

Right to request deletion

Right to correct inaccurate data

Right to opt out of sale/sharing (not applicable)

Right to non-discrimination

California “Shine the Light” Disclosure:
California residents may request a list of categories of personal information that we shared with publishers for their own marketing purposes during the preceding calendar year. We only share your email address and consent record with a publisher if you explicitly opted in to that publisher’s marketing program.

Requests may be submitted to info@avafli.com

Global Privacy Control (GPC) & Automated Opt-Out Signals:
Because our Platform does not sell or share personal information for cross-context behavioral advertising, Opt-Out Preference Signals (such as Global Privacy Control) do not alter our processing or require secondary opt-out actions within our platform.

CHILDREN’S PRIVACY

The Platform is for users 18 years or older.

We do not knowingly collect data from children under 18.

If such data is discovered, it will be deleted.

THIRD-PARTY UTILITY & INFRASTRUCTURE SERVICES

The Platform does not use third-party advertising networks, retargeting pixels, or cross-site behavioral tracking technologies. We integrate exclusively with essential services and utility providers to deliver the platform safely:

• Google Firebase: User authentication (for B2B publisher dashboards) and secure cloud data storage.
• Google reCAPTCHA Enterprise: Deployed at entry points to evaluate security risks and defend against automated bot traffic and entry fraud.
• Google Places API: Deployed during winner claim verification to provide address autocomplete for prize fulfillment.
• Stripe: Processes publisher B2B subscription payments (never entrant payments).  

You should review the privacy policies of these third‑party services to understand how they process and protect your information.

INTERNATIONAL DATA TRANSFERS

Your information may be processed in the United States or other countries.

We use safeguards to protect transferred data.

CHANGES TO THIS POLICY

We may update this Policy periodically.

The “Last Updated” date reflects the latest revision.

CONTACT US

Avafli, LLC  

Privacy & General Inquiries
Email: info@avafli.com