1. Introduction

1.1 Deep Blue Coast Limited (“Deep Blue Coast,” “Whale.us,” “we,” “us,” or “our”) operates the social sweepstakes platform available at www.whale.us, together with all associated games, promotions, and related services (collectively, the “Platform”). This Privacy Policy explains what information we collect from users of the Platform, why we collect it, how we use and share it, and the choices and rights available to you.

1.2 This Policy is incorporated by reference into our Terms & Conditions. By registering a Customer Account, accessing the Platform, or playing any Game, you confirm that you have read, understood, and agree to be bound by this Policy in its entirety.

1.3 We may update this Policy at any time. Updates will be posted on the Platform with a revised effective date. Your continued use of the Platform following any update constitutes acceptance of the revised Policy. If you do not accept the updated Policy, you must stop using the Platform immediately.

2. Who We Are

2.1 Data Controller. The Platform is operated by DEEP BLUE COAST LIMITED (“Whale,” “we,” “us,” or “our”), a company duly incorporated under the laws of Cyprus, registration number HE 494371, with its registered office at Grigori Afxentiou, 39, ACADEMIA CENTER,BLOCK 1, Flat/Office 3 Larnaka, 6021, Larnaca, Cyprus. Deep Blue Coast Limited determines how and why your personal data is processed in connection with the Platform.

2.2 U.S. Disclosures. Because the Platform is a sweepstakes-model product intended for users located in the United States, this Policy also incorporates the additional disclosures required under applicable U.S. state privacy laws, set out in Clause 13 below.

3. Information We Collect

We collect the categories of information described below. Not every category applies to every Customer — for example, identity-verification data is only collected once you attempt to redeem a Prize or reach the thresholds that trigger our KYC obligations.

3.1 Information You Give Us Directly

Account and profile details: full legal name, date of birth, permanent residential address, email address, phone number, username, and gender.
Identity-verification documents: government-issued ID, proof of address, and similar records submitted to satisfy our KYC checks.
Biometric information: facial-geometry data generated from a selfie you submit during identity verification, collected only with your express consent.
Payment Medium details: information needed to process Gold Coin purchases or Prize redemptions (we do not store full card or bank credentials — see Clause 6).
Correspondence: anything you send us through support tickets, live chat, email, or social media, including the content of those messages.
Sweep Coin requests submitted under the free Alternative Method of Entry (AMOE) in Clause 8.3 of our Terms & Conditions, whether by mail or digital upload.

3.2 Information Collected Automatically

Device and technical data: device model, operating system, browser type, IP address, and unique device identifiers.
Usage data: Games played, session duration, click paths, and general interaction with the Platform, Lootboxes, and Tribes.
Approximate and precise geolocation data, collected to confirm that you are accessing the Platform from a permitted U.S. state (see Clause 9). You must enable location services on your device to use the Platform.

3.3 Information From Third Parties

Identity, age, and fraud-signal data returned by our identity-verification and compliance partners.
Information from social login providers, where you choose to register that way.
Data from affiliate or marketing partners who referred you to the Platform.

4. How We Use Your Information

4.1 We rely on your information to:

Operate your Customer Account, including verifying your age, identity, and location before permitting Participation or Prize redemption;
Detect, investigate, and prevent fraud, collusion, bonus abuse, and other conduct prohibited under our Terms & Conditions;
Process Gold Coin purchases and fulfil Sweep Coin Prize redemptions;
Respond to support requests and communicate with you about your Account or the Platform;
Comply with anti-money-laundering, sanctions-screening, tax, and other legal or regulatory obligations;
Improve the Platform through analytics on aggregated, de-identified usage patterns; and
Send you marketing communications where permitted, subject to your ability to opt out at any time by contacting support@whale.us.

5. Cookies & Similar Technologies

5.1 We and our service providers use cookies, SDKs, pixels, and comparable technologies to recognise returning Customers, remember preferences, measure Platform performance, and support fraud detection.

5.2 You can manage cookie preferences through your browser settings; disabling certain cookies may limit functionality of the Platform. A current list of the cookies in use is available on request from support@whale.us.

6. Payment Processing

6.1 Gold Coin purchases and any Prize redemption payouts are handled through licensed third-party payment processors. Deep Blue Coast Limited does not directly store your full payment card number, bank account credentials, or equivalent sensitive payment data — that information is held by our processors under their own security and privacy safeguards, and we receive only the data necessary to confirm and reconcile the transaction.

7. Identity Verification & Biometric Data

7.1 To satisfy our know-your-customer and anti-fraud obligations under Clause 15 of our Terms & Conditions, we work with a third-party identity-verification vendor to confirm that you are who you claim to be and that you meet the minimum age requirement to Participate.

7.2 This process may involve comparing a photograph or selfie you submit against your government-issued identification using facial-matching technology, which involves the processing of biometric identifiers. Biometric data collected for this purpose is processed and retained by our verification vendor under its own biometric-data policy, and is retained by us only for as long as needed to complete verification or satisfy a legal retention obligation — generally no longer than the earlier of (i) satisfaction of the verification purpose or (ii) three years after your last interaction with us, whichever occurs first, unless a longer period is required by law.

8. Data Retention

8.1 We keep personal information only for as long as reasonably necessary to fulfil the purposes described in this Policy, to satisfy our AML, tax, and regulatory recordkeeping obligations, or to resolve disputes and enforce our Terms & Conditions. As a general rule, Account and transaction records are retained for at least the period required under applicable AML rules following Account closure, after which the information is deleted or anonymised unless a longer retention period applies.

9. Geolocation & State Availability

9.1 Whale.us is only intended for use by individuals physically located in a U.S. state that is not an Excluded Territory under Clause 2.1 of our Terms & Conditions. We use a dedicated geolocation vendor to verify your real-time location each time you access paid features of the Platform, and we will restrict or decline access from any Excluded Territory.

9.2 Location data collected under this Clause is used solely for eligibility and compliance purposes and is retained only as long as needed for those purposes.

10. How We Share Your Information

10.1 We do not sell your personal information for money, and we do not share it with third parties for cross-context behavioural advertising. We do share information in the following limited circumstances:

With service providers who perform functions on our behalf, such as identity verification, geolocation, payment processing, cloud hosting, customer support tooling, and marketing platforms — under contracts that restrict their use of your data to the services they provide us;
With regulators, law enforcement, or other governmental authorities where required by law, court order, or to meet AML, sanctions, or licensing obligations;
With professional advisors (legal, audit, insurance) as reasonably necessary;
In connection with a merger, financing, or sale of all or part of our business, subject to confidentiality commitments (see also Clause 29.8 of our Terms & Conditions); and
With your consent, or at your direction.

11. International Transfers

11.1 Because Deep Blue Coast Limited and its service providers operate across multiple jurisdictions, your information may be transferred to, stored in, and processed in countries outside of the country in which you reside, including Cyprus, other EU/EEA member states, and the United States. Where we transfer personal data out of the EU/EEA, we rely on the European Commission's standard contractual clauses or another legally recognised transfer mechanism.

12. Children's Privacy

12.1 The Platform is restricted to individuals who are at least 18 years old, or the higher age of majority in their jurisdiction, consistent with Clause 4.2 of our Terms & Conditions. We do not knowingly collect personal information from anyone under that age, and any Account found to belong to a minor will be closed and the associated data deleted, subject to any records we are legally obligated to retain.

13. U.S. State Privacy Rights

13.1 Depending on where you live, you may have rights under state privacy laws (such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and comparable laws in other states) to know, access, correct, delete, or obtain a portable copy of the personal information we hold about you, and to opt out of certain uses of sensitive personal information. You may exercise this opt-out right, or ask us to limit our use of your sensitive personal information, by emailing support@whale.us with the subject line “Sensitive Data Opt-Out.” Where required by applicable state law, we will also recognise opt-out preference signals (such as the Global Privacy Control) transmitted by your browser or device.

13.2 Categories of Information We Collect

Category	Examples	Collected
Identifiers	Name, address, email, phone number, IP address, Account identifiers	Yes
Government IDs & similar	Driver's licence, state ID, other identification submitted for KYC	Yes
Commercial information	Gold Coin purchases, Sweep Coin redemption history	Yes
Biometric information	Facial-matching data generated during identity verification	Yes
Internet/network activity	Browsing, click-stream, and gameplay activity on the Platform	Yes
Geolocation data	Approximate and precise location, used for state-eligibility checks	Yes
Professional/employment info	Not collected in the ordinary course	No
Protected classification data	Not requested; may incidentally appear in ID documents	Limited
Inferences	Preferences and risk/fraud scoring derived from your activity	Yes

13.3 Exercising Your Rights

13.3 You may submit a request to know, access, correct, or delete your personal information by emailing support@whale.us. Because we handle regulated sweepstakes Accounts, we will need to verify your identity before acting on a request — typically by matching the name, date of birth, and email or address on file with the details you provide. If you use an authorised agent to submit a request, we will also require written proof of that authorisation. We will respond to a verifiable request within forty-five (45) days of receipt; if additional time is needed, we will notify you and may extend this period by up to a further forty-five (45) days. We do not charge a fee to process a verifiable request unless it is excessive, repetitive, or manifestly unfounded, in which case we will explain our reasoning and provide a cost estimate before proceeding.

13.4 We will not discriminate against you for exercising any of these rights. Note that certain records — particularly those tied to AML, sanctions-screening, or tax obligations — may be exempt from deletion for as long as we are legally required to retain them. If we decline to act on your request in whole or in part, we will explain the basis for that decision and, where required by applicable state law, will provide you with a means to appeal by replying to our response or contacting support@whale.us.

14. Security

14.1 We maintain administrative, technical, and physical safeguards designed to protect the information we hold from unauthorised access, alteration, or disclosure, and we periodically review those measures as the Platform and the threat landscape evolve. No system can be guaranteed fully secure, and we encourage you to use a strong, unique password, enable multi-factor authentication, and notify us promptly at support@whale.us if you suspect unauthorised access to your Account.

15. Changes to This Policy

15.1 We may revise this Policy from time to time to reflect changes in our practices or in applicable law. Where a change is material, we will provide notice through the Platform or by email before it takes effect. The “Effective Date” at the top of this Policy indicates when it was most recently revised.

16. Contact Us

16.1 Questions or requests concerning this Policy or our handling of your information can be directed to support@whale.us, or in writing to Deep Blue Coast Limited, Grigori Afxentiou, 39, ACADEMIA CENTER,BLOCK 1, Flat/Office 3 Larnaka, 6021, Larnaca, Cyprus.

Version History

Version 1.0 | 07 September 2026 | Initial publication of Privacy Policy.