EngagePlay — Privacy Policy

This Privacy Policy explains how EngagePlay collects, uses, discloses, and protects personal information in connection with engageplay.app and the EngagePlay platform (the "Service"), in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

EngagePlay serves two groups: Business Users (our subscribers) and End Users / Players (their customers). For most player data, the Business User is the organization that decides why and how the data is used (the "controlling" organization), and EngagePlay processes that data on the business's behalf as a service provider. This policy describes both our own practices and how we handle data for Business Users.

1. Information we collect

From Business Users: name, business name, email, phone, billing details (processed by our payment processor — we do not store full card numbers), account credentials, and information you submit for SMS/A2P registration (legal name, business number, address, website, sample messages).

From End Users / Players: information collected through a Business User's campaign, which may include first name, email address, phone number (when provided, e.g., for VIP/voucher delivery), consent indicators and timestamps, gameplay and prize/voucher activity, reviews/feedback and ratings, and redemption status.

Automatically: device and usage data, IP address, browser type, pages viewed, and similar analytics, including via cookies and similar technologies (see section 10).

2. How we use information

We use personal information to: provide and operate the Service (run prize wheels, issue and redeem vouchers, collect reviews, send messages that recipients have consented to receive); authenticate users and secure accounts; process payments and manage subscriptions; provide support and service communications; generate reports and analytics for Business Users; comply with legal obligations (including CASL record-keeping for consent and opt-outs); and prevent fraud and abuse. We send commercial electronic messages only where consent exists, and we honour withdrawal of consent.

3. Legal basis / consent

We rely primarily on consent (express or implied as permitted by law) and on the necessity of processing to provide a service you requested. Players provide express consent (for example, by checking an opt-in box) before receiving marketing messages; transactional messages (such as a voucher you requested by playing) may rely on implied consent arising from your interaction. You may withdraw consent at any time (see "Your rights").

4. How we share information

We do not sell personal information. We share it with: service providers / processors that help us run the Service (listed below), under contracts requiring appropriate protection; Business Users, who receive the data collected through their own campaigns; payment processors to handle billing; and authorities or third parties where required by law, to enforce our terms, or to protect rights and safety. If we are involved in a merger, acquisition, or asset sale, information may be transferred subject to this policy.

Key sub-processors (may change):

• Supabase — application hosting, database, authentication.
• Resend — transactional and campaign email delivery.
• GoHighLevel / LeadConnector — SMS/text message delivery (A2P).
• Stripe (via our billing tooling) — payment processing.
• Cloudflare — content delivery and security.

5. International transfers

Our providers may process or store data outside your province or outside Canada (including the United States). Where this occurs, the information may be subject to the laws of those jurisdictions. We take reasonable steps so that transfers are protected by appropriate safeguards and provider commitments.

6. Retention

We keep personal information only as long as needed for the purposes described, to provide the Service to Business Users, and to meet legal, accounting, or reporting requirements (including CASL consent and opt-out records, which we retain for the periods required by law). When no longer needed, we delete or de-identify it. Business Users can request deletion of their account data after termination, subject to legal retention obligations.

7. Your rights

Subject to law, you may request to access, correct, or delete your personal information, and to withdraw consent to marketing communications. Players can opt out of SMS at any time by replying STOP, and out of emails via the unsubscribe link. To exercise rights, contact privacy@engageplay.app. If your data was collected through a specific business's campaign, we may direct or coordinate your request with that Business User, who controls that data. We will respond within the timeframes required by PIPEDA.

8. Security

We use technical and organizational safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, and restricted handling of credentials and tokens. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

9. Children

The Service is not directed to children. We do not knowingly collect personal information from children under 13 (or the applicable age in your province). If you believe a child has provided information, contact us and we will delete it.

10. Cookies

We use cookies and similar technologies (including local storage) for: strictly necessary purposes (sign-in, security, sessions); functional preferences; analytics to understand and improve usage; and limited campaign cookies on a Business User's prize-wheel page (e.g., to recognize a return visit or prevent duplicate plays). We do not use cookies to sell personal information. On first visit you can accept or decline non-essential cookies via our consent banner (the default is the most privacy-protective option), and you can control cookies through your browser settings; disabling some may affect functionality.

11. Changes to this policy

We may update this policy. Material changes will be posted with a new "Last updated" date and, where appropriate, communicated to users. Continued use after changes take effect constitutes acceptance.

12. Contact and complaints

Privacy questions or requests: privacy@engageplay.app, Connexvn Inc. (EngagePlay), 204‑1885 Wilson Ave., R1, Toronto, ON M9M 1A2, Canada. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).