Privacy Policy

Scope & Acceptance

This Privacy Policy describes how BookieSlip, Inc. ("BookieSlip," "we," "us," or "our") collects, uses, shares, and protects personal information about you when you use our website, mobile apps, APIs, and related services (the "Services").

We are a Delaware corporation. The Services are operated from the United States and are intended for U.S. residents 21 years of age or older. By using the Services, you consent to the practices described in this Policy.

This Policy is incorporated by reference into our Terms of Use, House Rules, and Sweepstakes Rules. If you do not agree with this Policy, do not access or use the Services.

Categories of Information We Collect

We collect the following categories of personal information, organized per California Civil Code § 1798.140 with examples specific to the Services.

We do not collect. We do not collect racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, health data, sexual orientation or sex-life data, or any other sensitive category outside what is listed above.

Sources of Information

We obtain personal information from three categories of sources.

How We Use Information

We use personal information for the following business purposes.

• Operate the Services. Create and manage your Account; accept wagers and grade outcomes per the House Rules; process redemptions; deliver subscription benefits.
• Verify your identity and age. Confirm you are 21+ and a U.S. resident outside Restricted States, including by biometric ID-to-selfie matching (Section 9).
• Process payments and tax reporting. Charge subscription fees and bundle purchases via Stripe; issue Form 1099-MISC where required.
• Detect and prevent fraud. Multi-accounting detection, syndicate-pattern analysis, AML-style controls, sanctions screening, VPN and geo-spoofing detection, dispute and chargeback investigation.
• Personalize the Services. Recommend picks and games, surface relevant social content, tailor the home dashboard. We do not engage in solely automated decision-making that produces legal or similarly significant effects on you.
• Communicate with you. Send transactional emails, SMS notifications you opt in to, push notifications, in-product banners, and (with consent) marketing communications.
• Improve the Services. Analyze usage to fix bugs, ship new features, and improve our models; conduct A/B testing.
• Comply with law. Respond to subpoenas, court orders, lawful regulatory requests, and tax obligations; cooperate with law-enforcement as required.
• Enforce these terms. Investigate violations of the Terms, House Rules, or Privacy Policy; enforce or defend our legal rights.
• Corporate transactions. In the event of a merger, acquisition, financing, or sale of assets, transfer information to a successor entity subject to this Policy (or one substantially similar).

What we do not do. We do not sell your personal information for money. We do not "share" your personal information for cross-context behavioral advertising without an explicit opt-in or unless required by Applicable Law. We do not train our or any third party's AI models on your User Content or chat messages (see Section 12). We do not use your data for any purpose materially different from the list above without prior notice and, where required, your consent.

Sharing & Disclosure

We disclose personal information only to the categories of recipients listed below and only for the purposes set forth in Section 4.

Every service provider listed above is bound by a written contract that limits their use of personal information to the specific purposes for which we share it, requires appropriate technical and organizational safeguards, and prohibits secondary uses (including selling or sharing for advertising).

Sale, Sharing & Targeted Advertising

We do not sell your personal information for money. We do not currently "share" your personal information for cross-context behavioral advertising. To the extent any future feature would constitute a "sale" or "share" under U.S. state privacy laws, you may opt out at any time.

How to opt out. Use either of the following persistent links, available at the footer of every page on the Services:

• Do Not Sell or Share My Personal Information — submits a CCPA/CPRA opt-out request and disables targeted advertising for your Account.
• Limit the Use of My Sensitive Personal Information — restricts our use of sensitive PI to the purposes enumerated in 11 C.C.R. § 7027(m) (security, anti-fraud, service delivery).

Global Privacy Control (GPC). We honor browser GPC signals as a valid opt-out of sale and sharing for residents of all U.S. states that mandate or permit GPC honoring (California, Colorado, Connecticut, Texas, Montana, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Delaware, and Oregon as of 2026). The signal is honored at the browser level and persists for the session.

Authorized agents. You may designate an authorized agent to submit an opt-out on your behalf. We will verify the agent's authority before acting on the request, except where GPC is in use.

Children. We do not knowingly sell or share for behavioral advertising any personal information of California residents under 16, or of any minor in any state with a higher opt-in threshold (see Section 17).

Cookies, SDKs & Tracking

We use cookies, local storage, mobile SDKs, and similar technologies to operate the Services, remember your preferences, and detect fraud.

Controls. You can clear cookies and local storage from your browser at any time. Doing so will sign you out and reset your preferences. You can opt out of non-strictly-necessary analytics via your Account Settings or by submitting a Do Not Sell or Share request (Section 6).

Payment Information & Stripe

All payment-card data is handled by Stripe, Inc., a PCI DSS Level 1 certified service provider. BookieSlip never receives, stores, or processes your full card number or CVC.

Stripe's processing of your information is governed by its own privacy policy, available at stripe.com/privacy. Stripe is the controller of payment-card data; BookieSlip is the controller of the identity and transaction metadata associated with your Account.

Identity Verification & Biometric Data

To redeem Prize Coins, you must complete identity verification. This involves a biometric comparison of your government-issued photo ID and a selfie you submit. This section is provided in compliance with the Illinois Biometric Information Privacy Act (740 ILCS 14, "BIPA"), the Texas Capture or Use of Biometric Identifier Act (Texas Bus. & Com. Code § 503.001, "CUBI"), the Washington My Health My Data Act (where applicable), and analogous state law.

Geolocation Data

We collect location information to confirm you are in a permitted U.S. state. Precise geolocation is treated as Sensitive Personal Information and is used only for the limited purposes set out below.

Marketing, Email & SMS

We send transactional communications about your Account and, with your consent, marketing communications by email and SMS.

Transactional. Receipts, security alerts, identity-verification updates, bet-settlement notifications, redemption status, and policy changes. These are required to operate the Services and are sent regardless of your marketing preferences.

Marketing email. Newsletters, promotions, feature announcements. You may opt out from any marketing email via the unsubscribe link in the footer, or in Account Settings → Notifications. Opt-out is honored within 10 business days.

SMS / TCPA. If you opt in to SMS programs (e.g., "Prime Time" alerts), you consent to receive recurring autodialed text messages from BookieSlip at the verified phone number. Programs disclose their frequency cap (Prime Time: up to 1 message per day) and their TCPA-required terms at the opt-in screen. Message and data rates from your carrier may apply. Reply STOP to unsubscribe; HELP for assistance. Carriers are not liable for delayed or undelivered messages. Phone numbers and consent timestamps are stored encrypted and retained for at least four years to support TCPA compliance evidence.

No sharing of mobile numbers. Mobile numbers and SMS consent records are collected only to operate the SMS programs you opt in to. Mobile numbers are not shared with third parties or affiliates for marketing or promotional purposes. We do not sell, rent, or share mobile opt-in data with third parties under any circumstances. Twilio acts as our SMS message-delivery processor under a written data-processing agreement and is contractually prohibited from using your number for any purpose other than delivering the messages you opted in to receive.

Push notifications. Controlled by your operating system. You can revoke permission in device settings.

AI Features & Chat Data

The Services include AI-powered features — pick recommendations, chat personas, and terminal-style analysis. This section explains how the AI features use your data.

Data Retention

We retain personal information only as long as needed for the purposes described in this Policy. The table below shows the retention windows by data class.

Legal hold. Where we are subject to a litigation hold, subpoena, or regulatory inquiry, we may retain relevant data beyond the standard windows above until the matter is resolved.

Anonymization. Where we retain data beyond the active windows for analytics or model evaluation, the data is anonymized so that it cannot reasonably be linked to you.

Your Privacy Rights

You have rights under U.S. state privacy laws, exercised through a single privacy request portal. Where state laws differ, we apply the stricter standard to all U.S. residents wherever practical.

How to submit a request. Use the request form linked from Section 21 — Contact or email privacy@bookieslip.com. We respond within 45 days of receipt (extendable once by an additional 45 days with notice).

Verification. Before fulfilling an access, deletion, correction, or portability request, we verify your identity by confirming control of the verified Account email and (for sensitive requests) by matching a recent transaction identifier or by re-verifying KYC. We do not collect more information for verification than we already hold.

Authorized agents. You may use an authorized agent. We require written authorization signed by you (or a power of attorney) before acting on agent submissions, except where a GPC signal is in use for opt-out of sale/sharing.

California Notice (CCPA / CPRA)

This section provides additional disclosures required of California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA").

Categories collected. See Section 2. In the preceding 12 months we have collected categories A, B, C, D, E, F, I, and J as defined in that section. We have not collected categories G or H.

Sources. See Section 3.

Business and commercial purposes. See Section 4.

Categories disclosed. In the preceding 12 months we have disclosed categories A, B, C, D, E, and J to the recipient categories described in Section 5.

Sale and sharing. We have not sold personal information in the preceding 12 months. We have not shared personal information for cross-context behavioral advertising in the preceding 12 months. See Section 6.

Sensitive PI. We use Sensitive PI only for purposes enumerated in 11 C.C.R. § 7027(m): performing the Service, security, anti-fraud, identity verification, brief storage and processing, ensuring physical safety, and maintaining product or service quality. You may exercise the right to limit by following the footer link "Limit the Use of My Sensitive Personal Information."

Your rights. California residents may exercise the rights in Section 14 plus the following: right to know specific pieces of personal information collected; right to know categories of third parties to whom we disclose; right to opt out of sale and sharing; right to limit use of Sensitive PI; right to non-discrimination (no different price or service for exercising rights); right to delete; right to correct; right to portability.

Shine the Light (Cal. Civ. Code § 1798.83). California residents may once per year request the categories of personal information we disclosed to third parties for those third parties' direct-marketing purposes during the prior calendar year. We do not currently disclose personal information for third-party direct-marketing purposes; if that changes, this section will be updated.

GPC. We honor the Global Privacy Control browser signal as a valid opt-out of sale and sharing. The signal is honored at the browser level and persists for the session.

Authorized agents. Authorized agent submissions are accepted with written authorization. No agent is required if you submit a GPC signal yourself.

Minors. California residents under 16 may not have their personal information sold or shared without opt-in consent (or, for those under 13, parental consent). We do not knowingly collect personal information of minors under 21. See Section 17.

Metrics. We will publish annual CCPA request-handling metrics on this page where required by 11 C.C.R. § 7102.

Other State Notices

This section provides additional disclosures required of residents of other U.S. states with comprehensive privacy laws. The universal rights in Section 14 apply across these states; the table below highlights state-specific points.

How to exercise. Use the same portal described in Section 14. We will handle your request under the standard most favorable to you when state rights overlap.

Children & COPPA

BookieSlip is not directed to children. The Services require a minimum age of 21. We do not knowingly collect personal information from anyone under 21.

COPPA (under 13). Consistent with the federal Children's Online Privacy Protection Act and the FTC's COPPA Rule amendments effective April 22, 2026, we do not knowingly collect personal information from children under 13. If we learn we have inadvertently collected such information, we will delete it promptly.

Minors 13–20. Although the Services are not open to anyone under 21, if you believe a minor under 21 has provided us with personal information, please contact us at privacy@bookieslip.com so we can investigate and remove the information.

State minor protections. Where state law (California, Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey, Oregon) imposes opt-in or opt-out protections for residents under various ages (typically 13–17), we apply the higher standard.

Information Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, and destruction. No system is perfectly secure; we describe our program transparently below.

Your role in security. Choose a unique, strong password. Enable available second factors. Sign out of shared devices. Never share your Account credentials. Report any suspected unauthorized access to security@bookieslip.com immediately.

Data Breach Notification

In the event of a security breach affecting your personal information, we will notify you and applicable regulators as required by Applicable Law.

Content of notice. Description of the incident, categories of personal information affected, date or estimated date of the incident, mitigation steps, recommended consumer actions, and a contact channel to ask follow-up questions.

Substitute notice. If individual notice is impracticable due to volume or lack of contact information, we will provide substitute notice as permitted by statute (typically a prominent website notice and notice to major statewide media).

Vendor breaches. Our Data Processing Agreements require service providers to notify us promptly (within 24–72 hours) of any security incident involving our customer data. We will roll up the regulatory and consumer notice obligations and respond on the timeline above.

International Data Transfers

BookieSlip operates exclusively in the United States. The Services are not offered to residents of the European Economic Area, the United Kingdom, Switzerland, or other foreign jurisdictions.

Personal information is stored on servers located in the United States. Some processors may have parent companies or sub-processors located outside the U.S. (e.g., support-team operations or engineering teams), and access to data may occur from those locations under written Data Processing Agreements that mirror U.S. protections. Where such access occurs from the EEA or UK, the processor is bound to the European Commission's Standard Contractual Clauses (2021) and any applicable UK or Swiss addenda.

If you access the Services from outside the United States, you do so on your own initiative and at your own risk, and your information will be processed in the United States subject to U.S. law.

Changes, Contact & Privacy Officer

We update this Policy as our practices evolve and as the law changes. Material changes are communicated by email and an in-product banner at least 30 days before they take effect.

Material vs. non-material. Material changes include any expansion of the categories of personal information collected, new categories of recipients, additional purposes that go beyond the list in Section 4, changes to retention windows, changes to your rights or to the request portal, and any change to AI training, sale, or sharing posture. Non-material changes (typo fixes, clarifying examples, restructured prose) take effect on posting.

Version that governs you. The version of this Policy in effect at the time of any collection or use governs that collection or use. Historical versions are archived and provided on request.

Contact.

Cross-references. See also our Terms of Use, House Rules, Sweepstakes Rules, and Account & Data Deletion page.