Play on - Challenge a Friend - Privacy Policy

Last Updated: October [xxx], 2025

See our Notice at Collection below for a high-level overview of our privacy practices.

Introduction

Papaya Stars Ltd. (“Papaya Stars”, “we”, “our” or “us”) develops and operates a social tournaments platform where players and creators can broadcast content, participate in skill-based games, and share their victories ("App"), as well as our website papayastars.com, its subdomains and its related features (“Website”, and together with the App - “Services” or " Play on – Challenge a Friend").

Papaya Stars is dedicated to protecting your privacy and making our practices regarding your Personal Data (as defined below) more transparent and fair. This Privacy Policy (“Policy”), integrated into and forming part of the Play on - Challenge a Friend Terms of Use, is designed to help you understand how we collect, store, use, process, and share your Personal Data. It also explains your rights and choices with respect to your Personal Data, and how you can contact us if you have any questions or concerns. This Policy applies whenever you visit our Website, install or interact with our App, or otherwise access or use any of our Services.

Please note that certain parts of this Policy may not apply to you, depending on the laws and regulations of your jurisdiction. The Services are designed for players who are at least eighteen (18) years old. However, in some jurisdictions, and at our sole discretion, we may allow players aged sixteen (16) or older but under eighteen (18) to access the Services, provided their parent or legal guardian grants explicit consent to the Play on - Challenge a Friend Terms of Use.

You are not legally required to provide us with any Personal Data, but without it, we will not be able to offer you the full range and best experience of using our Services.

We strongly urge you to read this Policy and make sure that you fully understand and agree to it. If you do not agree to this Policy, please discontinue and avoid using our Services. You have the right to cease using our Services, pursuant to this Policy, at any time.

Specifically, this Policy describes -

1. What types of data we collect?

2. Tracking technologies

3. Why we process your Personal Data?

4. With whom we share your data?

5. Marketing and advertising

6. Your rights

7. Transfer of Personal Data

8. Security

9. Minors

10. Retention

11. Updates to this Policy

12. Controlling version

13. Data protection officer

14. Contact us

1. What types of data we collect?

   We collect Personal Data about you, meaning any information that potentially allows your identification through reasonable means (for example, email address or name) (collectively "Personal Data"). This section sets out how and when we collect and process Personal Data about you.

   • 1. Account Information. If you choose to register an account with our Services, we collect your full name, email address, password, phone number, birthdate and player nickname, as well as voluntary information, such as your profile picture. In certain cases, we may also request proof of identity or age verification by asking you to provide a valid government-issued ID or other documentation to confirm your identity or age. If you choose to log in, access or otherwise connect to the Services through a third-party service (such as Google, Facebook, Apple, Twitter, Instagram, etc.), we may collect your player ID and/or player name associated with that social networking service, as well as any information you make public using that social networking service or that the social networking service allows us to access. In that case you will be bound by the terms and conditions and privacy notices of said third parties. We do not receive or store your passwords for any of these third-party services.
     
     

     If you are under the Age of Majority (as defined below) but at least sixteen (16) years old, we may require additional information about your parent or legal guardian to verify their identity and obtain their explicit consent to allow you to access the Services where required by applicable law. This may include providing a copy of a government-issued ID or other forms of identification to confirm the identity of your parent or legal guardian and their relationship to you.

     
     
     2. Player Content Information: We process the content you create or upload to the Services, such as photos, audio, video recordings and live streaming, comments, hashtags, feedback, reviews, and related metadata such as time, location, and creator information (“Player Content”). To enhance your experience on the Services, we may request permissions to access your device, including your camera, microphone, and files. These permissions enable functionalities such as capturing photos or videos, recording audio, or uploading files. You will have the option to grant or deny these permissions through your device settings, and certain features may not be available if permissions are not granted. This also includes identifying objects that appear in your content, the existence and location and attributes within images and videos, the nature of the audio and the text of any spoken words, including metadata that can describe how, when, where, and by whom the piece of content was created, collected, or modified and how that content is formatted. Additionally, we may collect, in certain cases, biometric identifiers and biometric information, as necessary for identity verification purposes, in accordance with our internal policies. If you are not a player, information about you may still appear in Player Content that others generate or share on the Services. We automatically upload a temporary copy of Player Content as soon as you create, import, or upload it, even if you later choose not to save or publish it, to provide audio suggestions and other personalized recommendations. When effects are applied to your Player Content, we may also collect an unedited version.
     3. Messaging Information. We process information from messages and communications you send or receive through various features of the Services. This includes details you provide when composing, sending, or receiving messages using the Services' messaging channels, including the content of the messages as well as metadata, such as timestamps and participant details. We may review the content of these messages if a user reports, or we otherwise detect, a potential trust and safety violation, potentially illegal or illicit activity, or violations of our Terms of Use, as permitted by applicable laws. Please note that messages you send to other players of the Platform will be visible to those recipients, and we are not responsible for how they choose to use or share such messages.
     4. Payment Information: When you decide to purchase digital items in our App, you will be required to provide us with your billing information. The information you will need to submit, including your bank account and other payment account information, depends on the billing method you choose. For example, if you pay with a credit card, we will collect your card information through a secure third-party processor.
     5. Usage Information: When you use our Services, we collect technical information about your interaction with our Services. Such information may include gameplay recordings and statistics, geolocation data, IP address, unique identifiers (e.g. MAC address and UUID), as well as other information that relates to your activity in the Services.
     6. Contact Information: When you choose to share your experience on our Services or invite friends to join, we collect information such as your contacts' names, phone numbers, email addresses, and public profile details from your phone or social media accounts. Where you provide us with the Personal Data of third parties, such as your friends, it is your responsibility to inform them about the processing of their Personal Data in accordance with this Privacy Policy, and to confirm that they have given their permission.
     7. Communication Information: When you send us an email or contact us via the support in our App or Website, we collect the Personal Data you provide us. This includes your name, email address and any other information you choose to provide, as well as information you provide through participation in our games, challenges, promotions, marketing campaigns, events, or contests.

   If you are under the Age of Majority but at least sixteen (16) years old, we may also contact your parent or legal guardian directly to verify the consent provided and to ensure they understand and agree to the Play on – Challenge a Friend Terms of Use on your behalf. Failure to provide the required verification or obtain valid consent may result in the denial of access to the Services or suspension of your account.

2. Tracking technologies

   When you visit or access our Services, we use cookies, pixels, beacons, local storage and similar technologies ("Tracking Technologies"). These Tracking Technologies allow us to automatically collect information about you, your device, and your online behaviour, in order to enhance your navigation in our Services, improve the performance of our Services, perform analytics, customize your experience, and offer you, for example, tailored content and advertisements that better correspond with your interests. Additionally, to improve our Services and your experience, we personalize your feed based on your preferences and interactions, presenting you with content and updates that are most relevant to you.

   1. What types of Tracking Technologies do we use?

      When you use or access our Services, we use the following categories of Tracking Technologies:

      1. Strictly Necessary Tracking Technologies: These Tracking Technologies are automatically placed on your computer or device when you access our Services or take certain actions on our Services. These Tracking Technologies are essential to enable you to navigate and use the features of our Services. We do not need to obtain your consent in order to use these Tracking Technologies.
      2. Tracking and Advertising Tracking Technologies: These Tracking Technologies collect information about your browsing habits in order to make advertising more relevant to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of an advertising campaign. The Tracking Technologies remember the websites you visit and such information is shared with other parties such as advertisers and/or publishers. Publishers, advertisers, and third-party ad networks may also utilize Tracking Technologies or similar technologies to deliver ads and monitor the performance of such ads. The collection of information through Tracking Technologies by such third parties will be governed by their own privacy policies/cookies policies and principles, which Papaya Stars does not control.
      3. Functionality Tracking Technologies: These Tracking Technologies allow our Services to remember choices you make (such as your language) and provide enhanced and personalized features. For example, these Tracking Technologies are used for authentication (to remember when you are logged in) and support other features of our Services.
      4. Performance Tracking Technologies: These Tracking Technologies collect information about your online activity (for example, the duration of your visit to our Services), including behavioural data and content engagement metrics. These Tracking Technologies are used for analytics, research and to perform statistics (based on aggregated information).
   2. How and by whom Tracking Technologies are stored on your device?

      We store Tracking Technologies on your device when you visit or access our Services (for example, when you visit our Website). Such Tracking Technologies are called "First Party Tracking Technologies". In addition, Tracking Technologies are stored by other third parties (for example, our analytics service providers, business partners, and advertisers), who run content on our Services. Such Tracking Technologies are called "Third Party Tracking Technologies". Both types of Tracking Technologies may be stored either for the duration of your visit on our Services / Website or for repeated visits.

      There are various ways in which you can manage and control your Tracking Technologies settings. You can change your preferences using our cookie settings tool (however, please note that this tool may only be available in certain jurisdictions). Other methods of managing your Tracking Technology preferences include changing your browser settings to send a “Do-Not-Track” signal. In such a case, your browser will send us a special signal to stop tracking your activity. However, please note that certain features of the Website may not work properly or effectively if you delete or disable cookies.

      To learn more about how you can manage your cookies, below is a list of useful links that can provide you with more information:

      1. Google Chrome
      2. Microsoft Edge
      3. Mozilla Firefox
      4. Safari (Desktop)
      5. Safari (Mobile)
      6. Android Browser

      You can learn more about how to turn off certain third-party targeting and advertising cookies by visiting the following third-party webpages:

      1. The Interactive Advertising Bureau (US)
      2. The Interactive Advertising Bureau (EU)
      3. European Interactive Digital Advertising Alliance (EU)
      4. Digital Advertising Alliance
      5. Network Advertising Initiative

      You can withdraw your consent to personalized advertising experience on your device at any time by using your device settings as follows:

      1. On iOS, depending on the applicable iOS version, you may withdraw consent across all Services by either enabling the “Limit Ad Tracking” setting or disabling the “Allow App to Request to Track” permission in your iOS device settings. Depending on the applicable iOS version, instead of withdrawing consent on a device-wide basis, you may also have the option of withdrawing consent on a per-app basis by disabling tracking permission for specific App that appears under the “Allow App to Request to Track” setting in your iOS device settings (precise directions may differ depending on the applicable iOS version).
      2. On Android devices, you may withdraw your consent in the Google Ads settings within your Android settings by enabling the “Opt out of Ads Personalization” setting (precise directions and the name of the setting may differ depending on the applicable Android versions and device manufacturer).
3. Why we process your Personal Data?

   This section explains for what purposes we use your Personal Data and outlines the legal bases or justifications that underlie our usage.

   Purpose and Scope of Collected Data	Legal Basis
   Provision of our Services; support. We use your Personal Data, such as your name and email address, for customer service purposes. This includes, for example, responding to your inquiries.	The legal bases for processing this data are the performance of our contractual obligations towards you; your consent (for example, when you provide Personal Data) where required by law; and our legitimate interests. Our legitimate interests in this case are the provision of our Services and supporting our customers.
   Payments. We collect from our third-party payment processors certain information about your payment instruments for the purpose of connecting your payment instrument to your account on our Services, and sending you statements, invoices, and payment reminders.	The legal bases for processing this data are the performance of our contractual obligations; the protection of our legitimate interests, in this case provision of our Services; and compliance with legal obligations to which we are subject.
   Improve our Services. We collect and analyse information about you and your usage of our Services to improve the usability and effectiveness of our Services.	The legal bases for processing this data are our legitimate interests, in this case – providing and improving our Services.
   Marketing and advertising. We may use automated tools, including Tracking Technologies (which may collect Personal Data) in order to provide you with personalized and non-personalized advertisements when you visit our Services, including personalized and non-personalized advertising as part of your current interaction with us.	The legal bases for processing this data are your consent (when required by law) and our legitimate interests. Our legitimate interests in this case are providing you with tailored services, content and advertisements that better correspond with your interests.
   Integrity and fraud prevention. We may process certain information about you and your use usage of the Service in order to keep the integrity and security of the Services, prevent fraud, identify your identity and enforce our policies.	The legal bases for processing this data are your consent (where required by law), compliance with our legal obligations, and our legitimate interests. Our legitimate interests in this case are keeping the integrity of our Services and the safety of our players.
   Compliance with applicable laws. We process your Personal Data in order to comply with our legal obligation under applicable laws.	The legal basis for processing this data is compliance with our legal obligations and our legitimate interests. Our legitimate interests in this case are compliance with our legal obligations and assisting law enforcement agencies.

4. With whom we share your data?

   We share and disclose your Personal Data as described below:

   • 1. Affiliated companies: We may share Personal Data internally within our parent company, affiliated companies and subsidiaries, for the purposes described in this Policy.
     2. Payment processors: We share your payment information with third-party payment processors, for the purpose of facilitating your payments when using our Services. These third parties may have access to your Personal Data so that are able to perform these tasks on our behalf.
     3. Service providers: We may share your Personal Data with our service providers that provide services on our behalf or help us operate our Services. These companies include those we have hired to provide customer service support, operate the technical infrastructure that we need to provide the services, cloud storage vendors, payment processors, and providers of analytics, email delivery, marketing, and database management services.
     4. Third party advertisers: We may partner with third parties to either display advertising on our Services or to manage our advertising on other websites or apps. Our third-party advertisers may use Tracking Technologies to gather information about your activities on our Services and other websites and apps in order to provide you with advertising based on your browsing activities and interests. For more information, please visit our partners’ privacy policies via the following links: AppLovin, Unity and TikTok.
     5. Third Party Integrations: The Services allow you to integrate with certain third party services, such as in order to connect your Facebook or Apple account to our App or to place purchases, in which case you will be bound by the terms and conditions and privacy notices of said third parties (e.g., Apple, Google or Facebook) – so please make sure that you read and accept them in advance. We do not receive or store your passwords for any of these third-party services.
     6. Compliance with laws and law enforcement entities: We may disclose relevant Personal Data about you to the government or law enforcement officials or private parties when we reasonably believe such disclosure is necessary or appropriate to respond to claims and legal procedures (including but not limited to subpoenas), to protect our or a third party’s property and rights, to protect the safety of the public or any person, or to prevent or stop any activity we may consider to be or to pose a risk of being, illegal, unethical or legally actionable. We may also be required to disclose an individual’s Personal Data in response to a lawful request by public authorities, including meeting national security or law enforcement requirements.
     7. Auditors and advisers: We may share your data with our external auditors, advisors and professional service providers (e.g., lawyers, accountants, insurers) to ensure our compliance with regulatory requirements and industry standards.
     8. Mergers and acquisitions: We may transfer, sell or otherwise share your data in case of entering into a business transaction such as merger, acquisition, reorganization, bankruptcy, or sale of some or all of our assets.
5. Marketing and advertising

   We may use your Personal Data ourselves or by using our third-party service providers for the purpose of providing you with in-app promotional materials concerning the Services as well as products, websites and applications which relate to: (i) affiliated companies, or (ii) Papaya Stars' business partners and affiliates (collectively, “Marketing Affiliates”), which we believe may interest you.

   You may at any time decline receiving further marketing offers from us or from our business partners and Marketing Affiliates by contacting us at Privacy@papayastars.com. Please note that even if you unsubscribe from our marketing mailing list, we may continue to send you in-app service-related updates and notifications.

6. Your rights

   Depending on the jurisdiction in which you reside, you may have certain rights under relevant applicable laws regarding the collection and processing of your Personal Data. To the extent these rights apply and concern you, you can contact us via the contact details available below and ask to exercise the following rights.

   • 1. Rights of access to your Personal Data: You have the right to receive confirmation as to whether or not Personal Data concerning you is being processed, and access your stored Personal Data, together with supplementary information.
     2. Right of data portability: You have the right to request us to move, copy and transfer your Personal Data easily from one IT environment to another, in a safe and secure way, without affecting its usability.
     3. Right of rectification: You have the right to request rectification of your Personal Data in our control in the event that you believe the Personal Data held by Papaya Stars is inaccurate, incomplete or outdated.
     4. Right of deletion/erasure: You have the right to request that Papaya Stars erase or delete Personal Data held about you at any time.
     5. Right to restriction or objection to processing: You have the right to request that Papaya Stars restrict or cease to process Personal Data.
     6. Right to withdraw your consent: To the extent we process Personal Data based on your consent, you have the right to withdraw your given consent at any time.
     7. Right to limit use and disclosure of your sensitive Personal Data: You have the right to request to limit the collection of your sensitive Personal Data, to only such data that is necessary to perform our Services.
     8. Right not to be subject to automated decision making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects to you.
     9. Right to opt-out of the sale or share of Personal Data for interest-based advertising: We may share information with third-party advertising partners and allow them to collect information about your use of the Services, in order to show you ads as described in the “Tracking Technologies” section above. Our disclosure of information to these partners may be considered a “sale” or “sharing” of Personal Data under applicable laws. You have the right to request to opt out of these disclosures by contacting us at: Privacy@papayastars.com. Please note that your opt out will be specific to the device and browser you use when you opt out. We do not have actual knowledge that we have sold or shared the Personal Data of children under the age of 16. After you opt-out, we may continue disclosing some Personal Data to our partners to help us perform business-related functions such as, but not limited to, providing the Services, ensuring that the Services are working correctly and securely, providing aggregate statistics and analytics and preventing fraud.
     10. Right to non-discrimination: You have the right to be free from any discrimination for exercising your rights, such as offering you different pricing or products, or providing you with a different level or quality of services, based solely upon your request. 
     11. Right to content removal: If you are a California resident under the Age of Majority and over the age of Sixteen (16), you have the right to request the removal of any Player Content you have posted on the Services. You can exercise this right by contacting us at privacy@papayastars.com.

   Prior to responding to your requests, we may verify your identity by matching any identifying information you provide against the information we have about you.

   Please note that these rights are not absolute and may be subject to our own legitimate interests and regulatory requirements. You are welcome to contact us for any questions or requests through our contact details below. We will make an effort to reply within a reasonable timeframe. Please feel free to reach out to us at any time. If you are unsatisfied with our response, you can lodge a complaint with the applicable data protection supervisory authority or appeal our denial of your request by contacting us as set out in the “Contact Us” section below.

7. Authorized agent

   Depending on your jurisdiction, you may designate an authorized agent to make a request on your behalf. We will require authorized agents to confirm their identity and authorization to act on your behalf, in accordance with applicable laws.

Depending on your jurisdiction, you may designate an authorized agent to make a request on your behalf. We will require authorized agents to confirm their identity and authorization to act on your behalf, in accordance with applicable laws.

8. Transfer of Personal Data

   We operate globally. Any information that we collect, disclose or share, including your Personal Data, can be stored and processed in various jurisdictions around the world, including (but not limited to) the European Economic Area, United Kingdom and United States, for the purposes detailed in this Policy.

   To the extent that the GDPR or the UK GDPR is applicable, we will only transfer or share your Personal Data to data recipients:

   1. located in the EEA or in the UK;
   2. located in non-EEA countries or the UK that have been approved as providing adequate level of data protection; or
   3. who have entered into legal agreements ensuring an adequate level of data protection.
9. Security

   We have implemented administrative, technical, and physical safeguards to help prevent unauthorized access, use, or disclosure of your Personal Data. While we seek to protect your information to ensure that it is kept confidential, we cannot guarantee the security of any information. You should be aware that there is always some risk involved in transmitting information over the internet and that there is also some risk that others could find a way to thwart our security systems. Such breaches can lead to things such as reputational harm, fraud or identity theft. Therefore, we encourage you to exercise discretion regarding the Personal Data you choose to disclose. If you feel that your privacy was not treated in accordance with our Policy, or if any person attempted to abuse the Services or acted in an inappropriate manner, please contact us directly via our contact details available below.

10. Minors

    The Services are intended solely for players who are at least eighteen (18) years old and can form a legally binding contract under applicable law ("Age of Majority"). In certain jurisdictions, at our sole discretion, we may permit players who are under the Age of Majority but at least sixteen (16) years old to access the Services, provided that their parent or legal guardian consents to the Play on – Challenge a Friend Terms of Use and this Policy. Additionally, in specific jurisdictions, we may, at our sole discretion, implement further measures or requirements to ensure compliance with applicable laws and regulations regarding consent or age restrictions.

    Under no circumstances are players under the age of sixteen (16) permitted to use the Services. Any registration, use, or access to the Services by anyone under the Age of Majority without appropriate parental or guardian consent is unauthorized and constitutes a violation of Papaya Play on - Challenge a Friend's Terms of Use.

    We reserve the right to request proof of age or parental/legal guardian consent at any time. We may suspend or block access to the Services if we suspect that a user does not meet the applicable age requirements. If we become aware that we have inadvertently collected Personal Data from a player under the Age of Majority without proper consent, we will deactivate the account and take reasonable steps to delete the information promptly. If you believe that we might have any information from or about an individual under the Age of Majority, then please contact us through Privacy@papayastars.com.

    We encourage all parents, guardians, and adults to guide individuals under the Age of Majority in understanding the importance of not sharing Personal Data online without permission.

11. Retention

    We will retain your Personal Data for as long as necessary to provide our Services, and as necessary to comply with our legal obligations, resolve disputes, and enforce our policies. Retention periods will be determined to take into account the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable time.

12. Updates to this Policy

    We reserve the right to change this Policy at any time. The most current version will always be posted on our Services (as reflected in the “Last Updated” heading). You are advised to check for updates regularly. By continuing to access or use our Services after any revisions become effective, you agree to be bound by the updated Policy.

13. Controlling version

    This Policy has been drafted in the English language, which is the original and controlling version of this Policy. All translations of this Policy into other languages shall be solely for convenience and shall not control the meaning or application of this Policy. In the event of any discrepancy between the meanings of any translated versions of the Policy and the English language version, the meaning of the English language version shall prevail.

14. Data protection officer

    Papaya Stars has a “Data Protection Officer” who is responsible for matters relating to privacy and data protection. If you have any questions about this Policy, please contact our Data Protection Officer (the contact details are available in the "Contact Us" section).

15. Contact us

    For any questions regarding this Policy or the Services, please contact us at Privacy@papayastars.com. Depending on the details of your inquiry, Papaya Stars may request additional information to ensure your issue is addressed appropriately.

Notice at Collection

While you should read the Privacy Policy in its entirety, the following summarizes our practices currently and during the past 12 months regarding the categories of Personal Data that we collect and how we use them. We retain your Personal Data as described in the “Retention” section of our Privacy Policy.

*As described further in our Privacy Policy, we may disclose all categories of Personal Data to our service providers, affiliated companies, and professional advisors for the purposes described in the Privacy Policy. We also may disclose Personal Data to authorities and others for legal and compliance purposes, and business transferees in the context of an acquisition or the sale of our business or another corporate transaction.