Privacy policy

This Privacy policy (the "Policy") sets out how the Operator ("we", "us" or "our"), the company named in clause 2.1 that runs the Service under the Peeks name, collects, uses, discloses, keeps and protects Personal Data in connection with the Service, and the rights that you, as the person the Personal Data is about, may exercise over it.

This Policy forms part of the Terms of service (the "Terms"). Capitalized words that this Policy does not define have the meanings the Terms give them, including Access Code Account, Account, AssetPay, Balance, Bet, Cashier, Daily stake limit, Deposit, Deposit limit, Fun play, Game, Launch Date, Levels, Loss limit, Masking Tool, Maximum Payout, Network Check, Operator, Originals, Play break, Restricted Territory, Round, Seeds, Self-exclusion, Service, Session reminder, Site, Skins, Steam, Step-up Check, Studio, Studio games, Support, Time limit, Tip, Trade hold, Trade URL, Vault, Verifier, Winnings and Withdrawal. If this Policy and the Terms conflict on a question about Personal Data, this Policy governs.

In this Policy:

• "Aggregated Data" means totals and statistics drawn from the data of many people that identify none of them;
• "Anonymized Data" means data altered so that no one can be identified from it, whether on its own or together with other information reasonably available;
• "Campaign Attribution" means the setting, which we can switch on or off for the whole Site, under which we record with a new Account the source, medium and campaign named in the link through which its holder reached the Site and the page on which they arrived, as clause 5.3 describes;
• "Controller" means the person that decides why and how Personal Data is Processed, whom Law 8968 calls the party responsible for the database (responsable de la base de datos);
• "Law 8968" means Costa Rica's Law 8968 on the protection of persons with regard to the processing of their personal data (Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales), together with its Regulation, Executive Decree No. 37554-JP;
• "Personal Data" means information about a living individual who is identified, or who can be identified from that information alone or combined with other information we hold, such as a username, an email address, a network address or a record of activity on the Service;
• "PRODHAB" means the Agency for the Protection of the Data of Inhabitants (Agencia de Protección de Datos de los Habitantes), the Costa Rican authority that oversees compliance with Law 8968;
• "Processing" means anything done with Personal Data, by automated means or otherwise, including collecting, recording, arranging, storing, reading, using, combining, disclosing, restricting and deleting it, and "Process" is read accordingly;
• "Product Event Tracking" means the setting, which we can switch on or off for the whole Site, under which we record Product Events;
• "Product Events" means the records of the use of the Site that clause 5.10 lists;
• "Profiling" means the use of Personal Data by automated means to evaluate or predict something about a person, such as the games a player is likely to choose, whether an Account may be used for fraud or whether its holder may be at risk of gambling harm;
• "Recipient" means anyone to whom we disclose Personal Data, a Service Provider included;
• "Security Breach" means a breach of security that results in Personal Data being destroyed, lost, altered, disclosed or reached without authority;
• "Sensitive Data" means Personal Data that touches the private sphere of a person, as Law 8968 uses that idea, such as data showing racial origin, political opinions, religious or spiritual convictions, socioeconomic condition, biomedical or genetic information, or sex life and sexual orientation, together with biometric data used to identify someone and any other data that Applicable Law treats as sensitive;
• "Service Provider" means a person or company that Processes Personal Data on our behalf and only on our instructions;
• "Transfer" means a disclosure of Personal Data to a Recipient other than a Service Provider, or the sending of Personal Data to another country;
• "Verification Level" has the meaning given in the Terms: one of the four levels of identity verification, numbered 1 to 4, set out in the Identity verification policy.

We Process Personal Data in accordance with Law 8968 and with every other data protection law that applies to a particular Processing activity. Where the law of the country you live in grants you a protection that this Policy does not mention, we extend that protection to you to the extent that law requires.

This Policy is written in English. If we publish it in another language, the English text prevails over the translation wherever the two differ.

By opening an Account you confirm that you have read this Policy and consent to the Processing it describes where consent is the basis for that Processing. Several other documents describe Processing linked to the subjects they govern, and you should read them with this Policy: the Cookie policy, the Restricted countries and VPN policy, the Identity verification policy, the Anti-money laundering policy and the Responsible gambling policy.

The laws of the Republic of Costa Rica govern this Policy. That choice does not take away any protection that the law of the country you live in gives you and that cannot be excluded by agreement.

If you do not accept the Processing that this Policy describes, do not use the Service and do not give us Personal Data. A visit to the Site without an Account involves only the Processing described in clause 5.20, which we carry out on grounds in section 8 that do not depend on consent. Browsing the Site is not consent. Where this Policy relies on your consent, we ask for it through a separate action, which we record as clause 8.7 describes.

When we collect particular Personal Data, for example at an identity check, when you link a Steam account, in live support or in an Early Access application, the Site or the Discord bot may show a short notice about that collection. Each such notice forms part of this Policy and, where it is more specific, prevails over this Policy for that collection.

If a court or a competent authority finds any part of this Policy invalid or unenforceable, that part applies only to the extent the law permits, and the rest of this Policy stays in force. The general provisions of the Terms, including those on notices, waiver and assignment, also apply to this Policy.

3-102-136856 Limitada, trading as Peeks Entertainment Limitada, is the Operator and the Controller of the Personal Data covered by this Policy. It is a company organized under Costa Rican law with corporate identity number (cédula jurídica) 3-102-136856, whose registered address is Provincia 06 Puntarenas, Canton 11 Garabito, Jaco, Costado Este De La Municipalidad Garabito, Bufete Sanchez Chavarria, 61101, Costa Rica.

We provide the Service under the Peeks name on peeks.gg and its subdomains. The Company and license page gives details of the company and of the license under which it operates.

Our privacy officer oversees how we apply this Policy and the law, keeps the records this Policy describes, and deals with requests and complaints about Personal Data. You can write to the privacy officer through Support or at support@peeks.gg, marked for the attention of the privacy officer.

You may also raise any matter covered by this Policy with Support, through live support messages on the Support page, which is open to you whether or not you are logged in, or by email to support@peeks.gg. Support refers every request about Personal Data to the privacy officer.

This Policy applies to Personal Data that we Process when you:

• visit the Site, whether or not you are logged in;
• open, use, verify or close an Account, including an Access Code Account;
• play Originals or Studio games, in Fun play or with real money;
• make Deposits and Withdrawals, including Skins through AssetPay, use the Vault, or send or receive a Tip;
• set a Loss limit, a Daily stake limit, a Deposit limit, a Time limit or a Session reminder, or take a Play break or Self-exclusion;
• contact Support through live support, whether or not you are logged in, or by email, ask from the log-in window for help with a password reset, or contact us through any other channel;
• write to us, or mention us, on a social media account that we run, in which case we receive your profile name and picture, the other details your settings allow us to see and the content of your messages;
• join the waitlist on the pre-launch page of the Site;
• join the Peeks server on Discord, apply there for Early Access or open a ticket with the server's bot;
• receive an email from us.

Parts of this Policy apply to visitors who do not hold an Account. Clause 5.20 sets out what we Process about them.

This Policy does not cover Processing by third parties that decide for themselves why and how they Process Personal Data, such as Steam, Discord, AssetPay for its own services, the Studios for their games and the platforms that host our social media accounts, or by the owners of websites the Site links to. Their own privacy policies govern that Processing, as section 24 explains.

This Policy does not cover Personal Data of our staff and contractors Processed in connection with their work for us.

This Policy also covers Personal Data of people who deal with us in the course of business, such as staff of our suppliers, partners and Studios, and of people who apply to work with us.

We apply the following principles to all Processing:

• lawfulness and consent: we Process Personal Data only on a basis the law recognizes, and we tell you about it before or when we collect it;
• fairness and transparency: we Process Personal Data only in the ways this Policy makes known to you, and we tell you before a change to that Processing applies to you;
• purpose: we collect Personal Data for the purposes stated in this Policy and do not later use it for an unrelated purpose without telling you and, where needed, asking you;
• minimization: we collect only what each feature needs, and we store a one-way code instead of the data itself wherever a code does the job; because such a code can be matched to what it was made from, we still treat it as Personal Data;
• accuracy: we keep Personal Data accurate and up to date, and correct it when we learn that it is wrong;
• limited retention: we keep Personal Data no longer than section 14 allows;
• security and confidentiality: we protect Personal Data as section 15 describes, and our staff keep it confidential;
• privacy in design: when we build or change a feature, we assess its effect on privacy, and we use pseudonymous references, one-way codes and encryption to limit the identifying data that each part of the Service holds;
• accountability: we keep records that show how we meet these principles.

This section lists the categories of Personal Data we Process, how we obtain each and how we store it.

Account data. When you open an Account we collect:

• your email address, which you can confirm by following a link we send to it;
• your username, made of 3 to 20 letters, numbers or underscores, which you may change once every 30 days, and the record of its changes;
• your password, which we never store in readable form: we keep only a one-way hash of it produced with the scrypt function;
• your confirmation that you are 18 or older, with the time you gave it, and the version of the Terms you accepted;
• any referral code you enter at sign-up, and the record of how you found us that clause 5.3 describes;
• an internal account identifier, a separate public identifier for your profile page, the date your Account was opened and its status, including any suspension.

How you found us. When you open an Account, we record how you found us:

• any referral code you enter at sign-up or that reaches us with the link you followed, as clause 8.10 of the Cookie policy describes;
• the code of the tracking link, if any, that brought you to the Site, whether we made it for a campaign of our own or gave it to a partner, with the time of the visit on which you followed it;
• the partner, if any, to whom the referral code belongs or, where you used no referral code, to whom the tracking link belongs;
• while Campaign Attribution is switched on, the source, medium and campaign named in the link through which you reached the Site and the landing page, meaning the page of the Site on which you arrived, with the time of that visit; and
• whether a referral code, a tracking link or a campaign brought you, or none of them.

We take the tracking link and the campaign details from the first link carrying them that you followed in the same browser in the 30 days before you opened your Account. We make the record once, when your Account is opened, and we do not change it afterwards. While Campaign Attribution is switched off, we record no source, medium, campaign or landing page, and any that the link carried are discarded when you open your Account.

Identity data. At Verification Level 1, on the Verification tab of the Settings page, you give us your first name, last name, date of birth, street address, city, state or region, country and postal code. The date of birth must show an age of at least 18, or the higher minimum age that we apply to the country you give or to the country you connect from. We store your first name, last name and country encrypted with a key held on our servers. Your date of birth and address are sealed with a separate key: our servers hold only its public part, so the Site cannot read them back once saved, and they can be opened only with the matching private key, which is kept apart from the servers that run the Site. You cannot change these details yourself once you have given them: a correction needs a request to Support and, once verification beyond Verification Level 1 begins, evidence.

Identity documents. Verification Levels 2 to 4 are carried out through the Identity Partner and are not yet available. When they open, they may ask for an identity document, a live check of your face, proof of address and evidence of the source of your funds or wealth, as the Identity verification policy sets out level by level. Our systems are built to receive from the provider the outcome of each check, whether you are an adult and your country, together with the reference the provider gives the check, the kind of document checked, the country that issued it and its expiry date, and the provider's findings on whether the document is genuine, current and readable and, where a face check applies, how closely your face matches the photograph and whether the face shown was that of a live person. Where the provider also sends the details read from your document, such as its number and the name and date of birth it shows, we seal them in the way clause 5.4 describes and use the date of birth to confirm that you meet the minimum age; a document that shows you below it holds the check for review by our staff. If a level includes a live check of your face, the provider compares your face with the photograph on your identity document; that comparison involves biometric data, which the provider Processes for us only with your express consent. The provider establishes whether your document is genuine, whether it matches the details you gave at Verification Level 1 and, where a face check applies, whether your face matches its photograph, using automated tools and, where those cannot settle the question, its own reviewers. We do not receive the biometric template made from your face. Where the Site asks you to upload a document yourself, such as an identity document, proof of address or evidence of the source of your funds, it accepts PDF, JPEG or PNG files of up to 10 MB and seals each file with a public key in the same way, so that the Site cannot read it back. Where it asks you about the source of your funds, it seals in the same way your occupation, the type of your employment, the range of your income and the range of the funds you declare. Where a check needs a fix, we keep the reason recorded for it, such as a blurry photo, an expired document, a selfie or a name that does not match, or a document that could not be checked, and the Verification tab of the Settings page shows you what to do next. If a check fails or does not match your details, we may limit what you can do with your Account, as the Identity verification policy sets out, until a member of our staff has reviewed the result, and you may send other documents or ask for that review.

Security data. To protect your Account we Process:

• the secret of any authenticator app you add for two-step login, stored encrypted, and your recovery codes, stored only as one-way hashes;
• for each passkey, its public key, credential identifier, label, device type, backup status, signature counter and the time it was last used; the private key never leaves your device;
• session records, holding a one-way hash of the session token, the identifiers of the Account and the session, the way you logged in, the times the session began, was last active and will end, and when and why it ended; each record can also hold the country of your connection (and its region, if we switch on recording of it), the type of your device (desktop, phone, tablet or other) and the families of its operating system and browser, which we read from the user agent your browser sends without keeping the user agent itself, a keyed one-way code of your network address instead of the address itself and, where the Network Check runs, the kind of network it found, such as a VPN, a hosting network or Tor;
• records of security events, such as each login, with the way it was made, and each log-out, a change of email address, password, two-step login or passkey, a passed or failed Step-up Check, and the ending of a session because you logged in somewhere else (an Account has one live session at a time).

Network data. While the Network Check described in section 9 is switched on, we read your IP address for it when you sign up, log in, enter an access code, make a Deposit or request a Withdrawal, Skins included, and, while you are logged in, when you visit the Site. The Network Check Processes:

• your IP address;
• the country linked to the address by our lookup provider or, where the provider gives none, by Cloudflare;
• the time zone your browser reports and the time zone of the network you are using, as given by our lookup provider or, where the provider gives none, by Cloudflare;
• whether the address belongs to the Tor network (which Cloudflare also reports), a VPN, a proxy, a hosting network or a relay service such as iCloud Private Relay, and, if a lookup provider is switched on and is consulted, the summary it returns, which may include the name of a VPN service and a risk score or confidence value;
• for a sign-up the check refuses, the username that was entered, and for an access code entry it refuses, the identifier of the code.

Whether or not the Network Check is switched on, we also read the country that Cloudflare links to your network address when you sign up, give the details of Verification Level 1, play, send a Tip, make a Deposit or request a Withdrawal, so that we can apply our rules on Restricted Territories as clause 9.1 describes, and the country read when you log in is kept with your session record.

Rate limits and device type. We limit how often actions on the Service can be repeated, such as logging in, registering, recovering an Account, writing to Support, using the Cashier, placing Bets and sending Tips. The counters behind these limits hold a one-way code made from the action and from your network address, the email address or username you typed, your account identifier, the guest chat concerned or the random identifier that the peeks_device cookie holds for your browser, rather than the address, email address, username or identifier itself. Because such a code can be matched to what it was made from, we treat it as Personal Data. When you open a Studio game we read the device type your browser reports so that the phone or desktop version opens; we do not store that reading with the game, although each session record keeps the type of your device as clause 5.6 describes. We do not collect the precise location of your device, and we do not identify your device from the characteristics of your browser or hardware, a technique known as fingerprinting. Cloudflare, which protects the Site for us, examines characteristics of your browser and connection when it checks whether a visit comes from a person or from an automated tool, and may set the cookies listed in clause 23.4; it does so only to protect the Site.

Technical data. Every request your browser sends to the Site travels through Cloudflare to our servers and carries your network address, the address of the page or file requested, the time and the description your browser gives of itself (its user agent). We use technical data to deliver the Site, keep it secure, find and fix faults and investigate misuse.

Product Events. While Product Event Tracking is switched on, the Site records these Product Events, whether or not you are logged in:

• the pages you visit;
• the lobby rows you see, with the Games shown in each and their positions;
• the game tiles you click or tap, with the row, the position and the Game of each;
• the searches you make, with the number of results each one found but never the words you typed;
• the games you open, and whether you chose Fun play or real money;
• when you start and finish signing up for an Account;
• when you start a Deposit or a Withdrawal, with the method you chose;
• when you open the Verifier, with the Game concerned; and
• when you add or remove a favorite, with the Game concerned.

Each Product Event holds its name, the page on which it happened, the details listed above, the time it happened and the time we received it, the type of your device (desktop, phone, tablet or other), the country linked to your network address and, if you are logged in, your Account. So that the Product Events of one browser can be counted together, the Site keeps a random identifier for your browser in a first-party cookie, as clause 23.2 describes, and each Product Event holds a keyed one-way code made from that identifier instead of the identifier itself. Product Events hold no network address, no amount and nothing you type. While Product Event Tracking is switched off, the Site records no Product Events.

Play data. When you play we record:

• for each Bet on an Original: the Game, the stake, the options you chose, the result, the payout, the time, the hash of the server seed, your client seed, the nonce and the version of the Game's rules;
• for each Studio game you open while logged in: the Game, whether you chose Fun play or real-money play, and the time;
• for each real-money Round of a Studio game: the Game, the Studio, the stake, the win, the Round reference the Studio supplies and the times the Round began and settled;
• the number of real-money Rounds you play on each Studio game on each day;
• your entries in the lists of top wins kept for each Studio game, which hold your Account, the Bet and the win;
• your progress through the Levels, which is based on the total you have wagered;
• statistics drawn from your play, such as your number of Bets, the total wagered and the highlights shown on your profile;
• the Originals and Studio games you mark as favorites while logged in, with the time you marked each Original, and the time you last played each Original;
• any report you make that a Studio game did not work in Fun play, with the reason you chose, together with a short-lived record of the Studio games you open in Fun play while logged in, which shows whether a report concerns Fun play or real-money play.

Rounds of Originals played in Fun play are worked out in your browser and are not recorded against your Account. The server seed behind your Bets on an Original is stored encrypted until it is revealed, after which you can check every result with the Verifier.

Balance and transaction data. Every change to your Balance is recorded as an entry in an accounting journal, which shows the amount, the reason, the time and the Balance afterwards. This covers:

• Deposits and Withdrawals, with their amounts, method, status, references and times;
• money moved to and from the Vault, and any lock you place on it;
• Tips you send and receive, with the other player's username, the amount, the time and whether the Tip was marked public, and the notice of each Tip you receive, with the time you first read it;
• corrections, refunds, reversals and any debt a reversal creates.

These records make up your transaction history, which you can view and export. If AssetPay reports that digital currency linked to your Steam account has been sent to us, we record the Steam ID, the amount and the status it reports; that amount is never added to your Balance, and our staff deal with it as the Anti-money laundering policy provides.

Steam and Skins data. If you link a Steam account to deposit or withdraw Skins, we Process:

• your Steam ID, which Steam returns to us when you sign in through Steam;
• the name and avatar shown on your public Steam profile;
• your Trade URL, stored encrypted apart from its partner number, which is drawn from your Steam ID and reveals nothing beyond it;
• whether your Steam account can trade, any Trade hold, trade probation or number of days for which Steam holds its trades, any VAC ban, game ban or economy ban reported for it, and the times at which these were last checked;
• the Skins you deposit or withdraw, their prices, the trade offers and their status, and the time of each step;
• for each Skins Deposit or Withdrawal you ask for, the session in which you asked, how you confirmed the request, the user agent of your browser and a one-way code made from your network address, and for a Skins request we refuse, the session and that code, which we keep to investigate disputes and fraud;
• the history of linking, unlinking and changing your Steam account or Trade URL, with the Step-up Check each change requires.

We never ask for, receive or store your Steam password, your Steam Guard codes or your Steam API key. You can unlink your Steam account once no trade is open. After you unlink it, we keep your Steam ID, its profile details, the results of our checks on it and its link history, and that Steam account cannot be linked to another Account until our staff release it; they do not release it from an Account that is suspended or that has been under a Play break or a Self-exclusion.

Safer play data. We Process the Loss limits, Daily stake limit, Deposit limit, Time limit, Play break and Self-exclusion you set, with their start and end times, any change waiting to take effect and every change to them; while a Time limit is set, the time you have played in its current period, which our servers count from the times of your real-money Bets; any Deposit that is held apart from your Balance because it arrived during a Play break or Self-exclusion, over a Deposit limit or while your Account was suspended or restricted; and any suspension or other restriction our staff apply to your Account to protect you, as clause 21.2 describes. Session reminders are kept in your browser. Your answers to the self-assessment are not saved or sent to us.

Communications. We keep:

• the messages you exchange with our staff through live support, with their times; while a conversation is open, brief signals showing whether either side is typing or has the conversation in view; and how far each side has read the conversation, with the time;
• notes that our staff add to a conversation with you, which only staff can see;
• for live support used without logging in: any topic and Game you choose, your messages, a one-way code made from your network address and a one-way code of the random token in the peeks_sg cookie, which links the conversation to your browser; if you log in from that browser within two hours of last using a conversation and accept the offer to move it, it moves into your Account;
• a request for help with a password reset that you send from the log-in window without logging in, which holds the email address you enter and becomes a support conversation that our staff answer by email;
• emails you send us and our answers;
• messages you send us, and posts in which you mention us, on a social media account that we run;
• the emails we send you, while they wait in our sending queue;
• on the Peeks Discord server: Early Access applications, which hold your Discord user ID and username, the date your Discord account was created, the date you joined the server, your answers to the application questions and the result of the review; transcripts of tickets opened with the server's bot, including any Peeks username or Bet, Game or transaction reference you give, which are posted to a channel that only staff can see and sent to you as a direct message; any bar on opening tickets that our staff place on you, with your Discord user ID, the member of staff, the reason given and the time; and the staff moderation log, which records each Early Access decision with its reason and each change to a bar on tickets.

We do not offer support by telephone and we record no calls.

Profile and settings. We store your choices for Public profile, Public stats and Tip notifications, which are on when you open an Account and which you can change in Settings. Your Account accepts Tips but not Tips marked public; if the Site offers a setting to change either, we store your choice. Your display preferences are kept in your browser.

Pre-launch data. If you joined the waitlist, we hold the email address you gave and the time you joined, so that we can tell you once when the Service opens. If you hold an Access Code Account, we hold a one-way code of the access code, any label we gave it, the time it was used and the Account it opened. An Access Code Account opened before we began asking for an email address carries a placeholder address until you finish it with an address you can receive mail at.

Assessments and case records. We keep what we conclude about an Account and the records behind those conclusions: flags and alerts concerning fraud, money laundering, multiple Accounts, misuse of Tips, reversed trades and gambling harm, and any risk rating given to an Account; the results of any sanctions and politically exposed person screening; notes that our staff add to a support conversation, which are not shown to you; any suspension or other restriction our staff place on an Account, with the reasons for it; and the file of each investigation or review. These records are Personal Data, and you may ask for them under section 17, subject to clause 17.4.

Personal Data about other people. Where you pass us Personal Data about another person, such as in a report on another player or in a complaint, you must have the right to share it, and we use it only to deal with the matter you raised.

Visitors without an Account. If you use the Site without logging in, we Process: the technical data described in clause 5.9; the one-way codes used for rate limits; the content of any live support conversation or password reset request, as clause 5.15 describes; a one-way code made from your network address and the date if you report that a Studio game did not work in Fun play; the country that Cloudflare links to your network address, which we read to apply our rules on Restricted Territories; while Product Event Tracking is switched on, the Product Events described in clause 5.10, which then hold no Account; and, if the Network Check refuses a sign-up, a login or an access code entry, the record described in clause 9.3, which holds a keyed one-way code and the prefix of your network address and the signals found. The Network Check does not check your visits while you are not logged in. Cloudflare Processes your network address on every request, as it does for all visitors. Favorites and preferences you set while logged out stay in your browser. A referral code, a tracking link or campaign details in a link you follow are recorded by us only if you go on to open an Account, as clause 5.3 describes.

Cookies and browser storage. We set the cookies the Service needs to work and, while they are in use, the cookies for Product Events and for how you found us, and we keep some preferences in your browser, as section 23 and the Cookie policy describe.

What we do not collect. We do not:

• seek Sensitive Data, except where identity checks or our anti-money laundering duties require it, for example evidence of the source of your funds;
• ask for, or check, your criminal record;
• collect payment card numbers or bank account details, because the Service does not take card or bank payments;
• collect the precise location of your device;
• use advertising identifiers, third-party analytics or advertising tools;
• ask for your Steam password, Steam Guard codes or Steam API key.

The records we make of suspected fraud, money laundering or other offenses, and the results of sanctions screening, serve only the purposes in clauses 7.8 and 7.14, and only staff whose role requires it can see them. If you include Sensitive Data in a message to us, for example about your health, we Process it only to deal with your message and to protect you, as clause 21.3 explains.

If you do not provide Personal Data. You are not obliged to give us Personal Data, but some features cannot work without it. We cannot open an Account without an email address, a username and a password; we cannot let you play without your confirmation of age; and we cannot pay a Withdrawal or keep your Account open when the law or the Terms require identity checks that you decline to complete.

Keeping data accurate. You must keep your Personal Data accurate and up to date. You can change your email address and username in Settings and ask Support to correct anything else. Giving us false or incomplete details, or the details of another person, is a breach of the Terms, and we may then restrict, suspend or close the Account as the Terms provide; we keep a record of the details given and of the steps we took.

We obtain most Personal Data directly from you, when you fill in a form, change a setting, place a Bet, make a transaction or write to us.

Some Personal Data is generated as you use the Service, including session records, security events, play records, journal entries, the network data in clause 5.7, the technical data in clause 5.9, the Product Events in clause 5.10 while Product Event Tracking is switched on, and the records in clause 5.18.

The link through which you reach the Site can carry a referral code, the code of a tracking link and campaign details, placed in it by us or by the partner or other person who shared it. We take them from the link, and keep them only as clause 5.3 describes.

We also receive Personal Data from third parties, as follows:

• Steam, operated by Valve Corporation: your Steam ID when you sign in through Steam, and the name and avatar on your public Steam profile;
• AssetPay: the Skins in your inventory that it accepts, their prices, the results of its checks on your Trade URL and trade status, including Trade holds, trade probation and any VAC, game or economy ban, the progress and result of each trade, and any digital currency it reports as sent to us;
• the Identity Partner, once Verification Levels 2 to 4 open: the outcome of your checks, whether you are an adult, your country and the other results described in clause 5.5;
• our lookup provider, if one is switched on, which is one of IPQualityScore, IPinfo, ipapi.is and MaxMind: whether your network address belongs to the Tor network, a VPN, a proxy, a hosting network or a relay service and, depending on the provider, the network's country and time zone, the name of the VPN service and a risk score or confidence value;
• Cloudflare: the country and time zone linked to your network address, and whether the address belongs to the Tor network;
• the Game Aggregator and the Studios that supply Studio games: the stakes, wins and references of the Rounds you play;
• Discord: your Discord user ID, username, account creation date and server join date, when you apply for Early Access or open a ticket;
• the platforms that host our social media accounts: your profile name and picture and the other details your settings allow us to see, when you write to us or mention us there.

We download public lists of Tor exit nodes, of VPN and hosting networks and of relay services, and compare your network address with them on our own servers. Your address is not sent to the publishers of those lists.

Other players give us Personal Data about you when they choose you as the recipient of a Tip or report your conduct to us, including through the Discord server.

A person who is not a player may contact us about a player, such as a relative worried about the player's gambling or someone with legal authority to act for the player. We record what that person tells us and their contact details, and use them only to protect the player and to reply. We do not reveal who raised a concern where that could put anyone at risk, and we give that person the player's Personal Data only with the player's agreement or on proof of legal authority to receive it.

We may check your details against sanctions lists and lists of politically exposed persons and of their relatives and close associates, at the times that clauses 10.5 and 11.3 of the Anti-money laundering policy describe, such as when you give the details of Verification Level 1, at a later Verification Level or when your identity details change. We may also search news reports of financial crime, as clause 8.17 of that Policy describes. To confirm who you are or where your funds come from, we may also consult public records and what you have made public, such as company and property registers, court records and public social media profiles.

We may combine the Personal Data you give us, the data your use of the Service creates and the data we receive under clause 6.4, and compare data held on different Accounts, for the purposes in section 7, in particular to confirm identity and to detect multiple Accounts, collusion, misuse of Tips and attempts to get round a limit, a Play break or a Self-exclusion. Data combined in this way remains subject to this Policy.

We Process Personal Data only for the purposes in this section. Each purpose names the main categories of data it uses and its legal basis, which section 8 explains.

Opening, running and closing your Account. Data: Account data, identity data, security data and communications. Basis: performing our contract with you under the Terms, and your consent.

Confirming your age and identity and keeping records of the checks. Data: identity data and identity documents. Basis: our legal obligations, including those under anti-money laundering law, and our legitimate interest in keeping minors and other ineligible persons off the Service.

Keeping your Account and the Service secure, including two-step login, passkeys, Step-up Checks before sensitive changes, the single live session, rate limits and emails about security changes. Data: security data, session records, rate-limit codes, network data and technical data. Basis: performing the contract, and our legitimate interest in preventing unauthorized access.

Enforcing our rules on Restricted Territories, using the country that Cloudflare links to your network address, and our rules on VPNs, proxies, Tor and hosting networks through the Network Check. Data: network data and session records. Basis: our legal obligations and the Terms, and our legitimate interest in offering the Service only where we have chosen to offer it.

Running the Games: accepting and settling Bets, applying each Game's limits, the Maximum Payout on Originals and the limit on single wins in Studio games, keeping open Rounds until you return, calculating your Level, publishing the Seeds and results that let you verify Originals, and resolving questions about Rounds. Data: play data and Balance data. Basis: performing the contract.

Running your Balance, the Vault, Tips, Deposits and Withdrawals, including sending trade offers, holding CS2 Deposits until Steam's Trade hold ends, refunding declined Withdrawals and recording reversals and any debt they create. Data: Balance and transaction data, and Steam and Skins data. Basis: performing the contract, and our legal obligations to keep financial records.

Preventing, detecting and investigating fraud, money laundering, terrorist financing, cheating, collusion, multiple Accounts, misuse of Tips and other breaches of the Terms. Data: any category except Product Events, as far as the case in hand needs it, including technical data and the records in clause 5.18. Basis: our legal obligations, and our legitimate interest in protecting the Service, our players and ourselves.

Applying your safer play tools and protecting players at risk of harm. Data: safer play data, play data, communications and the records in clause 5.18. Basis: performing the contract, our legal obligations where they apply, and our legitimate interest in preventing gambling harm; for any Sensitive Data, your explicit consent or another basis the law allows for it.

Answering your messages, requests and complaints. Data: communications and any category the matter concerns. Basis: performing the contract, and our legitimate interest in giving useful support.

Sending the messages the Service needs, as listed in clause 22.2. Data: Account data. Basis: performing the contract, and our legal obligations for notices the law requires.

Showing the public parts of the Service, such as feeds of Bets, profile pages and public Tips, in line with your settings, and showing wins from those feeds outside the Site as clause 12.9 describes. Data: Account data, play data and settings. Basis: performing the contract and the choices you make in Settings; for wins shown outside the Site in the shortened form, our legitimate interest in promoting the Service; and for anything beyond that form, your consent.

Keeping accounting, tax and audit records. Data: Balance and transaction data. Basis: our legal obligations.

Bringing, pursuing or defending legal claims, and answering lawful requests from authorities. Data: any category concerned, including the records in clause 5.18. Basis: our legal obligations, and our legitimate interest in protecting our legal position.

Maintaining and improving the Service, including fixing faults, hiding Studio games that fail in Fun play until they work, and measuring use of the Service in aggregate. Data: play data, reports, technical data and other technical records, aggregated wherever possible. Basis: our legitimate interest in running a Service that works.

Understanding how the Site is used. While Product Event Tracking is switched on, we use Product Events to count visits and visitors, to see which pages, lobby rows and Games are seen and opened and how well searches find what players look for, and to find where sign-up, Deposits and Withdrawals are started but not finished, so that we can improve the Site. Apart from meeting a legal duty or dealing with a legal claim under clause 7.14, we use Product Events for nothing else: not to recognize a device or link Accounts, not to take any decision about you or your Account, and not to choose offers for you. Data: Product Events. Basis: our legitimate interest in understanding how the Site is used, so that we can maintain and improve the Service.

Running the waitlist, the Discord server and Early Access. Data: the data in clauses 5.15 and 5.17. Basis: your consent, and our legitimate interest in organizing testing before launch.

Recording how you found us. When you open an Account, we record how you found us: any referral code, the tracking link that brought you to the Site and, while Campaign Attribution is switched on, the source, medium and campaign named in that link and its landing page. We use the record to count, in totals, the players, Deposits and play that each referral code, tracking link, partner, source and campaign brings to the Service, and to judge which of them are worth what they cost. No reward is paid for referrals at present, and we do not tell the holder of a code, the owner of a link or anyone else behind a campaign that you used it or anything about your Account. Before any referral or affiliate program begins, we will state in this Policy what its participants can see about the players they refer. Data: the record described in clause 5.3. Basis: performing the contract, for a referral code you enter, and our legitimate interest in knowing how players find the Service, for the rest of the record.

Protecting the integrity of the Games and managing our exposure: reviewing play and transactions for errors or malfunctions in a Game or the Cashier and for play that takes advantage of them, reviewing unusual patterns of Winnings, and setting or adjusting the limits that apply to an Account. Data: play data, Balance and transaction data, technical data and the records in clause 5.18. Basis: performing the contract, and our legitimate interest in protecting the Service and the funds from which Winnings are paid. A member of staff takes any decision on these grounds that restricts or closes an Account, as clause 10.3 provides.

Ordering the Recommended list of Studio games. When you are logged in and have not typed a search, we order the Recommended list of Studio games for you from the Studio games you played with real money and those you opened, in Fun play or with real money, over the last 60 days, giving more weight to recent days than to earlier ones and less weight to a game you only opened than to one you played, and we add games that other players often play alongside them. Data: play data. Basis: our legitimate interest in showing you games you are likely to want. Clause 10.6 explains how this Profiling affects you.

We do not use artificial intelligence or machine-learning tools on Personal Data, and we do not use Personal Data to train such tools. Before we begin to use one, we will add the tool and its purpose to this Policy.

We do not use Personal Data to show you advertising or to choose advertising for you, we do not build marketing profiles, and we do not sell Personal Data. The record of how you found us under clause 7.18 only measures which links and campaigns bring players to the Service. Before using Personal Data for a purpose this section does not list, we will tell you and, where the law requires, ask for your consent.

Under Law 8968, Processing needs your informed consent unless an exception in the law applies, for example where a competent authority orders the Processing or a legal or constitutional duty requires the data to be provided. You give consent when, having been told about this Policy, you open an Account, and when you use a feature for which this Policy asks for consent. Consent must be given freely, expressly and for specific, stated purposes.

Consent can be withdrawn whenever you wish, by writing to us as section 18 describes. Processing that took place before you withdrew consent remains lawful. Because the Service cannot run without Processing your Account data, withdrawing consent to that Processing means the Account has to be closed, and the data we must keep is then held under section 14.

Where the law of the place you live requires a specific legal basis for each activity, we rely on the bases named in section 7:

• contract: the Processing is needed to provide the Service you asked for under the Terms, or to take steps you requested before accepting them;
• legal obligation: a law that applies to us, such as anti-money laundering, tax or accounting law, or an order of a competent authority, requires the Processing;
• legitimate interests: the Processing is needed for an interest that we or another person pursue, and your interests, rights and freedoms do not outweigh it;
• consent: you agreed to the Processing for a specific purpose;
• vital interests: the Processing is needed to protect your life or physical safety, or another person's.

The legitimate interests we rely on are securing Accounts and the Service; preventing fraud, cheating, money laundering and other unlawful conduct; enforcing the Terms, including our limits on countries and networks; preventing gambling harm; protecting the integrity of the Games; resolving disputes; maintaining and improving the Service; understanding how the Site is used; knowing how players find the Service; ordering the Recommended list; promoting the Service; and organizing testing before launch. Before relying on a legitimate interest, we weigh the effect of the Processing on you, limit the data to what the interest needs and apply the safeguards in section 15. The main safeguard for each interest is as follows: for the Network Check, a record is made only when a signal other than a relay service is found (clause 9.3); for reviews of fraud and multiple Accounts, access is limited by role and a person takes every decision with a serious effect (clause 10.3); for maintaining and improving the Service, we use Aggregated Data wherever it serves (clause 7.15); for Product Events, a browser is known only by a keyed one-way code, a search is kept only as its number of results, and each Product Event is deleted 90 days after it is recorded (clauses 5.10 and 14.2); for the record of how you found us, it is made once, when an Account is opened, it holds campaign details only while Campaign Attribution is switched on, and no one behind a link or a campaign is told who used it (clauses 5.3 and 7.18); for the Recommended list, the ordering draws on your own play over the last 60 days and on Aggregated Data, and decides nothing about you (clause 10.6); and for showing wins outside the Site, only the shortened form is used without your consent (clause 12.9). You may ask for details of that assessment, and you may object to the Processing under clause 17.2.

Our anti-money laundering duties arise from Costa Rica's Law 7786 on narcotics, psychotropic substances, drugs of unauthorized use, related activities, money laundering and terrorist financing, as amended by Laws 8204 and 9449, and from the measures in our Anti-money laundering policy.

We carry out identity, sanctions and anti-money laundering checks as standards we have adopted ourselves. For those checks we rely on performing our contract with you and on our legitimate interest in keeping crime off the Service.

We keep a record of each consent you give or withdraw under this Policy, showing what it covered, the version of the Terms, of which this Policy forms part, shown to you, the time and the means by which you gave or withdrew it. We keep that record while the consent applies and afterwards for as long as we may need to show that our Processing was lawful.

We offer the Service only outside the Restricted Territories, which the Restricted countries and VPN policy lists, and the Terms forbid the use of a VPN, a proxy, the Tor network, a hosting network or any other Masking Tool. To apply the rules on Restricted Territories, we use the country that Cloudflare links to your network address when you sign up, give the details of Verification Level 1, play, send a Tip, make a Deposit or request a Withdrawal, together with the country in your identity details where you have given them. To enforce the ban on Masking Tools, we may run the Network Check, which, while it is switched on, examines your network address when you sign up, log in, enter an access code, make a Deposit or request a Withdrawal, Skins included, and, while you are logged in, when you visit the Site. The country linked to your address by our lookup provider or, where the provider gives none, by Cloudflare is kept with any check that finds a signal, and we may also use it to apply the rules on Restricted Territories.

For each check we first see whether Cloudflare reports the address as part of the Tor network, and we compare the address with the lists described in clause 6.5. If neither settles the matter and a lookup provider is switched on, we send that provider the address, and nothing else: IPQualityScore by default, or IPinfo, ipapi.is or MaxMind. The provider reports whether the address belongs to the Tor network, a VPN, a proxy, a hosting network or a relay service and, depending on the provider, the network's country and time zone, the name of the VPN service and a risk score or confidence value. We keep that answer in memory for up to six hours so that further checks of the same address need no new lookup; it is written to our database only when a record is made under clause 9.3.

A check makes a record only when it finds a signal other than a relay service. The record holds the checkpoint and the step, such as a password, a passkey, an access code or a Skins request; a keyed one-way code made from your IP address and the prefix of the address that identifies its network (for example the first three of the four numbers of an IPv4 address), but never the full address; the signals found, with the source of each and the date of any list that matched; the name of the lookup provider and its summary; the time zone your browser reports and the network's, where the two differ by an hour or more; the country described in clause 9.1; the mode in which the check ran and whether it refused the action; and, for a Deposit or Withdrawal, the amount, the method and asset, the references of the request and, for Skins, the game. A refused Deposit or Withdrawal also creates a separate record of the refusal. Checks made during visits are recorded only for logged-in users, and at most once for the same address in any six hours. A sign-up the check refuses is recorded with the username that was entered, and a refused access code entry with the identifier of the code. A refused login or access code entry that cannot be matched to an active Account with valid details is recorded without an Account, with the code and prefix of the address and the signals.

Our staff can see, for each Account, how many checks flagged or refused it and which signals were found. Staff whose role gives access to an Account's personal details or to the audit log can also see each recorded check, including the prefix of the address; no staff tool shows the full address, which the records do not hold.

The Terms and the Restricted countries and VPN policy set out what follows from a check, including refusal of the action, review of the Account, suspension and the voiding of Bets placed while your location was hidden. Clause 10.4 explains how to ask for a review.

While it is switched on, the Network Check takes automated decisions. When it finds that your network address belongs to the Tor network, a VPN, a proxy or a hosting network, it refuses the sign-up, login, access code entry, Deposit or Withdrawal at once or, on a visit while you are logged in, blocks the page, and the Site tells you that it is not available on a VPN or proxy until you turn it off. We may also run it so that it records a finding for review by our staff without refusing the action. A relay service such as iCloud Private Relay is neither refused nor recorded on its own. A difference between your browser's time zone and your network's does not refuse anything; it is recorded so that staff can review it.

Our systems also decide automatically to:

• refuse further attempts for a short time when too many attempts to log in, register, recover an Account or carry out another limited action come from one network address, one email address or username, or one Account;
• refuse a Bet that would break your Loss limit or Daily stake limit, refuse new stakes once your Time limit is used up, refuse a Deposit that would go over your Deposit limit, and refuse Bets, Tips, Deposits and Fun play in Studio games during a Play break or Self-exclusion;
• hold apart from your Balance, for our staff to deal with, a Deposit that arrives during a Play break or Self-exclusion, over a Deposit limit or while your Account is suspended or restricted;
• refuse a sign-up, a Bet, a Tip or a Deposit from a country where our rules on Restricted Territories block it, and refuse the details of Verification Level 1 when they show an age below the minimum that applies;
• refuse a Deposit until you have completed the Verification Level that your Deposits call for, and a Withdrawal by a method that requires a verified identity, as the Identity verification policy sets out;
• refuse a Bet above a Game's limits; refuse a Bet on an Original that could pay more than the Maximum Payout of $1,000,000, end a Round played in steps before a step that could pay more, and cash out a Crash Bet before its win would pass that amount; and hold back from your Balance, for review by our staff, a single win of more than $1,000,000 in a Studio game, as clause 4.9 of the Game rules sets out;
• pause Withdrawals of Skins for a waiting period, which the Cashier shows, after you link, change or unlink a Steam account or change your Trade URL, and stop new Withdrawals of Skins bought from sellers for a time after several of your Withdrawal offers have been declined;
• accept or reject an identity document or a face match where the Identity Partner's tools decide it, to which clause 10.4 applies.

We review activity on the Service for signs of fraud, money laundering, collusion, multiple Accounts and gambling harm. Automated alerts and scores may bring an Account to our attention, but a member of staff takes any decision on those grounds to suspend or close an Account, to withhold or void Winnings, or to refuse a Withdrawal.

If an automated decision affects you, you may ask Support for a person to review it, put your point of view and ask for the main reasons behind it. A member of staff who took no part in any earlier review will look at the matter again, running a fresh Network Check where relevant. We explain the main factors behind the decision, but we do not disclose details of our security and fraud controls where that would help others get round them.

We do not use Profiling to target you with offers, and nothing we learn from your play changes the outcome of any Game. Results in Originals come from the Seeds described in our Fairness policy.

The ordering of the Recommended list described in clause 7.20 is Profiling. It changes only the order in which Studio games are shown to you, takes no decision about you and has no effect on the outcome of any Game.

We do not sell, rent or trade Personal Data, and we do not share it with anyone for advertising. We disclose Personal Data only as this section sets out, and only as far as each Recipient needs it.

Service Providers. We disclose Personal Data to Service Providers of the following kinds, under terms that oblige them to keep it confidential and secure and to use it only to serve us:

• hosting and infrastructure providers that run our servers and databases and any backups;
• Cloudflare, which carries all traffic to and from the Site, shields it from attacks and abuse, and reports the country and time zone linked to each network address and whether the address belongs to the Tor network;
• an email delivery provider that sends our emails;
• our lookup provider for the Network Check, as section 9 describes;
• the Identity Partner, once Verification Levels 2 to 4 open;
• professional advisers such as lawyers, accountants, auditors, banks and insurers, who owe us duties of confidentiality, including an insurer to which we report a claim or a Security Breach.

Each Service Provider acts under a written contract that requires it to Process Personal Data only on our instructions; to keep it confidential and secure; to tell us without delay of any Security Breach; to engage another provider for our data only with our approval and on the same terms; to help us answer requests under section 17; and to delete or return the data when its service ends. On request, the privacy officer will give you the name of each Service Provider and the countries where it Processes Personal Data.

Cloudflare, the lookup provider, the email delivery provider, the hosting providers and the Identity Partner act as our Service Providers. Steam, Discord and the Studios decide for themselves how they Process the Personal Data they receive.

AssetPay. To deposit and withdraw Skins we send AssetPay your Steam ID, your Trade URL and your internal Peeks account identifier, with the details of each trade. We do not send AssetPay your name, email address or username. AssetPay uses this data to price items, carry out the trades on Steam and keep its own records, and its own privacy policy governs that Processing.

Steam. Deposits leave your Steam inventory, and Withdrawals reach it, as Steam trades. Steam therefore holds the details of each trade with your Steam account, under Steam's own privacy policy. We read only your public Steam profile. Pictures of Skins and Steam profile pictures load from Steam's content servers, which receive your network address.

Studio games. Studio games come from independent Studios through the Game Aggregator. When you open a Studio game for real money, we open a player account for you at the aggregator under your internal account identifier in a prefixed form, and send it the Game, the language of the Site, the currency, a link back to the Site and a link to the Cashier; the aggregator and the Studio then exchange with us the stakes, wins and references of your Rounds. We do not give them your name, email address or username. When you open a Game in Fun play, we send no player reference. Each Game loads in a frame from servers run by the aggregator or the Studio. Those servers receive your network address and the information your browser sends, may run their own security check and may set their own cookies. Some pictures of Studio games load from the aggregator's image servers, which also receive your network address. The Studios and the aggregator keep records of Rounds for their own legal and audit purposes.

Complaints about a Round or a trade. To look into a complaint about a Round of a Studio game, we give the aggregator and the Studio the Round reference, the Game, the stake, the result, the times and your description of the problem, linked to the identifier described in clause 11.7. To look into a complaint about a Skins trade, we give AssetPay the details of the trade and your account identifier. We give them your name, email address or username only if the matter cannot be settled without it, and we tell you before we do so.

Discord. The Peeks server and its bot run on Discord, which Processes your Discord data under its own privacy policy. We store the applications, tickets and records described in clause 5.15, and the staff who review them can see them.

Other players. Some data is visible to other players by design, as section 12 describes.

Authorities. We disclose Personal Data to courts, police and prosecutors, tax authorities, PRODHAB, the Financial Intelligence Unit of the Costa Rican Institute on Drugs (ICD) and other public bodies when the law requires it or a competent authority orders it, including reports of suspicious transactions under anti-money laundering law. These bodies include the General Superintendency of Financial Entities (SUGEF), where Law 7786 places us under its supervision, the tax administration in respect of the tax under Law 9050 and the municipality that issued our license. We act on a request only when an authority with power to make it does so in writing, or confirms it in writing afterwards where clause 11.14 applies, and we meet a request from an authority outside Costa Rica only where Costa Rican law gives it effect. We check that each request has a legal basis, disclose no more than it requires and resist requests that are unlawful or excessive, and we keep a record of each request and of what we disclosed. We tell you about a request that concerns you unless the law forbids it or telling you would harm an investigation. Authorities may send requests to the address in clause 26.3.

Reporting suspected offenses. If we reasonably suspect that the Service has been used for fraud, theft, money laundering or another offense, we may report it on our own initiative to the police, prosecutors or the Financial Intelligence Unit, with the Personal Data needed to describe it, and we may tell AssetPay or Steam about a Steam account involved so that they can act under their own rules. We do not share Personal Data with any fraud prevention or self-exclusion database used by other operators.

Protecting rights. We may disclose Personal Data where that is reasonably needed to enforce the Terms, to investigate a breach of them, or to defend the Operator, our players or anyone else against harm to their safety, property or rights, for example to AssetPay in a case of fraud or a reversed trade.

Emergencies. If we believe in good faith that a person's life or physical safety is in serious and immediate danger, for example because a player tells us in live support or on the Discord server that they intend to harm themselves or someone else, we may give the police, emergency services or a crisis service the Personal Data they need to help, Sensitive Data included, without first asking the player. We record each such disclosure and the reason for it.

Recovering debts. If a reversed Deposit or any other event leaves you owing us money that your Balance does not cover, we may give your name, contact details, the amount owed and the records that show it to a lawyer or collection agency acting for us and to a court.

Public statements. If you make a public statement about your dealings with us, for example on a review site, a forum or the Peeks Discord server, we may reply in public with the facts needed to correct it, such as whether a Bet settled or a Withdrawal was paid. In doing so we do not publish your identity data, contact details, identity documents, Balance or safer play data.

Business transfers. If we take part in a merger, acquisition, reorganization, financing, sale of all or part of our business or assets, or insolvency proceedings, Personal Data may be disclosed to the parties and their advisers under duties of confidentiality and passed to the successor. The successor must Process it under this Policy. We will tell you by email and on the Site before your Personal Data becomes subject to a different privacy policy.

Group companies. If a parent, subsidiary or sister company of ours helps provide the Service, it receives Personal Data only for that purpose and under this Policy.

At your request. We disclose Personal Data to any other person when you ask us to or agree to it.

Anonymized and Aggregated Data. We may create Anonymized Data and Aggregated Data from Personal Data and use, publish or share them for any purpose, such as statistics on the Games, for example the number of players of a Game or the number of Rounds played, or reports to authorities. Because such data identifies no one, this Policy does not restrict that use. We do not attempt to identify anyone from it, and we require those who receive it not to attempt to do so. If such data is combined with other data in a way that identifies a person again, we treat the result as Personal Data.

Your username identifies you on the Service. In public feeds of Bets and wins and in lists of top wins, your Bets show the first four characters of your username followed by three asterisks, with your Level, the Game, the stake, the multiplier, the payout and the time. A username of four characters or fewer shows in full. Feeds show only real Bets by real players.

If you turn Public profile off in Settings, your Bets show in feeds as Hidden, your Level is not shown with them, and you do not appear in player search.

Anyone who knows your exact username or your public identifier can open your profile page, which shows your username and the date you joined. Your statistics (number of Bets, total wagered and highlights) and your Level appear there only while Public stats is on.

When you send a Tip, the recipient sees your username and the amount. For a Tip of $5 or more you may ask for it to be shown publicly, which the Site accepts only where the recipient takes public Tips; wherever the Site shows public Tips, each shows both usernames in full, the amount and the time.

Other players never see your email address, Balance, transactions, identity data, Steam data, limits, Play break or Self-exclusion, or your support messages. Clause 12.6 describes what a seller of Skins can see when it fills a Withdrawal.

When a Withdrawal is filled with an item that AssetPay buys from a seller, AssetPay passes your Trade URL to that seller, who sends the trade offer from the seller's own Steam account and can therefore see your Steam profile name, avatar and whatever else your Steam profile shows. Items sent from AssetPay's own stock come from AssetPay's trading accounts, which see the same details. A Deposit needs your Steam inventory to be public, and while it is public anyone on Steam can see it. We never give a seller your Peeks username, email address or any other data from your Account.

Your Discord username, and anything you post in public channels of the Peeks Discord server, can be seen by members of that server under Discord's rules.

We cannot control what you publish yourself, such as a screenshot of a win shared elsewhere.

We may show a Bet or win taken from the public feeds in posts on our social media accounts, on the Peeks Discord server and in videos that promote the Service, in the shortened form described in clause 12.1, and never for an Account whose Public profile is off. We show a full username, an image or recording of a player or any other detail that identifies a player only with that player's consent, which the player may withdraw for future use by telling Support.

We are established in Costa Rica, but our servers, our Service Providers and their staff may be elsewhere, so Personal Data may be transferred to, stored in or accessed from other countries, including countries whose data protection laws differ from those of Costa Rica or of the country you live in. Cloudflare runs a global network and usually handles your traffic at a location near you.

Some transfers follow from what you ask us to do. A Skins Deposit or Withdrawal sends trade data to AssetPay, to Steam and, for an item bought from a seller, to that seller, and opening a Studio game connects your browser to servers run by the Game Aggregator or the Studio, wherever those are.

Linking a Steam account connects your Account to Steam, which Valve Corporation operates from the United States. Valve is not our Service Provider, and no contract with us governs its use of your data. You link a Steam account only by choosing to sign in through Steam yourself, and by doing so you consent to that connection. You can withdraw that consent by unlinking the Steam account once no trade is open. Unlinking stops further exchanges with Steam, but it does not reverse trades already made, free the Steam account for use with another Account or remove the records that clause 5.13 says we keep after unlinking.

We transfer Personal Data abroad only where Law 8968 allows it, including transfers made with your consent and transfers needed to perform our contract with you. Where the law of your country sets conditions for sending Personal Data out of it, we meet them.

For each transfer to a Service Provider we require the recipient to protect the Personal Data to a standard at least equal to this Policy, we send only what the recipient needs, and we encrypt it in transit. You may ask the privacy officer for a description of the safeguards that apply to any transfer.

When you open an Account, you check the box confirming that you are 18 or older and that you accept the Terms, of which this Policy forms part. By doing so you expressly authorize us to make Transfers of your Personal Data to the Recipients described in section 11, in Costa Rica and in the other countries described in this section, for the purposes in section 7. If you withdraw this authorization, clause 8.2 applies.

We keep Personal Data only while we need it for the purposes for which we collected it, and afterwards for as long as the law requires us to keep it or a legal claim may depend on it. We set each period by reference to its purpose, the legal duties that apply, how sensitive the data is and the harm that keeping it could cause. Where a period depends on a possible legal claim, it ends when the time for bringing that claim runs out. When a period ends we delete the data, or anonymize it so that it no longer identifies anyone, subject to clause 14.4. Anonymized Data may be kept without time limit.

The retention periods are:

• the record of a visitor who used live support without logging in: kept for as long as any of its conversations is kept, and otherwise deleted 30 days after it was last used; the link between such a conversation and a browser: deleted 30 days after it was last used, or sooner if it is revoked;
• session records, which hold the details in clause 5.6: kept while the session lasts, which is never longer than seven days, and deleted 30 days after it ends, whether you log out or it runs out; the note that a session ended because you logged in elsewhere is deleted when that session would have run out;
• unfinished two-step logins and passkey checks: deleted one day after they expire, and the secret of an authenticator app that you began to add but did not confirm is erased when that set-up ends;
• rate-limit codes: deleted one day after the end of the window they count, and each window lasts between one minute and one day;
• Network Check answers held in memory: up to six hours;
• emails waiting to be sent, and the links and codes in them: deleted seven days after the link or code expires;
• reports that a Studio game did not work in Fun play, and the record of Studio games opened in Fun play that goes with them: deleted after fourteen days;
• daily counts of real-money Rounds played on each Studio game: deleted after 120 days;
• Product Events, and the daily record of which browsers visited the Site that is drawn from them: deleted 90 days after they are recorded, while the daily totals drawn from them are Aggregated Data;
• the record of how you found us that clause 5.3 describes: kept for as long as we keep your Account data;
• the cookie that holds the details of a link until you open an Account, which clause 23.2 describes: no longer than 30 days;
• signals that someone is typing in or viewing a live support conversation: under one minute;
• waitlist email addresses and the time each was given: deleted within 30 days after the email announcing the launch, and from backup copies of the waitlist within a further 14 days.

When your Account is closed, our staff suspend it so that no one can use it, and the Personal Data we must keep is then restricted to the purposes for which we keep it.

Records of money, Bets, Skins trades, Tips, Tip notices, Tip settings, support messages and staff notes, the history of Steam links, and the audit log, which holds the Network Check records and other security events such as changes of username, email address and two-step login, are written to our database in an append-only form that cannot be altered or deleted in the ordinary course of operation, so that they stay a complete and reliable account of what happened. We keep them as clause 14.1 describes, and we can meet a request to erase them only in the ways clause 17.5 describes.

If we close an Account for a breach of the Terms, for fraud or for a reason connected with money laundering, we keep what we need to recognize the same person if they try to return, such as the email address, the Steam ID, the identity details, the network data held for the Account and the reason for closure. We use it only to refuse or review a new Account and to meet our legal duties. If you believe you have been matched in error, you may ask for a review under clause 10.4.

We keep Personal Data beyond these periods while an investigation, dispute, complaint or legal proceeding about it is open, or while an authority requires us to keep it. Where you make a complaint under the Complaints policy, we keep the records that concern it until the complaint is closed and the time limit for claims in clause 19.7 of the Terms has passed, or until any proceedings about it have ended, whichever is later, as clause 8.28 of that Policy sets out.

We delete Personal Data by erasing it from our live systems so that it cannot be recovered in the ordinary course of operation, and it leaves our backups as the copies that hold it are deleted. Data we keep only to meet a legal duty can be reached only by the staff who deal with that duty and is used for nothing else.

We protect Personal Data against loss, misuse and unauthorized access, change or disclosure with technical and organizational measures suited to the risk. They include:

• TLS encryption for all traffic between your browser and the Site;
• encryption of identity data, with your date of birth and address, your answers about the source of your funds and any documents you upload sealed so that the Site cannot read them back, and encryption of authenticator secrets, Trade URLs apart from the partner number drawn from the Steam ID, the contents of emails waiting to be sent, and server seeds until they are revealed;
• one-way hashing of passwords (with scrypt), recovery codes, access codes and session tokens, and keyed one-way codes in place of network addresses in session records and in the audit log;
• two-step login with an authenticator app, passkeys, Step-up Checks before sensitive changes, one live session per Account, and the ending of your other sessions when you change your password;
• rate limits on logging in, registering, recovering an Account and other sensitive actions;
• access for staff by role and permission, granted to named members of staff and recorded, with a separate permission needed to see email addresses, and a record of every sensitive action staff take;
• a login with an authenticator app or a passkey before a member of staff can open staff tools, and a passkey confirmation, which lasts five minutes, before staff make a change;
• append-only records of money movements and Bets that cannot be edited;
• review of our code and systems for security weaknesses;
• written confidentiality undertakings and data protection training for everyone who handles Personal Data;
• a written plan for responding to a Security Breach;
• a review of each Service Provider's security before it receives Personal Data.

Only staff who need Personal Data for their work can reach it, through the roles and permissions granted to each of them, and they must keep it confidential, a duty that continues after their work for us ends.

You must keep your login details secret, choose a password of at least twelve characters that you use nowhere else, turn on two-step login or a passkey, keep your email and Steam accounts secure, and tell us at once if you think someone else has got into your Account. Our staff will never ask for your password, your two-step or recovery codes, your Steam Guard codes or your Steam API key, and no member of staff will ever ask you to send them money or Skins. We contact you only by email from addresses ending in @peeks.gg, through live support on the Site and, if you use it, through the bot on the Peeks Discord server.

No way of sending or storing data is free of risk, and we cannot guarantee that Personal Data will never be reached without authority. Please report any security weakness you find in the Service as the Security policy describes, or to support@peeks.gg.

You are responsible for what is done through your Account until you tell us that someone else may have gained access to it, unless it was done because we failed to meet this Policy or the Terms. We are not liable for loss caused by someone using your login details, your email account, your Steam account or your devices without your authority, or by a site or message that imitates us. To the extent the law allows, our liability for any access to Personal Data that occurs despite the measures in this section is limited as the Terms provide.

If we learn of a Security Breach, we act at once to contain it, assess its effects and the risk to the people concerned, and record the facts, the effects and the steps taken.

Where a Security Breach significantly affects the rights of the people concerned, we inform them and PRODHAB without undue delay, by email and by a notice on the Site. The notice states what happened, which Personal Data is involved, the likely consequences, what we have done or will do, what you can do to protect yourself, and whom to contact.

Where the law of another country requires us to notify a Security Breach to an authority or to the people concerned, we do so as that law requires.

Law 8968 gives you the following rights:

• the right to be informed, before your Personal Data is collected, of why it is Processed, who receives it, whether you must provide it, what follows if you do not, and who is responsible for it, as this Policy does;
• the right of access: to learn whether we Process your Personal Data and to receive a copy of it with information about its Processing;
• the right to rectification: to have inaccurate or incomplete Personal Data corrected or completed;
• the right to deletion: to have Personal Data deleted when its Processing breaks the law or it is no longer needed for the purpose for which it was collected;
• the right to revoke your consent.

Whatever the law of the place you live, we also give you these rights, subject to clause 17.4:

• restriction: to have us keep Personal Data without otherwise using it while we check its accuracy or your objection, where its Processing is unlawful and you prefer restriction to deletion, or where we no longer need it but you need it to bring or defend a legal claim; while data is restricted we only store it, unless you agree or the law requires otherwise, and we tell you before the restriction ends;
• the right to object to Processing based on our legitimate interests, which we will then stop unless we have compelling grounds to continue or need the data for legal claims;
• deletion of Personal Data whose Processing rested only on a consent you have withdrawn, or on a legitimate interest to which we have upheld your objection, unless clause 17.4 or section 14 requires us to keep it;
• portability: the right to receive the Personal Data you gave us in a structured electronic file that common software can read, and to have us send it to another organization where that is technically possible;
• the right to have a person review an automated decision, as clause 10.4 describes;
• the right to complain to us and to PRODHAB, as section 19 describes.

You can use several of these rights yourself, without making a request:

• change your email address, your username (once every 30 days), your password, your two-step login and your passkeys in Settings;
• turn Public profile, Public stats and Tip notifications on or off;
• see your Bets and transactions and download them as CSV files;
• unlink your Steam account once no trade is open, with the effects described in clause 5.13.

The law limits some rights. We may refuse a request in whole or in part where:

• we must keep the data to meet a legal obligation, such as the record-keeping duties of anti-money laundering law;
• we need the data to bring, pursue or defend a legal claim, or to investigate fraud or a breach of the Terms;
• meeting the request would reveal Personal Data about someone else, or would expose our security and fraud controls in a way that would help others get round them;
• the data is in communications with our lawyers that the law protects as privileged or confidential;
• meeting the request would reveal that we have made, or may make, a report to an authority, or would prejudice the prevention, detection or investigation of an offense;
• meeting the request would disclose confidential business information, such as how our risk ratings are worked out, beyond what clause 10.4 requires;
• the request is clearly unfounded or excessive, for example because it repeats an earlier request without reason.

If we refuse, we tell you which limit applies, why, and how you can complain, unless telling you would itself reveal a report or prejudice an investigation.

Erasure and closing your Account. To have your Personal Data deleted, ask Support to close your Account. Open Rounds must finish first, and any Balance is dealt with as the Terms provide. Our staff then suspend the Account so that no one can use it, delete or overwrite the Personal Data we are not required to keep, and restrict the rest to the purposes in section 14 until its retention period ends, after which we delete or anonymize it. The records described in clause 14.4 are kept for their full period.

If you are on a Play break or in a Self-exclusion, we keep the records needed to enforce it until it ends, even if you ask us to delete your Account, so that we can act if a new Account is used to get round it.

Exercising a right never counts against you. We do not refuse you the Service, charge you more or treat you less well because you have used a right under this Policy, except that we cannot keep providing the Service once the Personal Data it needs has been deleted or its Processing stopped.

When we correct, delete or restrict Personal Data at your request, we tell each Recipient to whom we disclosed it, such as AssetPay or the Identity Partner, unless that proves impossible or needs effort out of proportion to the benefit to you. On request, we tell you who those Recipients are.

If we decline to correct data that you say is wrong, we tell you why, and we record with the data that you dispute it, together with any short statement you give us.

To exercise a right, write to support@peeks.gg, marked for the attention of the privacy officer, from the email address registered to your Account, or send a message through live support on the Support page while logged in. Say which right you want to use and, where it helps, which data or period you mean.

We must be sure that a request comes from you. A request through live support while you are logged in, or from the email address registered to your Account, is normally enough. We may ask you to pass a Step-up Check or give further information before we act, in particular before we disclose or delete data, but we ask only for what we need to confirm who you are, and we use it for nothing else. If we cannot confirm who you are, we tell you and do not act on the request.

Someone else may make a request on your behalf. We will ask that person for written proof of their authority, and we may confirm the request with you directly.

We answer requests within the time the law allows. If a request is complex or you have made many requests, we may extend that period where the law allows, and we will tell you why.

We send copies of Personal Data in electronic form, normally as CSV or JSON files, unless you ask for another reasonable format. Requests are free of charge.

We confirm that we have received each request, and we tell you if we need more information to answer it.

A copy of your Personal Data includes, as far as we hold them, your Account, identity and security data; your Bets, Rounds and transactions; your Steam and Skins data; your safer play settings; your messages with Support; the Network Check records about you; and the records described in clause 5.18, subject to clause 17.4. With it we state the purposes of the Processing, the Recipients or kinds of Recipient, how long the data is kept or how that period is set, and where we obtained any data that did not come from you.

We keep a record of each request and of our answer.

If you have a concern about our handling of your Personal Data or of a request, raise it with the privacy officer first. We will confirm that we have received your complaint, look into it and answer in writing. Our answer states what we found, what we will do and that you may complain to PRODHAB. The Complaints policy describes our general procedure.

You may complain at any time to PRODHAB, the authority that enforces Law 8968 in Costa Rica. If you live in another country, you may also complain to the data protection authority there.

You may also take your case to the courts, as the law of Costa Rica or of the country where you live allows, whether or not you have complained to us or to an authority.

The Service is for adults only. You must be 18 or older, or older still if the minimum legal age where you live is higher, to open an Account or play with real money. The Service is not aimed at minors. We do not knowingly accept an Account, or any Personal Data, from a person under 18.

Everyone who opens an Account must confirm that they are 18 or older, and the date of birth given at Verification Level 1 must show an age of at least 18. We may check age at any time through the checks in the Identity verification policy.

If we learn or suspect that an Account belongs to a minor, we suspend it at once, stop all play and deal with any Balance as the Terms provide. Our staff then close the Account in the way clause 14.3 describes and delete or overwrite the minor's Personal Data, except the minimum we need to stop the same person opening a new Account before turning 18 and the records the law requires us to keep.

If you believe a minor is using the Service, tell Support at once. A parent or guardian may ask us to close the Account and delete the minor's data. The Responsible gambling policy lists software that blocks gambling sites on devices that minors use.

We use your safer play data to apply the tools you choose: Loss limits over one, three, seven or fourteen days; the Daily stake limit; a Deposit limit and a Time limit for each UTC day, week or month; Session reminders; the Play break; and Self-exclusion. These tools work automatically, as clause 10.2 describes.

We may also review play data, safer play data, communications and the records in clause 5.18 for signs that a player is at risk of harm, such as stakes that rise quickly or repeated attempts to raise or remove limits, and we take account of any concern raised under clause 6.7. Where we see such signs, our staff may contact you, suggest limits or a Play break, or suspend or close an Account, as the Responsible gambling policy explains.

We do not ask about your health. If you tell us that you have a gambling problem or another condition that affects your ability to gamble safely, we Process that information, with your consent or as the law otherwise allows for Sensitive Data, only to protect you, for example by applying an exclusion, and only the staff who need it can see it. Where what you tell us shows that your life or safety, or another person's, is in danger, clause 11.14 applies.

Your answers to the self-assessment stay in your browser and are not sent to us. Session reminders are kept only on the device where you set them.

We do not use safer play data for any commercial purpose.

We do not send marketing or promotional messages by email, text message, push notification or any other channel, and we do not give your contact details to others for their marketing.

We send only messages about your Account and the Service: emails that confirm your email address or reset your password; security notices telling you that your password, email address or two-step login has changed, or that a Steam account was linked to or unlinked from your Account or your Trade URL changed; notices that this Policy or the Terms require, such as notice of a change to them, of a Security Breach or of a transfer of our business; replies to your messages, requests and complaints, and requests for information about your identity or funds; a summary of your account statistics when you ask for one; and the single email to the waitlist described in clause 22.4. These messages are not marketing. While your Account is open you cannot turn off those that protect it or that give you notices the law requires.

If we decide to send marketing in the future, we will ask for your consent first, we will not send it to anyone on a Play break or in a Self-exclusion, and you will be able to withdraw your consent to marketing communications at any time, through a link in each message or in Settings.

If you joined the waitlist, we will send you one email when the Service opens and none after that.

When you receive a Tip, a notice appears in your Account. You can turn off Tip notifications in Settings.

Our emails contain no tracking images, and we do not alter their links to record whether you follow them.

We set the cookies the Service needs in order to work and, while they are in use, the cookies for Product Events and for how you found us that clause 23.2 describes. We use no third-party analytics, advertising or social media cookies, and we load no third-party scripts that track you. The cookies the Service needs are:

• peeks_session, which keeps you logged in for up to seven days;
• peeks_mfa_login, which holds a two-step login for five minutes while you enter your code, or for ten minutes when you use a recovery code;
• peeks_passkey_challenge, which holds a passkey check for five minutes;
• peeks_sg, which links your browser to a live support conversation you open without logging in, holds a random token that is sent only to our support service, and lasts 30 days;
• peeks_sg_hint, which tells the page that such a conversation exists, holds nothing about you, and lasts 30 days;
• peeks_device, which holds a random identifier for your browser, signed by our servers, so that we can limit how many live support conversations one browser can open without logging in, and lasts 400 days.

While Product Event Tracking is switched on, the Site sets a first-party cookie that holds a random identifier for your browser and nothing else, so that the Product Events of one browser can be counted together, as clause 5.10 describes. When you reach the Site through a link that carries the code of a tracking link or campaign details, the Site may keep them, with the page on which you arrived and the time, in a first-party cookie that lasts no longer than 30 days and is sent to our servers only when you open an Account, together with a second cookie that holds no detail and stops a later link from replacing the first. Opening an Account through the sign-up form deletes both, and what they held is recorded only as clause 5.3 describes. None of these cookies is needed for the Site to work, and blocking or deleting them changes nothing else. The Cookie policy names each of them, with its lifetime, from the day it is first used.

We keep some preferences and working data in your browser's storage rather than on our servers: sound and animation settings, the state of the sidebar, favorites chosen while logged out, Session reminders, the date format, the tabs you last used, recent searches, recent stakes and Game settings, the balance you chose to play from, notices you have closed, drafts and unsent messages in live support and the state of the support panel, a marker showing that the browser has been used for early access before, a note that your Account is suspended or under review so that your other open tabs show it, notes about a Fun play Round or automatic play still under way when you left or reloaded a Game, and keys that let an action resume safely if your connection drops. The Cookie policy lists each item. You can clear them in your browser.

Cloudflare may set its own cookies, such as cf_clearance and __cf_bm, when it checks whether a visit comes from a person or an automated tool, as clause 5.8 describes, and the Cookie policy lists them. Studio games, which load in frames from servers run by the Game Aggregator or the Studio, and Steam's sign-in page set their own cookies under their own policies.

Because we do not track you across websites, sell Personal Data or share it for advertising, a Do Not Track or Global Privacy Control signal has nothing of ours to switch off. We still treat either signal as an objection to any such Processing, should we ever begin it.

The Cookie policy lists each cookie with its purpose and lifetime, including two that let our staff preview seasonal designs of the Site; they hold only the preview setting of the address you opened and nothing about you.

The Site links to, or opens inside its pages, services we do not control, including Steam, the Studio games served by the Game Aggregator and the Studios, and the help organizations listed on our Responsible play page, and the Peeks server runs on Discord. Their own privacy policies govern how they Process your Personal Data, and we are not responsible for their content or for how they handle Personal Data.

A link to another service, or its appearance inside the Site, does not mean that we endorse that service or the way it handles Personal Data. Read its privacy policy before you give it any Personal Data.

We may amend this Policy to reflect changes to the Service, to the law or to how we Process Personal Data. The date at the top of this Policy shows when it last changed.

A change is material if it adds a purpose, a kind of Personal Data, a kind of Recipient or a country to which we transfer Personal Data, or if it narrows your rights. We give at least 14 days' notice of a material change, as clause 1.7 of the Terms provides, by email and by a notice on the Site or in your Account, before it takes effect, unless the law or the security of the Service requires it to apply sooner. Other changes, such as corrections and clearer wording, take effect when we publish them. Where a change needs your consent, we will ask for it, and the change will not apply to you until you give it.

We keep earlier versions of this Policy and will send you any of them on request. This Policy replaces the privacy notice of 13 October 2026 shown on the Site and the waitlist privacy notice of 14 October 2026.

If you use the Service after a change takes effect, the Policy as changed applies to you, except that a change that needs your consent applies to you only once you give it. If you do not accept a change, you may close your Account as clause 17.5 describes.

Privacy officer: through Support or at support@peeks.gg, marked for the attention of the privacy officer.

Support: live support messages on the Support page, or support@peeks.gg.

Requests from authorities: support@peeks.gg, marked "Legal inquiry".