Privacy Policy: Your Data and Your Rights

Version 2.0 — Effective October 27, 2026

This Privacy Policy replaces the Privacy Policy dated June 19, 2026, and applies from the effective date above. Earlier versions are listed in the Revision History at the end of this policy.

Winfield LLC ("Company", "we", "our", or "us"), which provides the online social gaming platform SweepBurger, respects your privacy and is committed to protecting it through our compliance with this policy. This policy describes how we collect, process, retain, and disclose personal data about you when providing services such as our games and promotions to you through our website, PWA, and services that link to this policy (our "Services"), and our practices for using, maintaining, protecting, and disclosing that information.

Part of the Platform Documents. This Privacy Policy is one of the SweepBurger Platform Documents, together with the Terms and Conditions, the Sweepstakes Rules and the Responsible Social Gameplay Policy. It is incorporated into the Terms and Conditions, and you accept it when you accept the Terms and Conditions, whether at registration or by using the Services. On matters concerning personal data, including cookies and similar technologies, this policy takes precedence over the other Platform Documents. Capitalized terms not defined here have the meanings given in the Terms and Conditions.

This policy applies only to information we collect:

• Through the Services.
• In communications, including email, text, chat, and other electronic messages, between you and the Services.
• When you interact with our advertising and applications on third-party websites and services, including social media pages we operate, if those applications or advertising include links to this policy.

It does not apply to information collected by any third party, including through any application or content (including advertising) that may link to or be accessible from or through the Services.

United States only. The Services are offered only to persons located in permitted states of the United States, as described in the Terms and Conditions. They are not offered, and may not be accessed, from any other country or territory, and we do not knowingly collect personal data from individuals located outside the United States.

Please read this policy carefully to understand our policies and practices regarding your information and how we treat it. By interacting with our Services or providing us with your information, you agree to the collection, use, and sharing of your information as described in this privacy policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of the Services after we make changes as described here is deemed to be acceptance of those changes, so please check the policy periodically for updates.

Children's and Minors' Data

Our Services are not intended for, and we do not knowingly collect any personal data from, anyone under the age of 18. Registration requires you to confirm that you are at least 18 years old or the age of majority in your jurisdiction, whichever is higher. If we learn that we have collected or received personal data from a person under 18, we will delete that information and close any associated account. We also carry out age and identity verification checks, and any account found to belong to a person under the required age will be terminated and its data promptly deleted or deidentified, subject to any records we must keep by law. If you believe we may have collected data from or about a minor, please contact us immediately.

The Personal Data That We Collect or Process

"Personal data" is information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, telephone number, home address, or payment information.

The types and categories of personal data we collect or process include:

• Account and contact information, including name, address, email address, phone number, username, and other contact information you provide us.
• Payment information, including credit or debit card information and information about the payment methods and services you use to purchase Gold Coins or receive prize redemptions.
• Account history, including information about your account activity and gameplay, and transactions such as Gold Coin purchases, prize redemptions, Daily Bonus claims, and requests for Burger Coins by mail.
• Demographic information, including your age and date of birth.
• Location information, including general geographic location such as country, state or city, which we use to confirm you are in a jurisdiction where the Services are permitted.
• Device information, including your IP address, device identifiers, operating system and version, preferred language, hardware identifiers, browser type and settings, and other device information.
• Content and information you elect to provide as part of your profile, in reviews, or in emails, chats, or other communications sent to us.
• Social login information. If you sign in using Facebook® Login, we receive the information Facebook® shares with us under your settings, such as your name, email address and profile identifier.
• Images, voice recordings, and videos collected or stored in connection with the Services, if you have provided this information or consented to its collection.
• Identity document information, such as driver's license or passport details and images, collected when we verify your identity, including before a prize redemption. Where we require additional verification, this may also include proof of address, Social Security number confirmation (where legally required), source-of-funds and employment information, and bank account and payment method ownership confirmation.
• Biometric information. Before any prize redemption, we require a biometric liveness check, in which a live image of your face is captured and compared against your identity document, which may involve creating a facial geometry template. This check is mandatory for prize redemptions and is carried out with your consent, as described in Biometric Information below.

Some of this information, including identity document and biometric information, may be considered sensitive data under certain laws. Where required by applicable law, we collect and process sensitive personal data only with your consent. If you choose not to provide or allow us to collect some information, we may not be able to provide you with requested features, services, or information, including prize redemptions.

We also collect:

• Statistical or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive it from personal data. For example, we may aggregate personal data to calculate the percentage of users accessing a specific feature.
• Technical information, about your internet connection and how you interact with the Services, such as clickstream information to, through and from our Services (including date and time), features you view or search for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs), and methods used to browse away from a page.

If we combine or connect non-personal statistical or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as personal data.

Biometric Information

We use biometric information only to verify your identity and to prevent fraud, including confirming that the person requesting a prize redemption is the holder of the Customer Account and of the identity document provided.

Consent. Before any biometric information is collected, you will be informed of the purpose of the collection and of how long it will be kept, and asked to give your written consent, which may be given electronically, in the identity verification flow. If you do not consent, we will not collect your biometric information, but we will be unable to complete identity verification and you will not be able to redeem prizes.

Disclosure. Biometric information is collected and processed on our behalf by our identity verification provider. We do not sell, lease, trade, or otherwise profit from your biometric information, and we do not disclose it to anyone else unless you consent, it is needed to complete a transaction you have requested, or we are required to do so by law, subpoena, or warrant.

Retention and destruction. Biometric information is kept only as long as needed for identity verification and our related legal obligations, and is permanently destroyed when the purpose for collecting it has been satisfied, and in any event no later than three (3) years after your last interaction with us, unless a longer period is required by law.

Protection. We store, transmit, and protect biometric information using a standard of care at least as protective as the one we use for other confidential and sensitive information.

How We Collect Your Personal and Other Data

You provide information to us. We collect information about you when you interact with our Services, such as when you create or update an account, make a purchase, request a prize redemption, request Burger Coins by mail, participate in promotions, complete identity verification, contact Customer Support, or upload or post content to the Services, including reviews, requests or comments.

Automatically through our Services. As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include personal data, such as usage details, IP addresses, operating system and browser type, and information collected through cookies, web beacons, and other tracking technologies, including traffic data, location data, logs, and other communication data. We may use these technologies to collect information about your online activities over time and across third-party sites or other online services (behavioral tracking).

IP address logging. Each time you access the Services, we automatically capture and retain your public Internet Protocol (IP) address. We use it to verify your geographic eligibility, detect the use of VPNs or proxies, prevent multiple accounts, and investigate suspected fraud or abuse.

From business partners and service providers. We may receive personal data about you from other sources and combine it with information we collect directly from you. For example, we may obtain information from service providers that perform services on our behalf, such as email platform providers, content delivery services, payment processors, identity verification providers, geolocation providers, promotions services, gift card program providers, analytics, security and anti-fraud services, and data brokers. We may also receive personal data from business partners that we engage to share consumer information with us, including your personal preferences and demographic information such as age, gender, and income level, so that we can better provide you with a personalized experience.

Cookies and Similar Technologies

The technologies we use for automatic data collection include:

• Cookies. A cookie is a small file placed on your device when you interact with the Services. Some cookies are strictly necessary to run the Services, for example to keep you signed in, confirm your location, and protect against fraud. Others help us understand how the Services are used, remember your preferences, or measure and deliver advertising.
• Web beacons and pixels. Some parts of the Services and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those parts or opened an email, and for other related statistics (such as recording the popularity of certain content and verifying system and server integrity). Our advertising partners, including social media platforms, place pixels on the Services to measure the effectiveness of our advertising.
• Session recording. We use Microsoft Clarity, described below, to record how visitors interact with the Services.

When you interact with the Services, third parties may also use automatic collection technologies to collect information about you or your device. These third parties may include advertisers, ad networks and ad servers, social media platforms, analytics companies, your device manufacturer, and your internet or mobile service provider. The information they collect may be associated with your personal data, or they may collect information about your online activities over time and across different websites, apps, platforms and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content. We do not control these third parties' tracking technologies or how they may be used. If you have questions about an advertisement or other targeted content, you should contact the responsible provider directly.

You can refuse or disable cookies through your browser or device settings, but some features of the Services may then be unavailable, and strictly necessary cookies are required for the Services to work. Your choices about advertising and tracking are described in Your Rights and Choices About Your Information.

Advertising and Analytics Partners

We currently work with the following advertising and analytics partners, which may collect information through cookies, pixels, software development kits and similar technologies on the Services:

• Google Ads (Google LLC), to measure the results of our advertising, build advertising audiences, and show you SweepBurger ads on Google services and partner sites. See the Google Privacy Policy and how Google uses information from sites that use its services; you can manage ad personalization at Google My Ad Center.
• Google Analytics (Google LLC), to understand how visitors use the Services, including pages viewed, time spent and the device and browser used. You can opt out with the Google Analytics Opt-out Browser Add-on.
• Meta (Meta Platforms, Inc.), through the Meta Pixel and related tools, to measure and target our advertising on Facebook and Instagram. See the Meta Privacy Policy.
• TikTok (TikTok Inc.), through the TikTok Pixel, to measure and target our advertising on TikTok. See the TikTok Privacy Policy.
• Snapchat (Snap Inc.), through the Snap Pixel, to measure and target our advertising on Snapchat. See the Snap Privacy Policy.
• Reddit (Reddit, Inc.), through the Reddit Pixel, to measure and target our advertising on Reddit. See the Reddit Privacy Policy.
• Microsoft Clarity (Microsoft Corporation), to understand how visitors use the Services and to improve them. Clarity records your interactions with the Services, including mouse movements, clicks, scrolling, taps, and the pages you visit, and uses them to create session replays and heatmaps. Clarity is configured to mask the content of input fields and sensitive information such as passwords, payment details and identity documents. See the Microsoft Privacy Statement.

Under some state laws, allowing these partners to collect information for targeted advertising may be considered a "sale" or "sharing" of personal data, or "targeted advertising." You can opt out as described in Your Rights and Choices About Your Information, including by using a Global Privacy Control signal. We may change our advertising and analytics partners from time to time and will update this list when we do.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal data, to:

• Provide you with the Services and any content, features, information, or services that we make available through them, including our games and promotions.
• Fulfill and manage Gold Coin purchases, prize redemptions, Daily Bonus claims, requests for Burger Coins by mail, and promotion participation.
• Verify your identity, age and location, and confirm your eligibility to participate and to redeem prizes.
• Detect, prevent and investigate fraud, money laundering, multiple accounts, game malfunctions and other conduct prohibited by the Platform Documents.
• Fulfill any other purpose for which you provide it.
• Provide you with notices about your account.
• Improve our Services, including by analyzing your information and creating aggregated data derived from it to develop, maintain, analyze, improve, optimize, measure, and report on our Services and how users interact with them. Our analysis may include the use of technology like machine learning and large language models, which may include training these models or sharing with third parties for model training.
• Promote our Services, business, and offerings by publishing advertising on our own Services and by placing ads on third parties' services. We may use your information to model, segment, target, offer, market, and advertise our Services.
• Carry out our obligations and enforce our rights arising from any contracts between you and us, including the Platform Documents, and for billing and collection.
• Notify you about updates to the Services and changes to the Platform Documents.
• Support the responsible social gameplay tools described in the Responsible Social Gameplay Policy, including applying any limits or exclusions you set.
• Comply with our legal obligations.
• In any other way we may describe when you provide the information, or for any other purpose with your consent.

The usage information we collect, whether connected to your personal data or not, helps us improve our Services and deliver a better and more personalized experience by enabling us to estimate our audience sizes and usage patterns, store information about your preferences, speed up your searches, and recognize you when you return to our Services.

We may also use your information to contact you about goods and services that may be of interest to you. If you do not want us to use your information in this way, please check the relevant box on the registration form or see Your Rights and Choices About Your Information.

Who We Disclose Your Information To

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose personal data that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to support our organization, including payment processors, identity verification, geolocation, fraud prevention, hosting, analytics, customer support and email providers, who are bound by contractual obligations to keep personal data confidential and use it only for the purposes for which we disclose it to them.
• To the advertising and analytics partners listed in Advertising and Analytics Partners, through the cookies, pixels and similar technologies described in this policy.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Winfield LLC's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by Winfield LLC is among the assets transferred.
• To third parties to market their products or services to you if you have consented to, or not opted out of, these disclosures. We contractually require these third parties to keep personal data confidential and use it only for the purposes for which we disclose it to them.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal data:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply the Platform Documents and other agreements.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our organization, our users, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

The categories of personal data we may disclose include account and contact information; payment information; account history, including purchases and prize redemption requests; demographic information; location information; device information; content and information you elect to provide; images, voice recordings and videos you have consented to; identity document information; and biometric information (only as described in Biometric Information).

Your Rights and Choices About Your Information

This section describes how you can control certain uses and disclosures of your information, and the rights you may have under state law, depending on where you live.

Cookies and other tracking technologies. You can set your browser to refuse all or some browser cookies or other tracking technology files, or to alert you when these files are being sent. You can choose whether to allow the Services to collect information through other tracking technologies by emailing optout@sweepburger.com. If you disable or refuse cookies or similar tracking files, some features of the Services may be inaccessible or not function properly.

Do Not Track. Some browsers include a "Do Not Track" (DNT) setting. Because there is no common understanding of how to interpret the DNT signal, our Services may not respond to all browser DNT signals. You can instead use the other controls described in this policy.

Global Privacy Control. Some browsers and browser extensions support the Global Privacy Control ("GPC"), which sends a signal to opt out of certain types of data processing, including data "sales" and targeted advertising as defined under certain laws. When we detect such a signal, we will treat it as a valid request to opt out as required by applicable law.

Promotions by the Company. If you do not wish us to use your information to promote our own or third parties' products or services, you can opt out by emailing optout@sweepburger.com. You can also unsubscribe from marketing emails using the link in any such email.

Targeted advertising by the Company. If you do not want us to use information that we collect or that you provide to deliver advertisements according to our advertisers' target audience preferences, you can opt out by emailing optout@sweepburger.com.

Disclosure of your information for third-party advertising. If you do not want us to share your personal data with unaffiliated or non-agent third parties for advertising and marketing purposes, you can opt out by emailing optout@sweepburger.com. We do not control third parties' collection or use of your information to serve interest-based advertising, but these third parties may provide you with ways to choose not to have your information collected or used in this way, including through the links in Advertising and Analytics Partners. To learn more about opting out of targeted ads from members of the Network Advertising Initiative ("NAI"), see the NAI's opt-out page.

Location data. You can choose whether to allow the Services to collect and use real-time information about your device's location through your device's privacy settings. However, location information is required to confirm that you are accessing the Services from a jurisdiction where they are permitted, so if you block it you will not be able to access the Services.

Your state privacy rights. Depending on your state of residence, you may have certain rights related to your personal data, including:

• Access and data portability. You may confirm whether we process your personal data and access a copy of it. To the extent feasible and required by state law, data will be provided in a portable format.
• Correction. You may ask us to correct inaccuracies in your personal data, taking into account the information's nature and processing purpose.
• Deletion. You may ask us to delete personal data about you, subject to certain exceptions under applicable law, including records we must keep to comply with legal obligations, complete prize redemptions, or prevent fraud.
• Opt out of targeted advertising, profiling and sales. You may ask us not to use your personal data for these purposes.

The exact scope of these rights varies by state, and there are several exceptions where we may not be obliged to fulfill a request. To exercise any of these rights, email us at support@sweepburger.com. We may need to verify your identity before acting on your request. To appeal a decision about a consumer rights request, email us at support@sweepburger.com with "Appeal of Consumer Rights Decision" in the subject line.

You may also withdraw any consent you have given us, for example to marketing, at any time, without affecting processing that took place before you withdrew it. Where your state's law allows, you may use an authorized agent to submit a request on your behalf; we may ask for proof of the agent's authority and verify your identity directly. We will not discriminate against you for exercising any of these rights.

How We Protect Your Personal Data

We use commercially reasonable administrative, physical, and technical measures designed to protect your personal data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your personal data transmitted to, through, or in connection with the Services. In particular, email, texts, and chats sent to or from the Services may not be secure, and you should carefully decide what information you send through those channels. Any transmission of personal data is at your own risk.

These measures include encryption (SSL/TLS) of data in transit, access controls restricting personal data to authorized personnel, and monitoring and auditing of our systems for potential vulnerabilities. If we become aware of a breach that compromises your personal data, we will notify you and any applicable regulators as required by law.

The safety and security of your information also depends on you. You are responsible for keeping your login details secure, as described in the Terms and Conditions, and for taking steps to protect your personal data against unauthorized use, disclosure, and access.

How We Retain Your Personal Data

We keep the categories of personal data described in this policy for as long as reasonably necessary to fulfill the purposes described or as otherwise legally permitted or required, such as maintaining the Services, operating our organization, complying with our legal obligations, completing prize redemptions, resolving disputes, and for safety, security, and fraud prevention. We consider our legal and business obligations, potential risks of harm, and the nature of the information when deciding how long to retain personal data. At the end of the retention period, personal data will be deleted, destroyed, or deidentified.

Account and compliance data, including identity verification records, balance history and communications, may be kept for up to five (5) years after your account is closed, or longer where required by law. IP address data may be kept for up to five (5) years after your last activity for security, fraud prevention and compliance purposes. Biometric information is retained and destroyed as described in Biometric Information. Retention periods for Burger Coins and other operational data are set out in the Terms and Conditions and the Sweepstakes Rules.

Where Your Information Is Processed

The personal data we collect relates to users located in the United States. It is processed and stored in the United States and, to the extent necessary to operate the Platform, may be accessed by our service providers in the other jurisdictions in which they operate. We take reasonable steps to ensure your personal data remains protected consistently with this policy and applicable law wherever it is processed.

Third-Party Links

The Services may include links to third-party websites or services that we do not operate, including social media platforms. We are not responsible for their privacy practices or content, and we encourage you to review their privacy policies before sharing any personal data with them.

Dispute Resolution

All disputes arising out of or relating to this Privacy Policy or our data practices are subject to the dispute resolution and individual arbitration provisions in clause 20 of the Terms and Conditions, including the class action waiver and your right to opt out. This Privacy Policy does not contain a separate arbitration agreement, governing law provision or forum selection clause.

Changes to Our Privacy Policy

We may update this policy from time to time, and we will provide notice of changes as required by law and as described in the Terms and Conditions. The date the policy takes effect is shown at the top of the page. We will post the updated policy on the Services, and we may also notify you by email or on the Services. Please check the Services periodically to see the current policy.

Contact Information

To exercise your rights, or to ask questions or comment about this privacy policy or our privacy practices, contact us by email:

• General and privacy requests: support@sweepburger.com
• Opt-out requests: optout@sweepburger.com

Revision History