Privacy Policy

The data controller operates under the business name Etermedia. For any question or privacy request, contact [email protected]. The data controller's legal identity, address and registration details are provided in section 10, Operator details and service, of the Terms of Service, linked below.

We receive data from you when you register, update your profile, contact support or request a withdrawal. We also receive technical data from your device and browser, account information from the sign-in provider you choose, and offer status or reversal notices from partners whose offers you use.

Your display name, avatar and selected activity can be visible to other users in public profile, ranking and activity features. Your profile privacy setting limits this visibility. Do not include sensitive personal information in a public display name or support message unless it is necessary.

An email address and sign-in credentials are needed to create an account. Gender and date of birth are required to complete the initial profile and access the service. Date of birth is used to check that you are at least 18 years old; gender is collected to prepare your profile for future surveys. This survey feature is not active yet. Without these fields, initial setup cannot be completed. A wallet address and supported network are needed to request a crypto withdrawal. Postal code, a public profile and analytics or marketing choices remain optional.

Verisoul and CashoutGuard are active fraud prevention providers. The following session collection applies to Verisoul. Its browser SDK collects network, device and behavioral signals, including interaction events, only after you sign in. It is not loaded for guest visits and is stopped when you sign out. Our server submits a session identifier, an opaque account identifier and email to assess registration, sign-in, offers and withdrawals. Risk decisions can stop an action or require human review. Payout destinations and amounts are not sent through this integration. CashoutGuard collects security signals during registration, sign-in, offers and withdrawals. Our server sends its collector request ID, account ID, email and relevant event data, including payout destination, method and amount for withdrawal checks. Each provider can stop an action or require human review.

During registration, Check-Mail receives the domain portion of your email address to identify disposable email services.

Authorized personnel and providers needed to run the service may receive data. These include hosting and database providers, Firebase for authentication, Cloudflare Turnstile for abuse protection, Verisoul, CashoutGuard, FingerprintJS and proxycheck.io for fraud and network checks, Resend for email, and Google Analytics only after analytics consent. If a country cannot be established from other sources, an IP address may be sent to ipwho.is or ipapi.co for country lookup.

The offer network you choose receives an account attribution identifier and information needed to start and validate an offer. Partners may return completion or reversal data. Their own notices govern activity on their sites; read those notices before participating. Data may also be given to authorities when the law requires it.

CashoutGuard is operated by SSWAP MEDIA LLC in the United States. Its published data processing agreement states that data is hosted in the EU and that transfers outside the EEA use standard contractual clauses or another valid mechanism. This describes the provider’s published terms, not a separate verification of each transfer.

Google (Analytics and Firebase), FingerprintJS, Cloudflare and Resend may process data outside the European Economic Area, including in the United States. Google says that its advertising and analytics products may rely on the EU–US Data Privacy Framework for eligible US transfers and on EU standard contractual clauses for other restricted transfers. Google Cloud, FingerprintJS, Cloudflare and Resend publish data processing terms with standard contractual clauses for applicable restricted transfers. The source documents are linked below.

These published terms do not establish which agreement has been accepted for this SproutCents account, which legal entity receives a particular transfer, or which safeguards apply to every subprocessor. proxycheck.io says that a data processing agreement is available on request to paid customers. The safeguards for proxycheck.io, IP lookup providers and each active offer partner still need account-specific verification. Contact [email protected] to ask about the applicable safeguard or how to obtain a copy.

Account and activity records are kept until account closure. Self-service deletion removes the account and related records from the active database and stores a minimal Firebase identifier to complete authentication deletion. Failed attempts are retried automatically, including after a server restart. Completed deletion records are removed after 35 days; requests still pending after 24 hours require operator review. A remaining balance or pending withdrawal must be resolved through support before self-service deletion.

Stored device identifiers, FingerprintJS snapshots, network risk snapshots and last-access IP addresses are removed 90 days after their respective latest observation, with hourly cleanup. Account suspension status remains until closure or review. Local operational log files are retained for 30 days. Rate-limit identifiers are held in memory for the applicable window, up to 24 hours, and purged within a further 10 minutes, including when there are no new requests.

The operator's retention rule for support correspondence is until the request is resolved and for no more than 12 months afterwards. Mailbox deletion requires operator action. Documents necessary for an applicable legal obligation or a specific unresolved dispute may be kept separately, with restricted access, until the statutory period ends or the dispute is resolved; their continuing necessity must be reviewed every three months.

Local database backups are removed after 35 days. The same maximum period must be configured for hosting and mailbox backups before they are used; retention settings for those external copies have not yet been verified. Backups must be excluded from routine use. Before restored data is put back into service, previous erasure requests must be reapplied. External partners manage their own retention periods.

CashoutGuard applies its own retention: event history lasts 7–365 days depending on the plan; device and account links normally expire 12 months after last activity. Its policy keeps blocked or allowlisted accounts and accounts with cashouts while the customer site exists. These periods differ from our 90-day local fraud-signal snapshots. Contact us for requests concerning data held by this provider.

Security rate-limit entries expire after their short operational window. Your cookie choice is stored in your browser for six months unless processing conditions change. Your site language choice is stored in a first-party cookie for one year and can be changed in the footer. Our Google Analytics 4 property is set to retain event-level data for 2 months and user-level data for 14 months. Reset on new user activity is enabled: each new event restarts the retention period for that user identifier, so an active identifier may remain longer than 14 months. Standard aggregate reports are not governed by these settings. We review retention when its purpose ends and remove or anonymize data that is no longer needed.

You may request access, correction, erasure, restriction, portability where available, objection, or withdrawal of consent. Email [email protected]. We may verify your identity to protect your account. We normally respond within one month, subject to extensions allowed by the GDPR. You can change cookie preferences at any time using the link in the footer.

You have the right to lodge a complaint with a data protection supervisory authority.

The site uses technical indicators and risk scores to detect VPNs, proxies, duplicate accounts and possible abuse. These checks can automatically block registration or access, or cause a withdrawal to be reviewed. A false positive could prevent you from using the service or delay a reward. If you believe a decision is wrong, contact [email protected] to explain your position and request a human review.

The service is for people aged 18 or over. If we discover an account held by a minor, we may close it and handle the request under applicable law.

We restrict access to personal data to people and providers who need it for the purposes described above and use technical and organizational measures appropriate to the risks. No online service can guarantee absolute security; tell us promptly if you suspect unauthorized account access.

We will update this notice when our processing changes and inform users of material changes where required. This notice covers processing by the SproutCents operator; external sites have their own privacy notices.