1. Introduction

Rune Riches (“we,” “us,” or “our”) operates runeriches.com, a sweepstakes-based social casino platform available to eligible residents in the United States. We are committed to protecting the privacy and security of the personal information you share with us.

This Privacy Policy explains what personal information we collect, how we use and share it, how we protect it, and your rights with respect to it. By accessing or using our services, you agree to the terms of this Privacy Policy.

This platform is intended solely for use by individuals aged 21 or older. We do not knowingly collect personal information from anyone under the age of 21. If you believe a minor has provided us with personal information, please contact us at support@runeriches.com and we will promptly delete it.

2. Information We Collect

2.1 Information You Provide

When you register, verify your identity, make purchases, or contact us, we collect:

• Full legal name
• Email address
• Date of birth (for age verification)
• Phone number
• Billing address
• Payment card information (processed and stored by our PCI-DSS compliant payment processor; we do not store full card numbers)
• Last 4 digits of your Social Security Number — collected solely for identity verification and, where required, for IRS tax reporting on prizes (see Section 5)
• Username and password (password stored in hashed form)
• Communications you send to us (support requests, survey responses)

2.2 Information Collected Automatically

When you use our website, we automatically collect:

• 1. IP address and approximate geographic location
• 2. Browser type and version, operating system, device type
• 3. Referring URLs, pages viewed, session duration, and click paths
• 4. Cookie identifiers and similar tracking technologies (see Section 6)

2.3 Information from Third Parties

We may receive information about you from identity verification providers, fraud-prevention services, payment processors, and marketing affiliates through whom you reached our platform. We combine this information with information we hold about you to verify your identity, prevent fraud, and fulfill our legal obligations.

3. How We Use Your Information

We use your personal information for the following purposes:

• Contract performance: Account registration, identity verification, and KYC compliance
• Contract performance: Processing purchases, redemptions, and sweepstakes entries
• Contract performance: Communicating about your account, transactions, and service updates (these are not optional while your account is active)
• Legal obligation: Complying with applicable laws including sweepstakes regulations, anti-money laundering requirements, and IRS tax reporting obligations
• Legitimate interest: Fraud detection, risk assessment, and platform security
• Legitimate interest: Responsible gaming monitoring and enforcement
• Legitimate interest: Improving our platform, analytics, and user experience
• Legitimate interest / Contract performance: AI-assisted support, moderation, and operational processing as described in Section 10
• Consent / Legitimate interest: Sending promotional emails, special offers, and newsletters, if you have opted in or not opted out
• Consent / Legitimate interest: Personalising offers and marketing communications based on your gameplay activity and purchase history, including the frequency, type, and value of purchases and sweepstakes entries, in order to make our promotions more relevant to you.

We collect your last 4 SSN digits and date of birth solely to verify your identity and, where required, to satisfy IRS reporting requirements for prize winners (Form 1099). This information is never used for marketing and is never shared with third parties except as required by law.

How We Share Your Information

We do not sell your personal information. We share your information only in the following limited circumstances:

4.1 Service Providers

We share information with vendors who perform services on our behalf, such as payment processing, identity verification, fraud prevention, cloud hosting, email delivery, customer support, and AI-assisted processing. These providers are contractually bound to use your information only to perform services for us and to maintain appropriate security. See Section 10 for details specific to AI and large language model providers.

4.2 Marketing Partners and Affiliates

We may share your name, email address, and phone number with marketing partners or affiliates through whom you reached our platform, or with companies whose offers we believe may interest you. We will NOT share your payment information, SSN digits, KYC documents, or government-issued identification with any marketing partner or affiliate for any purpose.
You may opt out of this marketing-related sharing at any time by contacting us at support@runeriches.com or by using the unsubscribe link in any marketing
communication.

4.3 Legal and Regulatory Disclosure

We may disclose your information where required by law, court order, regulatory authority, or to protect the rights, property, or safety of Rune Riches, our users, or others.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the successor entity. We will notify you via email and/or a prominent notice on our website prior to your information becoming subject to a different privacy policy.

4.5 Aggregated Data
We may share aggregated, anonymised statistics (e.g., “60% of our users play on mobile”) with partners, advertisers, and the public. This data cannot be used to identify any individual.

5. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including to comply with our legal obligations:

• Account and transaction records: retained for a minimum of 5 years following account closure to comply with anti-money laundering and sweepstakes record-keeping requirements
• KYC and identity verification documents: retained for 5 years following the end of the customer relationship, or longer if required by applicable law
• IRS tax records (including last 4 SSN digits collected for 1099 reporting): retained for 7 years in accordance with IRS requirements
• Marketing contact preferences and opt-out records: retained indefinitely to honour your preferences
• Technical logs and analytics data: retained for up to 2 years, then aggregated or deleted

When your personal information is no longer required, we will securely delete or anonymise it.

6. Cookies and Tracking Technologies

We use cookies, pixel tags, and similar technologies to operate our website, remember your preferences, analyse usage patterns, and deliver relevant communications. Categories of cookies we use:

• Essential cookies: required for the website to function (login sessions, security tokens). Cannot be disabled.
• Analytics cookies: help us understand how users interact with our site (e.g. Google Analytics). You may opt out via your browser settings or the Google Analytics Opt-out Browser Add-on.
• Marketing and affiliate cookies: used to attribute your visit to a referring affiliate and to deliver relevant offers. You may opt out of marketing cookies via your browser settings or by contacting us.

You can remove or block cookies by adjusting your browser settings. Note that disabling certain cookies may affect the functionality of our platform.

7. Data Security

We implement industry-standard technical and organisational measures to protect your personal information, including:

• TLS encryption for all data in transit between your browser and our servers
• Encryption at rest for sensitive personal data fields (including payment data and identity verification information)
• Role-based access controls limiting employee access to personal data on a need-to-know basis
• Regular security assessments and employee security training
• Secure hosting environment with physical access controls

No method of data transmission or storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you and applicable regulatory authorities as required by law, within the timeframes prescribed by applicable state breach notification laws (typically 30–72 hours of confirmed discovery for regulatory notice, and “expedient” or “prompt” notice to affected individuals).

8. Your Privacy Rights

8.1 Rights Available to All Users

Regardless of where you are located, you may:

• Access the personal information we hold about you by logging into “My Account” or by submitting a request to support@runeriches.com
• Correct inaccurate personal information by updating your account or contacting us.
• Unsubscribe from marketing emails at any time using the unsubscribe link in any email or by contacting support
• Request deletion of your account and associated personal information, subject to our legal retention obligations described in Section 5

8.2 California Residents — CCPA/CPRA Rights

If you are a California resident, noting that you cannot lawfully play from within California and that we block all activity from California, you have the following additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• **Right to Know: **You may request that we disclose the categories and specific pieces of personal information we have collected about you, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions (e.g., information required for legal compliance or active transactions).
• **Right to Correct: **You may request that we correct inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing: We do not sell your personal information in the traditional sense. However, to the extent that our sharing of personal information with marketing partners constitutes “sharing” under the CPRA for cross-context behavioral advertising purposes, you have the right to opt out. You may exercise this right by contacting us.
  -** Right to Limit Use of Sensitive Personal Information:** You may request that we limit the use of sensitive personal information (including SSN digits, financial account data, and precise geolocation) to only that which is necessary to provide our services or as required by law.
• **Right to Non-Discrimination: **We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a verifiable consumer request, contact us at support@runeriches.com with the subject line “California Privacy Request.” We will acknowledge your request within 10 business days and respond within 45 calendar days. We will require verification of your residency along side your request to process it.

8.3 Other US State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of certain processing of their personal information. To exercise these rights, contact us at support@runeriches.com. We will respond in accordance with the applicable law in your state.

9. Communications from Rune Riches

9.1 Transactional and Service Communications

We send account-related communications including welcome emails, purchase confirmations, withdrawal notifications, identity verification requests, and security alerts. These communications are a necessary part of operating your account and cannot be opted out of while your account is active.

9.2 Promotional Communications

With your consent or where permitted by applicable law, we may send you promotional emails about special offers, bonuses, new features, and platform news. You may opt out at any time by:

• Clicking the unsubscribe link in any promotional email
• Contacting us at support@runeriches.com

Opting out of promotional communications will not affect transactional communications related to your account.

9.3 Phone Contact

We may ask for your phone number and call you during the onboarding period to assist with setup, verify your identity, support fraud prevention or address complex account queries. We will not call you for marketing purposes unless you have separately consented to such contact.

10. AI and Automated Processing

10.1 How We Use AI and Large Language Models

We use artificial intelligence tools, including large language models (LLMs) provided by third-party AI providers, to support the operation of our platform. Current uses include:

• Customer support assistance: summarising support queries, drafting responses, and routing tickets to the appropriate team
• Content and chat moderation: identifying potential violations of our community guidelines
• Fraud and risk review: assisting our team in reviewing flagged transactions and account activity
• Operational processing: internal analysis and summarisation of platform activity to support compliance and business operations

10.2 What Data Is Submitted to AI Providers

When personal data is submitted to an LLM provider, it is limited to the minimum necessary for the task. We apply the following restrictions:

• We do not submit raw payment card data, full SSN digits, or government-issued ID documents to LLM providers
• Support interactions may include your name, account identifier, and the content of your support query
• Fraud review inputs may include account activity summaries, transaction metadata, and behavioural signals — not raw financial credentials
• We do not submit data to LLM providers for the purpose of training their models; where available, we use API configurations that exclude our data from model training

10.3 AI Providers as Data Processors

AI providers who receive personal data on our behalf act as data processors under data processing agreements that require them to: process data only on our instructions; maintain appropriate technical and organisational security measures; and not use your data for their own purposes, including model training, unless separately required by law.

10.4 Human Oversight of AI Outputs

AI tools on our platform are used to assist human decision-making, not to replace it. Decisions that have a significant effect on your account — including fraud determinations, account suspensions, and redemption holds — are reviewed and confirmed by a member of our team before action is taken. AI outputs are not acted upon automatically in ways that could adversely affect your account without human review.

10.5 Your Rights in Relation to AI Processing

You have the right to:

• Request information about whether AI tools have been used in a decision affecting your account
• Request human review of any decision that was informed by AI processing and that has had a significant effect on your account
• Object to AI-assisted processing in certain circumstances — contact us at support@runeriches.com to make such a request

We do not make solely automated decisions that produce legal or similarly significant effects without human review. If you believe an AI-assisted decision has been applied to your account in error, contact support@runeriches.com and we will arrange for a manual review.

11. Minors

Our platform is strictly for use by individuals aged 21 or older. We do not knowingly collect, use, or share personal information from minors under the age of 21. If we become aware that we have inadvertently collected information from a minor, we will delete it promptly. If you believe a minor has registered on our platform, please notify us immediately at support@runeriches.com.

12. Third-Party Links

Our website may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party sites, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the “Last Updated” date at the top of this page and notify you by email or via a notice on our website at least 14 days before the changes take effect. Your continued use of our services after the effective date constitutes your acceptance of the updated policy.

14. How to Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Rune Riches — Privacy Team
Email: support@runeriches.com

We aim to respond to all privacy-related enquiries within 10 business days.