Privacy Policy

1. Introduction

This Privacy Policy explains how Sweepus, a trading name of Scrumpack ("we", "us", "our"), collects, uses and protects personal information when you use the Sweepus service available at sweepus.minicrms.com.

Sweepus is a social platform that allows users to create and participate in private sweepstakes with friends, family, colleagues and other groups.

We are committed to protecting your privacy and complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR) where applicable.

For privacy-related enquiries, please contact: sweepus@minicrms.com

2. Who We Are

Sweepus is operated by Scrumpack.

For the purposes of data protection law, Scrumpack acts as the data controller for personal information processed through the Sweepus platform.

3. Eligibility

Sweepus is intended for individuals aged 16 years or older.

By using the platform, you confirm that you are at least 16 years of age.

4. Information We Collect

The information we collect depends on how you use the service.

Information You Provide

You may provide:

• Display name
• Real name (optional)
• Email address (optional)
• Profile image (optional)
• Sweepstake names and descriptions
• Team selections and sweepstake assignments
• Messages or communications sent through the platform

Display names may be real names, nicknames, aliases or other identifiers chosen by users.

Information Provided About Other Participants

When creating a sweepstake, organisers may enter participant names manually, upload or enter participant email addresses, and invite participants to join a sweepstake.

By providing another person's email address, you confirm that you have permission to do so for the purpose of inviting them to participate in a private sweepstake.

Technical Information

We may automatically collect:

• IP address
• Browser type
• Device information
• Operating system
• Date and time of access
• Log and diagnostic information
• Pseudonymous browser and session identifiers
• Acquisition source, campaign tags and sanitised referring page

For growth attribution, Sweepus uses random browser identifiers that are hashed before storage. Referring links are reduced to their host and path; query strings and fragments are not retained. We do not use device fingerprinting for this purpose.

5. How We Use Information

We use information to:

• Create and manage sweepstakes
• Invite participants
• Display leaderboards and standings
• Authenticate users
• Maintain platform security
• Prevent misuse and fraud
• Respond to support requests
• Improve platform functionality
• Understand which sources and shared sweepstakes lead to new accounts
• Send service-related communications
• Send marketing communications where permitted by law

6. Marketing Communications

If you provide an email address, we may send product updates, feature announcements, service notifications and promotional communications.

You may unsubscribe from marketing communications at any time using the unsubscribe link included in our emails or by contacting us directly.

Service-related communications may still be sent where necessary to operate your account or sweepstake.

7. Legal Basis for Processing

Where UK GDPR or EU GDPR applies, we process information on one or more of the following legal bases:

• Performance of a contract
• Legitimate interests
• Consent
• Compliance with legal obligations

Our legitimate interests include operating, securing and improving the Sweepus platform.

8. Payments and Prizes

Sweepus does not collect, process or hold entry fees, prize funds, gambling stakes or winnings.

Any payments, prizes, contributions or financial arrangements relating to a sweepstake are arranged solely between participants. Sweepus is not responsible for such arrangements.

9. Data Storage and Security

We take reasonable technical and organisational measures to protect information against unauthorised access, loss, misuse or disclosure.

Information is stored using cloud infrastructure and service providers located within the UK and European Economic Area where possible.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Third-Party Service Providers

We use trusted third-party service providers to operate the platform. These may include:

• Supabase (database, authentication and storage services)
• Email delivery providers
• Infrastructure and hosting providers

These providers process information only as necessary to provide services to us.

11. Retention of Information

We retain personal information only for as long as reasonably necessary to operate the service, maintain records, resolve disputes and comply with legal obligations.

When accounts are deleted, personal identifiers may be removed or anonymised.

Historic sweepstake records may be retained in anonymised form for statistical, operational and historical purposes.

12. Your Rights

Depending on your location, you may have rights to access your information, correct inaccurate information, delete information, restrict processing, object to processing, withdraw consent and request data portability.

To exercise these rights, contact: sweepus@minicrms.com

13. International Transfers

If information is transferred outside the UK or EEA, we will take appropriate safeguards required by applicable data protection laws.

14. Cookies

Sweepus may use essential cookies necessary for operation of the platform.

Where additional analytics or advertising technologies are introduced in future, this policy may be updated accordingly.

15. Growth Attribution

We may associate a pseudonymous public leaderboard visit with a new Sweepus account created in the same browser within 90 days. This helps us understand first-touch and last-touch acquisition sources, and which sweepstakes contribute to product growth.

Authorised administrators can view aggregated reports and privacy-safe journey details. Anonymous visitors appear only under a short, non-reversible identifier. Account details are shown in a journey only after a successful conversion. This attribution does not follow people across devices and may be incomplete when browser storage is cleared.

16. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available at sweepus.minicrms.com.

Continued use of the platform after changes are published constitutes acceptance of the updated policy.

17. Contact Us

If you have any questions about this Privacy Policy or how your information is handled, please contact: sweepus@minicrms.com