E-Laab Gamification Platform

Privacy Policy

How E-laab collects, uses, shares, retains and deletes personal data across the campaigns, games and prize experiences run on our platform — and the specific commitments we make to Meta, Google, Apple and the other sign-in providers whose data we handle.

Policy version 2026-08-01 (draft) · Effective: [DD Month 2026] · Languages: English · العربية

1. Who we are, and which half of this policy applies to you

[LEGAL ENTITY NAME], a company registered in [JURISDICTION] under number [REG. NO.] with its registered office at [REGISTERED ADDRESS] ("E-laab", "we", "us"), operates the E-laab gamification platform at e-laab.com and on customer-branded domains.

E-laab is business software. Brands, retailers and agencies (our tenants) use it to build promotional campaigns — prize games, spin-to-win wheels, quizzes, receipt promotions, loyalty mechanics — which they then publish to their own audiences. That structure means we wear two different hats, and which one we are wearing decides who is answerable to you.

If you are a player

You entered a campaign, played a game, or claimed a prize. In almost all cases the tenant running that campaign is the controller of your personal data: they decided to run the promotion, they chose what to ask you, and they decide what happens to your entry afterwards. E-laab acts as their processor — we host and operate the campaign on their instructions under a written data processing agreement.

Practically: you can always contact us and we will help, but requests to access, correct or erase your data may be routed to the tenant, and their own privacy notice governs what they do with entries after the campaign closes. The tenant is named on every campaign page.

We are an independent controller for a narrow set of player data we determine ourselves: security and anti-fraud signals, platform-level audit logs, aggregated and de-identified usage statistics, and any direct correspondence you send us.

If you are a workspace user

You have a login to the E-laab admin workspace as an employee or contractor of a tenant, a retailer, or E-laab itself. For your account data, E-laab is the controller and this policy applies in full.

If you are a visitor

You are reading our marketing site or contacting us. E-laab is the controller.

2. Scope and key terms

This policy covers the E-laab platform: campaign landing pages and games, the player hub and mobile experiences, the admin workspace, our APIs, the messages we send on a tenant's behalf, and our marketing site.

This policy does not cover what a tenant does with data inside its own systems once it has been exported or synced to that tenant's CRM — see section 8.

3. Personal data we collect

Campaigns are configurable, so the exact fields collected vary. What follows is the complete set of categories the platform is capable of collecting; any individual campaign will use a subset, and the entry form shows you what it is asking for at the moment it asks.

3.1 Information you give us when you play

3.2 Information we generate about your play

3.3 Information collected automatically

3.4 Consent records

Every consent is written to an append-only ledger: what you consented to, the purpose, the version and a cryptographic hash of the policy text in force at that moment, the time, and the IP address and browser the consent came from. We never overwrite these rows — a withdrawal is recorded as a new entry — so the question "what did this person agree to, and when" always has an answer.

3.5 Information about workspace users

Name, work email, phone, role and permissions, employer or tenant, password credentials in hashed form, multi-factor secrets, login history, IP addresses, and a full audit trail of actions taken in the workspace.

3.6 Information from third parties

3.7 What we do not collect

We do not ask for special-category data — health, religion, political opinions, biometrics, sexual orientation — and campaigns must not be configured to collect it. We do not collect government identity numbers except where a specific prize or tax rule makes it unavoidable, in which case it is collected at claim time and clearly explained. Payment card details, where a campaign involves payment, are handled by a payment provider and never reach or persist in E-laab systems.

4. Data we receive from social sign-in providers

Some campaigns let you enter by signing in with an existing account instead of filling in a form. When you do, the provider asks for your permission and then sends us a limited profile. We never receive or store your password for that account, and we never post anything to your account, follow anyone on your behalf, or read your friends, contacts, messages, photos or timeline.

The platform is capable of receiving the following fields, and no others: Facebook — email address, name, profile picture, birthday, gender; Google — email address, name, given name, family name, profile picture, locale; Apple — email address (real or Apple's private relay address), name. (The source draft also listed X and TikTok; X and Pinterest social mechanics were removed from the platform on 2026-09-26 — see stale-service note.)

Two filters apply on top of that, and both are enforced in code rather than by policy alone: (1) the tenant building the campaign selects which of those fields the campaign needs, and fields they did not select are discarded on arrival and never written to storage; (2) anything outside the list above is discarded even if the provider sends it, because our storage layer only recognises the listed fields.

We use this profile to create or recognise your player record, to save you re-typing your name and email, to check age where a campaign is age-gated, and to contact you about the campaign and any prize. We do not use it to build a profile of you across tenants, and one tenant never sees data captured under another tenant's campaign. You can revoke our access at any time from the provider's app or connected-accounts settings — section 15 explains what happens to data we already hold when you do.

5. Why we use your data, and our legal basis

Where the GDPR, UK GDPR or a comparable law applies, we rely on performance of a contract (to run the campaign, register entries, decide and award prizes, deliver prizes and send transactional messages), legal obligation (age and eligibility checks, prize-regulation, tax and audit), legitimate interests (fraud and abuse prevention, security, platform operation and tenant reporting), and consent (for marketing, and for non-essential cookies). Where E-laab acts as a processor, the basis is the tenant's to establish and we act on their documented instructions.

We do not sell personal data, we do not share it with data brokers, and we do not use it for cross-context behavioural advertising.

6. Fair play, anti-cheat and automated decisions

Prize promotions attract automated abuse. To keep them fair we run integrity checks on entries. We check rate and volume (how many entries come from one IP address or one device fingerprint within a time window, against limits the tenant sets), connection reputation (whether your IP is a known VPN, proxy, Tor exit node or data-centre address), email genuineness (where the tenant enabled it), and eligibility (age, region, entry caps and campaign-specific rules).

An entry can be blocked at submission, flagged for review, or held back from prize allocation. In a small number of configurations this decision is fully automated and can prevent you from entering or claiming a prize. Where a decision about you is made solely by automated means and has a legal or similarly significant effect, you have the right to obtain human intervention, to express your point of view, and to contest the decision — write to [privacy@e-laab.com] quoting the campaign and the approximate time of your entry, and a person will review it.

We do not use these signals for any purpose other than integrity, security and the reporting of aggregate abuse rates. They are never used to target advertising, to score you as a customer, or to make decisions about credit, insurance, employment, housing or eligibility for any service outside the campaign.

7. Cookies, local storage and email tracking

We use cookies and equivalent browser storage for four things: strictly necessary (keeping you signed in, holding your place in a game, protecting forms against abuse, remembering your language — these cannot be switched off without breaking the service); integrity (the device fingerprint described in section 6); preferences (dismissed banners, theme and locale); and measurement (anonymous or aggregated counts of how campaign pages perform, where a tenant has enabled it).

Where local law requires consent for non-essential cookies, we ask for it before setting them, and you can change your mind from the cookie controls on the page.

Email tracking. Messages we send on a tenant's behalf can include an invisible image that tells us the message was opened, and links that pass through our servers so we can record the click before forwarding you on. If you would rather not be counted, most email clients can block remote images, and every marketing message carries an unsubscribe link that works in one click. We do not run third-party advertising trackers or advertising pixels on campaign pages served by E-laab.

8. Who we share data with

We share personal data only in the categories below. We do not sell it, rent it, license it or trade it.

8.1 The tenant running the campaign

Entries, outcomes and the fields the campaign collected are visible to the tenant that ran it, and to the agency or retailer partners the tenant authorises inside its own workspace. Tenants are contractually bound to use that data only for the promotion and for purposes disclosed in their own privacy notice.

8.2 Our service providers

These vendors process data on our instructions, under written terms, and only to provide their service to us. Which ones apply to you depends on the campaign's configuration: cloud hosting, storage and secrets (Amazon Web Services); content delivery and network protection (Cloudflare); transactional and campaign email (Amazon SES); SMS and push notifications (Amazon SNS; web push services); messaging via WhatsApp (WhatsApp Business Platform / Meta); VPN, proxy and connection-reputation checks ([ACTIVE VPN PROVIDER]); email genuineness checks (IPQualityScore); error monitoring and performance (Sentry; New Relic); prize fulfilment and delivery (marketplace and gift-card fulfilment partners, and couriers, per prize); wallet passes (Apple Wallet; Google Wallet); and AI assistance for campaign copy (Anthropic — campaign briefs written by workspace users, no player personal data is sent).

8.3 Tenant-owned integrations

A tenant can connect its own CRM, marketing platform or webhook endpoint using its own credentials, and route entry data there. Once data reaches a tenant's own system, that tenant is the controller of it and this policy stops applying — their notice takes over. We do not operate, hold credentials for, or receive data from a shared E-laab CRM account, by design.

8.4 Legal, corporate and safety

We disclose personal data where we are legally required to, to comply with a valid legal process, to enforce our terms, to protect the rights, property or safety of E-laab, our tenants or the public, and to prosecute or defend legal claims. If E-laab is involved in a merger, acquisition, financing or sale of assets, personal data may transfer as part of that transaction and will remain subject to this policy until the acquirer gives notice of a change.

8.5 Support access

To reproduce and fix a problem, a platform administrator may temporarily enter a tenant's workspace and see that tenant's live data. Access is short-lived, restricted to authorised staff, and every start and stop is written to an audit log the tenant can inspect.

9. Meta Platform: specific disclosures

This section applies where you signed in with Facebook, or where a tenant messages you through the WhatsApp Business Platform. It is written to satisfy Meta's Platform Terms and Developer Policies and it prevails over anything more general elsewhere in this policy.

What we receive from Meta: only the fields listed for Facebook in section 4 — email address, name, profile picture, birthday and gender — and only those a given campaign has been configured to request and you have permitted. We request the narrowest set of permissions each campaign actually needs. We use it to create or match your player record, pre-fill your name and email, check age where a campaign is age-gated, contact you about your entry and prize, and apply eligibility or personalisation rules the tenant published in the campaign terms — never for advertising or profiling.

What we will never do with it: sell, license, rent, trade or otherwise transfer Meta data for value; transfer it to any data or information broker, ad network, ad exchange or monetisation service; use it to make eligibility decisions about credit, insurance, employment, housing, education or government benefits; combine it with data from a broker or use it to build a profile of you outside the campaign; use it to identify a person or device across services or to re-identify de-identified data; use it to target advertising or build lookalike or custom audiences; or place it in any product that is not the E-laab platform.

You can remove E-laab's access at any time from Facebook Settings → Apps and Websites, which stops further data flowing to us and triggers our deletion process (section 15). Where a tenant messages you through WhatsApp it does so under Meta's WhatsApp Business Messaging Policy and only after you have opted in; you can stop the messages at any time by replying to opt out.

10. Google, Apple and other sign-in providers

The commitments in section 9 — no sale, no brokers, no ad networks, no eligibility decisions, no cross-service profiling, no re-identification — apply equally to data we receive from every other sign-in provider. In addition: our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and we do not use Google user data to train generalised AI models. We support Sign in with Apple and honour Apple's private email relay; if you use the relay address, that is the only address we hold.

11. International transfers

E-laab operates primarily from [PRIMARY REGION, e.g. AWS eu-central-1]. Some of our service providers, and some of our tenants, are located elsewhere, so your data may be transferred to and processed in countries other than your own. Where we transfer personal data out of the EEA, the UK, Saudi Arabia or another jurisdiction with transfer restrictions, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), the destination regulator's approved transfer mechanism, or your explicit consent where no other route applies. You can request a copy of the safeguards that apply to a specific transfer by writing to the address in section 21.

12. How long we keep data

We keep personal data only as long as we need it, then delete it or irreversibly anonymise it. Where E-laab acts as a processor, the tenant may set a shorter period, and we honour a tenant's deletion instruction at any time. Indicative periods (proposals pending verification): campaign entries and attempt records — [90 days] after the campaign closes; winner and prize-award records — [7 years]; social sign-in profile data — same period as the entry it belongs to; receipt images and uploaded proof — [180 days] after verification; marketing contact records — until you withdraw consent or after [24 months] of inactivity; consent ledger entries — [7 years]; suppression and unsubscribe lists — indefinitely; integrity and anti-cheat signals — [12 months]; security, access and audit logs — [12 months]; error and diagnostic reports — [90 days]; workspace user accounts — life of the account, then [12 months]; backups — [35 days].

Deleting data from live systems does not immediately remove it from encrypted backups. Backups age out on the schedule above and deleted records are not restored into live systems; if a restore is ever necessary, we re-apply outstanding deletions to the restored data.

13. How we protect data

We maintain technical and organisational measures appropriate to the risk, including: encryption in transit and at rest; strict tenant isolation so one tenant's data is never reachable from another's session; role-based access control with least privilege; multi-factor authentication and short-lived tokens for administrative access; secrets held in a managed secret store rather than in code; audit logging of privileged actions including support access; rate limiting and abuse protection on public endpoints; vulnerability management and dependency patching; and access reviews for staff and contractors.

No system is perfectly secure, and we cannot guarantee absolute security. If a personal data breach occurs, we will notify the affected tenant without undue delay so that they can meet their own notification duties, notify the competent supervisory authority where we are required to, and notify affected individuals directly where the law requires it. Please help us: use a strong, unique password for your workspace account, keep your multi-factor device secure, and tell us immediately at [security@e-laab.com] if you suspect unauthorised access.

14. Your rights and how to exercise them

Depending on where you live, you have some or all of the following rights over your personal data: access, rectification, erasure (section 15), restriction, portability, objection (to processing based on legitimate interests, and at any time to direct marketing), withdraw consent, human review of a solely automated decision that significantly affects you (section 6), and no discrimination for exercising a right. A campaign may still require data it genuinely needs to run — you cannot win a physical prize without a delivery address.

To make a request, write to [privacy@e-laab.com] or use the in-product controls where a campaign provides them. Because E-laab is usually a processor for player data, we will either forward your request to the tenant that controls it, or act on it directly where the tenant has authorised us to. We verify your identity before acting — usually by confirming control of the email address or phone number on the record. We respond within 30 days, and will tell you if we need a permitted extension.

15. Deleting your data

This section is E-laab's data deletion instruction page. To delete data collected through a social sign-in: (1) remove E-laab's access from the provider — for Facebook, Settings → Apps and Websites → E-laab → Remove — which stops any further data reaching us; (2) email [privacy@e-laab.com] from the address on your account, with the subject "Delete my data", telling us which sign-in provider you used and, if you know it, which campaign you entered. To delete any other data we hold about you, email the same address with the subject "Delete my data" from the address or phone number on the record.

What happens next: we acknowledge your request within 5 business days and give you a reference; we verify that the request is genuinely yours (section 14); where the data belongs to a tenant's campaign, we notify that tenant, who is the controller, and act on their instruction — or act directly where they have authorised us to; we complete deletion within 30 days of verification and confirm in writing what was deleted and what, if anything, we kept; deleted records age out of encrypted backups within [35 days] and are never restored into live systems.

What we may keep, and why: we may retain a minimum record where the law requires it or where we have an overriding legitimate ground — prize award records for tax and prize-regulation audit; consent ledger entries as evidence of lawful processing; suppression-list entries so that we continue not to contact you; and records needed for an ongoing legal claim or fraud investigation.

16. Children and age gating

The E-laab platform is not directed at children. The admin workspace is for business users only. Campaigns are set to a minimum age of 18 by default, and a tenant may set a different minimum where a promotion lawfully allows it — but never below 13, and never below the local minimum age of digital consent where that is higher. Where a campaign is age-gated we check the date of birth or age confirmation you provide, and entries that fail the check are refused. We do not knowingly collect personal data from a child below the applicable minimum; if you believe a child has given us data, write to [privacy@e-laab.com] and we will delete it promptly and tell the relevant tenant.

17. Marketing messages

There are two kinds of message you may get from us, and the difference matters. Transactional messages relate to something you did (your entry was received, you won, your prize has shipped, your code is ready, someone tried to sign in). You cannot unsubscribe from these while you have an active entry or account, because they are how the service works. Marketing messages promote the tenant's products or future campaigns; we only send these where you opted in — or where a soft opt-in is lawful in your country following an entry — and your choice is recorded in the consent ledger with a timestamp.

Every marketing message carries a one-click unsubscribe link, and unsubscribing takes effect immediately across that tenant's campaigns. You can also reply STOP to an SMS, opt out of a WhatsApp thread, turn off push in your browser or device settings, or write to [privacy@e-laab.com]. Unsubscribing from marketing does not remove your entry or forfeit a prize.

18. Prizes, winners and leaderboards

Some campaigns publish a leaderboard or announce winners. Where they do, the campaign terms say so before you enter, and what is shown is limited to a display name or a masked name (for example a first name and a last initial) plus a score or prize. We do not publish your email address, phone number or full address. To deliver a physical prize we pass your name, address and phone number to the fulfilment partner or courier handling it; to deliver a digital prize we pass only what that partner needs to issue the code or pass. Where a campaign requires publication of your name as a condition of winning, that requirement is in the campaign terms, and you can decline — though declining may mean the prize passes to another entrant if the terms say so.

19. Tenant-branded experiences and other sites

Campaigns often run on a tenant's own domain and carry the tenant's branding, so you may not realise E-laab is underneath. This policy still governs how the E-laab platform handles your data in that setting, alongside the tenant's own privacy notice, which governs their use of it. Where the two conflict on something we control, this policy applies; where they conflict on something the tenant controls, theirs applies. Campaign pages may link to a tenant's site, a retailer, an app store or a social platform — we do not control those destinations and are not responsible for their privacy practices.

20. Changes to this policy

We update this policy when the platform, our vendors or the law changes. Every version carries a version identifier and an effective date at the top of this page, and we keep a hash of the exact text in force with each consent we record — so what you agreed to is always recoverable. For a material change we will give notice before it takes effect, by email where we have your address, by a notice in the workspace for tenant users, and by re-asking for consent at the point of play where a change affects a purpose you consented to. Previous versions are available on request.

21. Contact us and complaints

Privacy questions and rights requests: [privacy@e-laab.com]. Data deletion (section 15): [privacy@e-laab.com], subject "Delete my data". Security reports: [security@e-laab.com]. Data Protection Officer: [DPO NAME AND ADDRESS, or "not appointed — not required"]. EU/UK representative: [NAME AND ADDRESS, or "not applicable"]. Postal: [REGISTERED ADDRESS].

Please come to us first — we would rather fix it. You also have the right to complain to a data protection authority: in the EEA or UK, the authority where you live, work or where the issue arose; in Saudi Arabia, the Saudi Data & AI Authority (SDAIA); in the UAE, the UAE Data Office; elsewhere, your national regulator. This policy is governed by the law of [JURISDICTION], without prejudice to the mandatory consumer and data protection rights you have where you live.

Draft for legal review — not published. Bracketed placeholders and drafting notes must be resolved before publication.