Privacy Policy

Version: 1.0  |  Last Updated: November 10, 2026

1. Introduction

Welcome to Foxy Flush ("we," "us," or "our"), accessible at foxyflush.online. We are committed to protecting the privacy and personal data of every individual who visits, registers on, or interacts with our platform. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have as a data subject.

By accessing or using our website, creating an account, or engaging with any of our services, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy. This document should be read alongside our Terms and Conditions and our Responsible Gaming page, which together form the full framework governing your relationship with Foxy Flush.

We reserve the right to update this Policy periodically. Any material changes will be communicated to you via email or a prominent notice on our website before they take effect. Continued use of our services after such notification constitutes your acceptance of the revised terms.

2. Data We Collect

We collect personal data that you provide directly, data generated through your use of our platform, and data received from trusted third-party sources. The categories below describe each type in detail.

2.1. Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, residential address, phone number, and chosen username or display name.
• Identity verification data: Government-issued photo ID (passport, driver's license, or state ID), proof of address (utility bill or bank statement), and, where required, selfie images for liveness checks.
• Financial data: Payment instrument details, billing address, and transaction history related to deposits and withdrawals in US Dollars (USD).
• Communications: Content of messages sent to our support team, survey responses, and feedback submissions.
• Responsible Gaming declarations: Self-exclusion requests, deposit limits, and session time settings submitted through our Responsible Gaming tools.

2.2. Data Collected Automatically

• Device and browser data: IP address, browser type and version, operating system, device identifiers, screen resolution, and time zone.
• Usage and behavioral data: Pages visited, games played, session duration, click-stream data, wagering patterns, and feature interactions.
• Geolocation data: Approximate geographic location derived from your IP address for access-control and compliance purposes.
• Log data: Server logs recording access times, error reports, and security events.

2.3. Data from Third Parties

• Payment processors: Transaction status and fraud-score signals from payment service providers.
• Identity verification providers: KYC/AML verification outcomes, watchlist screening results, and politically exposed persons (PEP) checks.
• Analytics and marketing partners: Aggregated campaign attribution and traffic-source data.
• Responsible Gaming registries: Information confirming self-exclusion status from third-party exclusion databases where available.

3. How We Use Your Data

We process personal data only for specific, legitimate, and clearly defined purposes. We do not sell your personal information to third parties.

3.1. Service Delivery and Account Management

We use registration and financial data to create and manage your account, process deposits and withdrawals, credit winnings, and provide customer support. Without this data, we cannot deliver our core gaming services.

3.2. Identity Verification and Regulatory Compliance

We are required to verify the identity of all players, confirm that users meet the minimum age requirement of 21 years in jurisdictions where that threshold applies, and screen against sanctions and watchlists. KYC/AML procedures are a mandatory part of operating a compliant gaming platform.

3.3. Fraud Prevention and Security

Behavioral and device data help us detect suspicious activity, prevent account takeovers, identify multi-accounting, and protect the integrity of our platform for all users. Security processing is an ongoing function that operates throughout the life of your account.

3.4. Responsible Gaming Monitoring

We use gameplay data, session patterns, and self-declared limits to monitor for signs of problem gambling behavior. Where our algorithms flag potential risk, our team may reach out to offer support or apply protective restrictions. Full details are available on our Responsible Gaming page.

3.5. Personalization and Communications

With your consent where required, we use usage data to personalize game recommendations, promotions, and bonus offers. We also send transactional emails (account confirmations, security alerts, withdrawal receipts) and, subject to your preferences, marketing communications.

3.6. Analytics and Platform Improvement

Aggregated and pseudonymized data helps us understand how players interact with our platform, identify technical issues, and improve product features. No individual profiling occurs for this purpose.

4. Legal Bases for Processing

Every processing activity we conduct rests on at least one recognized legal basis. The following table maps our primary purposes to their corresponding legal grounds.

Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. Where we rely on consent, you may withdraw that consent at any time by contacting us at [email protected], though withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We share data only where necessary to deliver our services, meet legal obligations, or protect our legitimate interests. All third-party recipients are contractually bound to protect your data and use it solely for the specified purpose.

5.1. Categories of Recipients

• Payment service providers: Visa, Mastercard, American Express, PayPal, Apple Pay, Google Pay, ACH bank transfers, Skrill, Neteller, and cryptocurrency gateway partners process payment transactions on our behalf.
• Identity and compliance vendors: KYC/AML platforms, age-verification services, PEP and sanctions screening providers.
• Technology and infrastructure partners: Cloud hosting providers, content delivery networks, and cybersecurity vendors who process data under strict data-processing agreements.
• Game software providers: Third-party game studios whose software is integrated into our platform may receive pseudonymized gameplay data for game-performance monitoring.
• Analytics platforms: Aggregated, anonymized data may be shared with website analytics providers for statistical analysis.
• Legal and regulatory authorities: We disclose data to law enforcement, regulatory bodies, or courts when required by applicable law or in response to a valid legal request.

5.2. Business Transfers

In the event of a merger, acquisition, or asset sale, your personal data may be transferred as part of the transaction. We will notify you before your data becomes subject to a different privacy policy.

6. Cookies & Tracking Technologies

Our website uses cookies, pixel tags, web beacons, and similar tracking technologies to ensure the platform functions correctly, to remember your preferences, and to gather analytics insights.

6.1. Types of Cookies We Use

• Strictly Necessary Cookies: Essential for core functionality, including session management, login state, and security. These cannot be disabled without breaking core features.
• Performance and Analytics Cookies: Collect anonymous data about how visitors use our site, helping us identify areas for improvement.
• Functional Cookies: Remember user preferences such as language settings, game volume, and display options.
• Marketing and Targeting Cookies: Track browsing activity to deliver relevant advertisements and measure the effectiveness of our campaigns. These are only placed with your prior consent.

6.2. Managing Your Cookie Preferences

You can manage or withdraw your cookie consent at any time through our on-site cookie preference center, accessible from the footer of every page. You may also configure your browser settings to block or delete cookies; however, doing so may affect the functionality of certain platform features. For more information about cookies, visit allaboutcookies.org.

7. Data Security

Protecting your personal data is a core operational priority. We implement a layered set of technical and organizational measures designed to prevent unauthorized access, disclosure, alteration, or destruction of your information.

7.1. Technical Safeguards

• Encryption: All data transmitted between your browser and our servers is protected by TLS 1.2 or higher. Sensitive data at rest, including payment information, is encrypted using AES-256.
• Access controls: Role-based access ensures that only authorized personnel can access personal data, strictly limited to what is necessary for their function.
• Intrusion detection and monitoring: Our infrastructure is monitored around the clock for anomalous activity, with automated alerting and incident-response workflows.
• Penetration testing: Regular third-party security audits and penetration tests are conducted to identify and remediate vulnerabilities.

7.2. Organizational Safeguards

All staff with access to personal data receive mandatory privacy and security training. We maintain internal data protection policies, enforce need-to-know access principles, and conduct privacy impact assessments for new processing activities. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy or to comply with applicable legal obligations. The key retention periods that govern our practices are as follows:

• Account and transaction records: Retained for a minimum of five (5) years following account closure, in line with standard anti-money laundering record-keeping requirements.
• KYC and identity documents: Stored for the duration of the account relationship and for five (5) years thereafter.
• Customer support communications: Retained for two (2) years from the date of the last interaction unless a longer period is required for ongoing dispute resolution.
• Marketing consent records: Retained for the duration that consent is active, plus three (3) years as evidence of that consent.
• Cookie and analytics data: Aggregated analytics data may be retained indefinitely in anonymized form; individual session data is purged within thirteen (13) months.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification.

9. Your Rights

Depending on your location and applicable privacy law, you may hold a range of rights regarding the personal data we hold about you. We are committed to honoring these rights promptly and transparently. To exercise any right listed below, submit a written request to [email protected]. We will respond within thirty (30) days, though complex or high-volume requests may take up to ninety (90) days with prior notice.

9.1. Right of Access

You have the right to request a copy of the personal data we hold about you, together with information about how it is used, where it originated, and with whom it has been shared. We will provide this information in a structured, commonly used, and machine-readable format where technically feasible.

9.2. Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay. You may also update certain account information directly through your profile settings.

9.3. Right to Erasure ("Right to Be Forgotten")

You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is otherwise unlawful. Please note that this right is subject to legal exceptions: data we are required to retain for AML, fraud prevention, or dispute resolution purposes cannot be deleted until the mandatory retention period expires.

9.4. Right to Restriction of Processing

You may ask us to restrict how we process your data while a dispute about its accuracy or the lawfulness of processing is being resolved. During a restriction period, we will store your data but will not actively process it beyond what is strictly necessary.

9.5. Right to Data Portability

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a portable format and to request that we transmit it directly to another controller where technically feasible.

9.6. Right to Object

You have the right to object at any time to the processing of your data for direct marketing purposes. Where we process your data based on legitimate interests, you may also object on grounds relating to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

9.7. Rights Related to Automated Decision-Making

We may use automated systems to flag accounts for fraud review or to apply Responsible Gaming restrictions. If you believe you have been subject to a solely automated decision that significantly affects you, you have the right to request human review of that decision by contacting our support team at [email protected].

9.8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you are entitled to additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). These include the right to know what personal information is collected, the right to delete, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising your privacy rights. To submit a verifiable consumer request, contact us at [email protected]. We do not sell personal information as defined under CCPA/CPRA.

10. International Data Transfers

Our primary operations are based in the United States and are directed at users located in the US. However, some of our technology partners and service providers may process or store data in jurisdictions outside the United States. When personal data is transferred internationally, we take steps to ensure it receives a comparable level of protection.

Safeguards we implement for international transfers include contractual clauses that impose data-protection obligations on the receiving party, vendor due diligence to confirm adequate security practices, and, where applicable, reliance on recognized data-transfer mechanisms. We do not transfer personal data to jurisdictions that do not provide an adequate level of protection unless specific safeguards are in place. If you have questions about how your data is protected during international transfers, contact us at [email protected].

11. Minors

Our services are strictly intended for adults. The minimum age to register and play on Foxy Flush is 18 years, or such higher age as required by the laws of the state or jurisdiction in which you reside (including 21 years in certain US states). We do not knowingly collect personal data from individuals below the applicable minimum age. If we become aware that a minor has provided us with personal information or has registered an account, we will immediately suspend that account, delete the associated data, and refund any deposits where possible. If you believe a minor has accessed our platform, please notify us immediately at [email protected]. We encourage parents and guardians to use parental control software to prevent underage access to gaming websites. Further details are available on our Responsible Gaming page.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will revise the "Last Updated" date at the top of this document and notify registered users by email or via a prominent in-platform notice at least fourteen (14) days before the changes take effect.

We encourage you to review this Policy periodically to stay informed about how we protect your data. The version currently published at foxyflush.online/privacy-policy supersedes all prior versions. If you disagree with any updates, you should discontinue use of our services and contact us to request account closure. Your continued use of our platform following the effective date of a revised Policy constitutes your acceptance of that revision.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please reach out to us through one of the following channels:

• General support and account inquiries: [email protected]
• Privacy, data protection, and rights requests: [email protected]
• Website: foxyflush.online

We aim to acknowledge all privacy-related requests within five (5) business days and to resolve them fully within thirty (30) days. For matters that are particularly complex, we will notify you of the expected timeline. If you are dissatisfied with our response, you may have the right to lodge a complaint with the relevant supervisory or consumer protection authority in your state or jurisdiction.

13.1. Responsible Gaming Resources

If you or someone you know may be experiencing gambling-related harm, the following organizations provide free, confidential support:

• National Council on Problem Gambling (NCPG): ncpgambling.org | Helpline: 1-800-522-4700
• Gamblers Anonymous (GA): gamblersanonymous.org
• National Problem Gambling Helpline: 1-800-522-4700 (call or text, available 24/7)
• Substance Abuse and Mental Health Services Administration (SAMHSA): samhsa.gov | Helpline: 1-800-662-4357
• Gambling Therapy: gamblingtherapy.org — Online support and self-help tools
• iGaming North America (IGNA) Responsible Gambling Resources: igamingna.com

You can also access Foxy Flush's self-exclusion tools and player-protection settings at any time through our Responsible Gaming page, or by writing directly to [email protected].