Privacy policy

1. Who we are

Sapniverse LLC is a limited liability company with its principal office at 447 Broadway, 2nd Floor, Suite 2206, New York, NY 10013, USA. We provide LaunchOfferwall, a business-to-business subscription software platform that lets our Customers launch and operate their own white-labelled offerwall networks. You can contact us about privacy at hello@launchofferwall.com.

We have not appointed a data protection officer, and we have not appointed a representative in the European Union or the United Kingdom. If we appoint either, we will update this policy with their details.

2. Scope of this policy and our two roles

This policy covers three groups of people. Our role, and therefore the rules that apply, differ between them.

• (a) Website visitors: people who visit launchofferwall.com and its pages (the “Website”). We are the controller of their personal data.
• (b) Customer account users: the owners, administrators and team members of our Customers who sign up for, sign in to, pay for or use the LaunchOfferwall console, and anyone who contacts us for sales or support. We are the controller of their account, billing, support and security data.
• (c) Publishers and End Users of our Customers' Networks: the Publishers that a Customer onboards (including people who use the Customer's publisher portal) and the End Users who view or interact with a Customer's offerwall through a Publisher's app, game or website. Each Customer is the controller of the personal data processed for its Network, and we act as that Customer's processor (or “service provider”), processing data only on the Customer's behalf and instructions to provide the Service.

Where a Customer is the controller

LaunchOfferwall is white-labelled, so Publishers and End Users usually see the Customer's brand, not ours. If you are a Publisher or End User, the privacy notice of the Network you deal with, and of the Publisher whose app or site showed you the offerwall, governs how your personal data is used. We are not responsible for the privacy or data practices of our Customers, their Partners or their Publishers, which may differ from ours.

If you want to access, correct or delete personal data that a Network holds about you, or otherwise exercise your rights, please contact that Network or Publisher directly. If you contact us, we will, where we can identify the relevant Customer, refer your request to that Customer and assist them as required by our agreement and by law. We may not be able to respond to you directly.

The descriptions in Section 5 of the data we process for Customers are provided for transparency. They do not make us the controller of that data.

There is a limited exception: for people who sign in to a Customer's publisher portal, we also process sign-in, session and security data as described in Section 4 for the purposes of authenticating users, securing the platform and preventing fraud across the Service. Where we decide those purposes ourselves, we act as a controller for that limited data.

3. Data about Website visitors

Our Website is a marketing site. It does not have sign-up forms of its own (sign-up happens in the console), and it does not use advertising cookies, advertising pixels, cross-site tracking or third-party marketing analytics. We collect:

• Technical and log data: when you request a page, our hosting provider Cloudflare receives your IP address, browser and device information (user agent), the page requested, the referring page and the date and time. This is used to deliver the Website, keep it secure and protect it from abuse, and may be retained in operational and security logs.
• Communications: if you email us, for example using the contact link, we receive your email address, name and anything you include in your message.

4. Data about Customer account users

When you or your organisation uses the LaunchOfferwall console, we collect:

• Account and profile data: your name, email address, password (which we store only as a salted cryptographic hash, never in plain text), whether your email address is verified, your organisation and Network name, your role and permissions, and invitations you send or receive.
• Authentication and session data: sign-in events, one-time sign-in (magic link) and verification tokens, session identifiers, and the IP address and user agent associated with each session.
• Network configuration: Network name, subdomain, custom domains, branding and theme settings, Plan, Trial dates and usage counts against Plan Limits.
• Billing data: your subscription status, Plan, billing period and the subscription and payer identifiers and related details that PayPal provides to us. You enter your payment details with PayPal; we do not receive or store your full card or bank account numbers.
• Activity and audit data: records of actions taken in the console, such as changes to offers, Publishers, settings and roles, including actions approved through the AI Assistant, which we keep in an audit log for security and accountability.
• AI Assistant data: the prompts you type into the AI Assistant, the responses it generates and the data that it retrieves on your behalf to answer you (see Section 9).
• Support and communications: messages you send us, our replies, and any feedback, survey responses or call notes.
• Technical data: IP address, browser and device information, and logs of requests to our console and API, used to operate and secure the Service.

5. Data we process on behalf of Customers

To provide the Service to a Customer, we process the following categories of data on that Customer's behalf. The exact data depends on how the Customer, its Publishers and its Partners configure and use the Service.

• End User identifiers: the user identifier that a Publisher passes to the offerwall (for example an in-app account ID). Customers and Publishers are instructed not to use email addresses, phone numbers or other direct identifiers for this purpose.
• End User technical data: IP address, approximate country derived from IP address, device type and user agent, collected when an End User loads the offerwall or clicks an offer.
• Click records: the offer, Publisher, app or site, country, device, time of the click and a signed click identifier.
• Conversion records: Partner transaction identifiers, offer and goal, status (for example approved, held or reversed), payout, publisher payout and reward amounts, and the End User IP address and country where a Partner reports them.
• Raw postbacks: copies of incoming postback requests from Partners, including their parameters and the IP address and user agent of the sending server, kept so that conversions can be verified and reprocessed, and records of postbacks the Service sends to Publishers.
• Fraud screening data: fraud rule results and flags and, if the Customer enables ProxyCheck.io with its own key, the IP address of each End User click sent to ProxyCheck.io for a risk lookup and the result returned.
• Publisher data: Publisher names, contact names, email addresses, apps and sites, postback URLs, revenue-share settings, and the sign-in data of publisher portal users.
• Partner data: Partner connection details and API keys or secrets (stored encrypted), offers and offer content retrieved from Partners, and contact details of Partner personnel the Customer enters.

6. Sources of personal data

We collect personal data from the following sources:

• directly from you, for example when you create an account, configure a Network, use the AI Assistant or contact us;
• automatically from your browser or device when you visit the Website or use the Service;
• from our Customers and their team members, for example when they invite you to a team or onboard you as a Publisher;
• from Publishers' apps and sites, which pass End User identifiers to the offerwall, and from End Users' browsers when they load the offerwall or click an offer;
• from Partners, through postbacks and API integrations that a Customer connects;
• from PayPal, about the status of your subscription and payments; and
• from ProxyCheck.io, where a Customer has enabled it, about the risk profile of IP addresses.

7. How we use personal data

We use the personal data for which we are a controller for the following purposes:

• to provide, operate and maintain the Website and the Service, including creating and managing accounts, authenticating users and enforcing roles and permissions;
• to process subscriptions, bill and collect Fees through PayPal, apply Trials and enforce Plan Limits;
• to send transactional and service communications, such as sign-in links, verification and password-reset emails, team invitations, security alerts, billing, usage and limit notices, and notices of changes to our terms or this policy;
• to provide customer support and respond to enquiries;
• to secure the Website and the Service, including detecting, preventing and investigating fraud, abuse, security incidents and breaches of our Terms of Service;
• to monitor, troubleshoot, analyse and improve the performance, reliability and features of the Service, including by producing aggregated or de-identified statistics;
• to send you information about our products and updates where permitted by law, from which you can unsubscribe at any time (see Section 14);
• to comply with legal, tax, accounting and regulatory obligations and respond to lawful requests from authorities;
• to establish, exercise or defend legal claims and enforce our agreements; and
• in connection with a business transfer described in Section 10.

How we use data we process for Customers

We use personal data that we process on behalf of Customers only to provide the Service to that Customer in accordance with its instructions, including serving the offerwall, redirecting clicks, recording and attributing conversions, delivering postbacks, screening for fraud as configured by the Customer, producing reports, providing support, maintaining security, and complying with law. We may also create aggregated or de-identified data that does not identify any individual or Customer and use it to operate and improve the Service, as permitted by our agreement with the Customer and by applicable law. We do not use Customer personal data to build profiles of End Users for our own purposes, to target advertising, or for any purpose of our own unrelated to providing the Service.

8. Legal bases for processing (EEA and UK)

If the General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing of your personal data as a controller, we rely on the following legal bases under Article 6:

• Performance of a contract (Article 6(1)(b)): to create and manage your account, provide the Service, process billing and provide support, where you are the contracting party or are taking steps to enter into a contract.
• Legitimate interests (Article 6(1)(f)): to provide the Service to the business you work for; to secure the Website and the Service and prevent fraud and abuse; to operate, analyse and improve the Service; to communicate with business contacts about our products; and to establish, exercise or defend legal claims. We balance these interests against your rights and freedoms, and you may object as described in Sections 16 and 17.
• Legal obligation (Article 6(1)(c)): to keep tax and accounting records, respond to lawful requests and comply with other legal requirements.
• Consent (Article 6(1)(a)): where we ask for your consent, for example for certain marketing communications where required. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Legal bases for Customer data

For personal data that we process as a processor on behalf of a Customer, the Customer is responsible for establishing a legal basis for the processing and for providing any required notices and obtaining any required consents.

9. AI Assistant

The console includes an AI Assistant powered by Claude, a large language model provided by Anthropic. When an authorised user uses the AI Assistant, the user's prompts, the conversation and the data the AI Assistant retrieves through the Service to answer the user (which may include Customer data such as offer, Publisher, click or conversion records) are sent to Anthropic to generate responses. Anthropic processes this data as our sub-processor under its commercial terms, which do not permit it to use these inputs and outputs to train its models.

The AI Assistant acts only within the permissions of the signed-in user, retrieves only the data that user is allowed to see, and asks the user to confirm before it makes changes. Actions approved through the AI Assistant are recorded in the Network's audit log like other actions. AI output can be inaccurate, and users should not enter sensitive personal data into the AI Assistant that is not needed for their request.

10. How we share personal data

We do not sell personal data, and we do not share personal data for cross-context behavioural advertising. We disclose personal data only as described below.

Sub-processors and service providers

We use the following service providers to host and operate the Website and the Service. They process personal data on our behalf, or on behalf of our Customers, under written agreements and only for the purposes described:

• Cloudflare, Inc. (United States, with a global network): hosting of the Website and all applications, content delivery, edge computing, DNS and TLS certificates for custom domains, key-value storage, message queues, object storage (R2, including raw postback copies), analytics datasets used for click reporting, and security protection.
• Turso (United States): managed databases, including the platform database and a separate database for each Network.
• Resend (United States): delivery of transactional emails such as sign-in links, verification emails, invitations and notices.
• PayPal, Inc. and its affiliates (United States and other countries): subscription billing and payment processing. PayPal processes your payment details as an independent controller under its own privacy statement.
• Anthropic, PBC (United States): the AI model that powers the AI Assistant, used only when an authorised user uses the AI Assistant.
• ProxyCheck.io: IP address risk lookups, used only for Networks whose Customer has enabled ProxyCheck.io with the Customer's own account and key. In that case, the Customer's agreement with ProxyCheck.io also governs the data.

Other disclosures

We may also disclose personal data:

• to the Customer whose Network or account the data relates to, and to its authorised users in accordance with the roles and permissions the Customer sets, for example team members who can see Publisher records or conversion data;
• to third parties that a Customer chooses to connect or send data to, such as its Partners and Publishers (for example postbacks sent to a Publisher's URL), at the Customer's direction;
• to professional advisers, such as lawyers, accountants, auditors and insurers, under duties of confidentiality;
• to law enforcement, regulators, courts or other authorities, or to other parties, where we believe in good faith that disclosure is required by law, subpoena or legal process, or is necessary to protect the rights, property or safety of Sapniverse, our Customers, users or the public, to detect or prevent fraud or security issues, or to enforce our agreements;
• to an actual or prospective acquirer, successor, investor or financing source, and their advisers, in connection with a merger, acquisition, financing, reorganisation, bankruptcy, sale of assets or similar transaction, subject to confidentiality obligations. Personal data may be transferred as part of that transaction and will remain subject to this policy or a policy that is at least as protective, unless you are notified otherwise;
• to our affiliates, if any, for the purposes described in this policy; and
• with your consent or at your direction.

11. Cookies and similar technologies

Website. The marketing Website does not set advertising or analytics cookies and does not use third-party tracking pixels or cross-site tracking. Our hosting and security provider, Cloudflare, may set or read strictly necessary cookies or similar technologies to protect the Website against abuse, bots and attacks.

Console and publisher portal. The console and publisher portal use strictly necessary cookies to keep you signed in, maintain your session and keep your account secure. These cookies are required for the Service to work and cannot be switched off. We do not use the console or publisher portal to serve advertising.

Offerwall. The offerwall does not need cookies to work. A Customer's offerwall and click links process the technical data described in Section 5 to deliver offers, record clicks and screen for fraud. Partners and advertisers whose offers an End User clicks may use their own cookies or tracking technologies on their own sites and apps, which are governed by their own policies and are outside our control.

You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in to the console or publisher portal.

12. International data transfers

Sapniverse is located in the United States, and we and our service providers process personal data in the United States and in other countries where they operate, including through Cloudflare's global network. These countries may have data protection laws that differ from, and may be less protective than, the laws of your country.

Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or on a service provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where applicable. For Customer data, these safeguards are set out in our Data Processing Addendum, which is available to Customers on request. You can request more information about these safeguards by contacting hello@launchofferwall.com.

13. Data retention

We keep personal data for as long as necessary for the purposes described in this policy, unless a longer period is required or permitted by law. In particular:

• Account and profile data is kept while your account is active and for a reasonable period afterwards so that we can respond to queries, resolve disputes and prevent fraud.
• Session data is kept for the life of the session and expires automatically; one-time sign-in and verification tokens expire after a short period.
• Billing and transaction records are kept for as long as required by tax, accounting and other laws, typically up to seven years.
• Support communications are kept for as long as needed to handle your request and for a reasonable period afterwards.
• Security, audit and operational logs are kept for limited periods appropriate to their purpose, and longer where needed to investigate an incident or defend a claim.
• Customer data processed for a Network is kept while the Customer's account is active and in accordance with the Customer's instructions. Short click identifiers used for click redirects expire after 90 days. When a Customer's subscription ends, we make Customer data available for export for 30 days and may then delete it, subject to backups, which are overwritten in the normal course, and to any data we must retain by law.
• Aggregated or de-identified data that does not identify any individual may be kept indefinitely.

14. Email communications

We send transactional and service emails that are necessary to provide the Service, such as sign-in links, verification emails, invitations, security alerts, billing receipts and notices, usage and limit notices and important notices about our terms and policies. You cannot opt out of these while you have an account, because they are part of the Service.

If we send you product news or marketing emails, we will do so in accordance with the CAN-SPAM Act and other applicable laws, and every such email will include a way to unsubscribe. You can also unsubscribe at any time by emailing hello@launchofferwall.com. Emails that Networks send to their own Publishers or End Users are the responsibility of those Networks.

15. Security

We use administrative, technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse and alteration. They include a separate database for each Network, encryption of stored Partner API keys with AES-256-GCM, hashed passwords, signed click identifiers, authenticated postbacks, role-based access controls, an audit log of changes made through the AI Assistant and HTTPS encryption in transit on every domain. More detail is available on our security page.

No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials and the email account you use to sign in secure, and for telling us promptly if you suspect unauthorised access to your account.

16. Your privacy rights

Depending on where you live, and subject to exceptions in applicable law, you may have some or all of the following rights in relation to personal data for which we are the controller:

• Access and portability: to confirm whether we process your personal data, to obtain a copy of it, and to receive it in a portable, machine-readable format.
• Correction: to correct inaccurate or incomplete personal data. You can update most account information yourself in the console.
• Deletion: to have your personal data deleted.
• Restriction and objection: to restrict our processing, or to object to processing based on legitimate interests, including profiling, and to object at any time to direct marketing.
• Withdrawal of consent: where we rely on consent, to withdraw it at any time.
• Opt out of sale, sharing and targeted advertising: we do not sell personal data, share it for cross-context behavioural advertising or use it for targeted advertising, so there is nothing to opt out of, but you may still contact us.
• Limit use of sensitive personal information: we do not use or disclose sensitive personal information for purposes that would give rise to this right under California law.
• Complaint: to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where an alleged infringement occurred. We would appreciate the chance to address your concern first.

European Economic Area, United Kingdom and Switzerland

If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to you, you have the rights listed above as provided by those laws, including the rights of access, rectification, erasure, restriction, data portability and objection, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions about you.

California

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives you the right to know the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it and the categories of third parties to whom we disclose it; the right to delete; the right to correct; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising these rights.

In the preceding 12 months, we have collected the following categories of personal information described in the CCPA: identifiers (such as name, email address, IP address and account identifiers); customer records (such as billing and subscription details); commercial information (such as Plans purchased and subscription history); internet or other electronic network activity information (such as logs, session data and console activity); geolocation data limited to approximate location derived from IP address; professional or employment-related information (such as your organisation and role); and inferences limited to security and fraud-prevention assessments. We collect this information from the sources described in Section 6, for the purposes described in Section 7, and disclose it for business purposes to the categories of recipients described in Section 10 (service providers, Customers you are associated with, professional advisers, authorities and transaction counterparties). Account passwords are sensitive personal information, which we use only to authenticate you.

We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. We retain each category of personal information for the periods described in Section 13.

Other U.S. states

Residents of other U.S. states with comprehensive privacy laws, such as Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia, among others, may have rights to confirm whether we process their personal data, to access, correct and delete it, to obtain a portable copy, and to opt out of the sale of personal data, targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal data, engage in targeted advertising or conduct such profiling. Some of these laws do not apply to personal data collected in a business-to-business context, but we will consider every request in good faith.

17. How to exercise your rights

Making a request. To exercise any of your rights for personal data that we control, email hello@launchofferwall.com with “Privacy request” in the subject line, or write to us at Sapniverse LLC, 447 Broadway, 2nd Floor, Suite 2206, New York, NY 10013, USA. Please tell us which right you want to exercise and give enough information for us to identify you and your account. We will respond within the period required by applicable law, which is generally one month under the GDPR and 45 days under the CCPA, and may extend that period where the law allows, in which case we will tell you.

Verification. To protect your data, we will verify your identity before acting on a request, usually by asking you to confirm control of the email address associated with your account, and may ask for additional information where necessary. We will use information you provide for verification only for that purpose. We may decline a request if we cannot verify your identity, if the request is manifestly unfounded or excessive, or where an exception under applicable law applies, and we will explain our reasons where required.

Authorised agents. Where permitted by law, you may use an authorised agent to make a request on your behalf. We may require the agent to provide written, signed permission from you, and may require you to verify your identity directly with us, unless the agent holds a valid power of attorney.

Appeals. If we decline to act on your request, you may appeal our decision by emailing hello@launchofferwall.com with “Privacy appeal” in the subject line within a reasonable time after our decision. We will respond to your appeal within the period required by applicable law and explain the reasons for our decision. If you are not satisfied with the outcome of an appeal, you may contact the attorney general or data protection authority of your state or country.

Non-discrimination. We will not discriminate against you for exercising any of your privacy rights, for example by denying you the Service or charging you a different price, except as permitted by law. Note that some data, such as account and billing data, is necessary to provide the Service, so deleting it may require closing your account.

No fees. We do not charge a fee to process a request, unless the request is manifestly unfounded or excessive and the law permits a fee.

Requests about data we process for a Customer

If your request relates to personal data that we process on behalf of a Customer, for example because you are an End User of an offerwall or a Publisher of a Network, please send your request to that Customer or the Publisher you deal with, because they are the controller and decide how to respond. If you send your request to us, we will forward it to the relevant Customer where we can identify it, and support that Customer in responding as our agreement with them and the law require.

18. Children's privacy

The Website and the console are intended for businesses and are not directed to children. We do not knowingly collect personal data from children under 13 (or under 16 in the EEA, the UK and other places where a higher age applies) as a controller. If we learn that we have collected such data, we will delete it. If you believe a child has provided us with personal data, contact us at hello@launchofferwall.com.

Our Terms of Service prohibit Customers from using the Service with apps, games or sites directed to children, from targeting offers to children and from knowingly collecting personal information from children under 13 or any higher age required by law. Customers and their Publishers are responsible for ensuring that offerwalls are shown only to audiences permitted by law and by their Partners' terms, and for complying with the Children's Online Privacy Protection Act and similar laws.

19. Do Not Track and Global Privacy Control

Some browsers send a “Do Not Track” signal. Because there is no common industry standard for responding to these signals, our Website and Service do not respond to them. Our Website does not track visitors across third-party websites or use advertising trackers in any case. Where the law requires us to honour an opt-out preference signal such as Global Privacy Control, we will treat it as a request to opt out of the sale or sharing of personal data associated with that browser; because we do not sell or share personal data, this does not change how we process your data.

20. Third-party websites and services

The Website, the Service and Customers' offerwalls may link to or integrate with websites, apps and services operated by others, including Partners, advertisers, Publishers, PayPal and ProxyCheck.io. This policy does not apply to them, and we are not responsible for their privacy practices. Please read their privacy policies before providing personal data to them.

21. Changes to this policy

We may update this policy from time to time, for example to reflect changes to the Service, our sub-processors or the law. We will post the updated policy on this page with a new “last updated” date, and the changes take effect when posted unless we state otherwise. If we make material changes, we will also notify Customers by email or in the console before the changes take effect where reasonably practicable. If you continue to use the Website or the Service after the changes take effect, the updated policy applies to you. We encourage you to review this page periodically.

22. Contact us

If you have any question, concern or complaint about this policy or our handling of personal data, or want to request our Data Processing Addendum, contact us at hello@launchofferwall.com. Notices may also be sent by post to Sapniverse LLC, 447 Broadway, 2nd Floor, Suite 2206, New York, NY 10013, USA, Attention: Privacy.