Draft — subject to legal review
This document is a working draft prepared for review by qualified counsel. It is not legal advice, it is not yet in force, and it may change materially before publication. Bracketed text marks information that has not been confirmed yet.
This Privacy Policy explains how Codexx Nepal Pvt. Ltd., a private limited company incorporated in Nepal (registered office: [Registered address]; company registration number: [Company registration number]; PAN/VAT: [PAN/VAT number]) ("Afterparty", "we", "us") handles personal data in connection with the Afterparty website at https://afterparty.example.com, our documentation site, the Afterparty back office, demo and onboarding flows, and our sales and support activities.
1. Our Two Roles
Afterparty as controller. We decide how and why personal data is processed, and are the controller (or "business" under California law), for data about: people who visit our websites; staff of our customers who use the Afterparty back office ("Authorized Users"); prospects who request a demo, sign up for evaluation access or contact us; and people who subscribe to our marketing communications. This Privacy Policy covers that processing.
Afterparty as processor for player data. Our customers are casino, sportsbook, social casino and sweepstakes operators ("Operators"). When an Operator uses Afterparty to run rewards, gamification, raffles, journeys and messaging for its players, the Operator is the controller of its players' personal data and Afterparty processes that data only on the Operator's instructions, as a processor and service provider, under our Data Processing Agreement. If you are a player of a casino or sweepstakes brand, please read that brand's privacy notice and contact the brand directly to exercise your rights or ask questions about your data. If you contact us, we will forward your request to the relevant Operator where we can identify it. Operators can use our Player-Facing Widget Notice Template to explain this to their players.
2. Personal Data We Collect
Account and profile data. Name, business email address, job title, employer, role and permissions, language and time-zone preferences, and authentication data such as hashed passwords, multi-factor authentication settings and API key metadata.
Back-office activity data. Actions that Authorized Users take in the back office, recorded in audit logs (for example, who changed a campaign, approved an AI-proposed action or exported data, and when), together with IP address, browser and device information.
Onboarding, demo and contact data. Information you provide when you request a demo, start onboarding, send feedback or contact us, such as your name, business email, company, the content of your message, and whether you accepted our terms and gave marketing consent, including the time and wording of that consent.
Communications and support data. Correspondence with us, support tickets, meeting notes and call recordings where you have been informed of the recording.
Billing data. Billing contact details, invoices, tax identifiers and payment status. Payment card details are handled by our payment provider and are not stored by us.
Website and technical data. IP address, browser type, operating system, referring page, pages viewed, timestamps, and similar log data, plus information stored in essential cookies (see Section 10).
Information from others. Business contact information from your employer when it creates your account, from referral partners, from public professional sources, and from event organisers where you have agreed to share it.
3. Purposes and Legal Bases
Where the EU or UK General Data Protection Regulation ("GDPR") applies, we rely on the following legal bases.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Providing the back office and our contract with the Operator, including account administration and support | Account, activity, support data | Performance of a contract with you, or our legitimate interest in performing our contract with your employer |
| Security, fraud prevention, audit logging and abuse detection | Account, activity, technical data | Legitimate interests in protecting the service, our customers and players; compliance with legal obligations |
| Handling demo requests, onboarding and evaluation access | Onboarding and contact data | Steps taken at your request before entering into a contract; legitimate interests in responding to business enquiries |
| Direct marketing by email | Contact data and consent records | Consent, which you may withdraw at any time; legitimate interests in keeping proof of consent and maintaining suppression lists |
| Improving the service and our websites, including aggregated analytics | Activity and technical data | Legitimate interests in improving our products |
| Billing, accounting and tax | Billing data | Compliance with legal obligations; performance of a contract |
| Complying with law, responding to lawful requests and establishing or defending legal claims | Any relevant data | Compliance with legal obligations; legitimate interests in protecting our rights |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us for more information about that assessment. We do not use personal data for automated decision-making that produces legal or similarly significant effects on you.
4. AI Features
The back office includes optional AI features, such as AI agents and drafting assistants, that send prompts to third-party model providers listed on our Sub-processors page. Prompts may include information you type and data from the Operator's workspace. We do not use your personal data to train third-party foundation models, and we configure providers, where they offer it, not to train on our customers' data. AI outputs that would change data or send communications require approval by an Authorized User.
5. How We Share Personal Data
We share personal data only as follows: with service providers and sub-processors that host our infrastructure, deliver email, provide error monitoring, support and payment services, under contracts that limit their use of the data (see the Sub-processors page); with your employer (the Operator), which administers your back-office account and can see audit logs about your activity; with professional advisers such as lawyers, auditors and insurers; with authorities where required by law, including gaming regulators where an Operator is legally required to disclose information; and with a successor in a merger, acquisition or sale of assets, subject to this Privacy Policy.
We do not sell personal data and we do not share it for cross-context behavioural advertising.
6. International Transfers
Codexx Nepal Pvt. Ltd. is established in Nepal, and our service is hosted by Amazon Web Services, Inc. in the AWS US East (N. Virginia) region (us-east-1), United States. Backups are stored in the same region. We do not currently offer hosting in the European Union or the United Kingdom, so personal data of people in those regions is transferred to the United States. Our personnel and sub-processors may access personal data from Nepal, the United States and other countries that may not provide the same level of data protection as your own country. Neither Nepal nor the United States (outside the EU-U.S. Data Privacy Framework) is covered by an EU or UK adequacy decision. Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with supplementary measures such as encryption. You can request a copy of the relevant safeguards by contacting us.
7. Retention
We keep personal data only as long as necessary for the purposes described above:
- Back-office account data: for the life of the account and up to 90 days after it is closed, unless the Operator asks us to delete it sooner.
- Audit logs of changes made in the back office: for 12 months, or longer where needed to investigate a security incident or required by an Operator's regulatory obligations. A daily job deletes change audit logs once this period expires. Logs of read access to records are deleted automatically, by default after 7 days.
- Demo, onboarding and contact data: up to 24 months after our last interaction, unless a contract follows.
- Marketing consent records and suppression lists: for as long as we send marketing and for up to 3 years afterwards, to demonstrate consent and honour opt-outs.
- Billing records: for the period required by tax and accounting law, currently up to 7 years.
- Website and infrastructure logs: up to 30 days, unless needed for security investigations.
8. Security
We use technical and organisational measures designed to protect personal data, including encryption in transit (TLS) and encryption at rest, field-level encryption of sensitive fields, keyed hashing of identifiers used for lookups, role-based access control with feature-level permissions, multi-factor authentication for back-office users, strict tenant and organisation scoping, audit logging of administrative actions, password hashing with bcrypt, and documented retention and erasure jobs. The measures applied to player data are described in Annex 2 of the Data Processing Agreement. No system is completely secure; please contact us immediately if you suspect a vulnerability.
9. Your Rights
9.1 EEA, UK and Swiss residents
You have the right to request access to, correction of, deletion of, restriction of and portability of your personal data, and to object to processing based on legitimate interests. You may object at any time to direct marketing, and you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work.
[EU representative under GDPR Article 27: name and address to be appointed.] [UK representative under UK GDPR Article 27: name and address to be appointed.]
9.2 California and other U.S. state residents
This section is our notice at collection and privacy policy for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and it also applies to residents of other U.S. states with similar laws.
Categories collected in the last 12 months: identifiers (name, email, IP address, account identifiers); professional or employment-related information (employer, job title, role); commercial information (subscriptions and billing records); internet or other electronic network activity (back-office activity, audit logs, website logs); and sensitive personal information limited to account log-in credentials. Sources, purposes and retention periods are described in Sections 2, 3 and 7.
Disclosures: we disclose these categories for business purposes to the service providers and recipients described in Section 5. We have not sold personal information or shared it for cross-context behavioural advertising in the last 12 months, and we do not knowingly sell or share the personal information of consumers under 16. We use sensitive personal information only for purposes permitted by the CCPA, such as providing secure log-in.
Your rights: you may request to know what personal information we collect, use and disclose; to access and receive a copy of it; to correct inaccurate information; and to delete it, subject to legal exceptions. Because we do not sell or share personal information, there is nothing to opt out of, but we honour Global Privacy Control signals as an opt-out request. We will not discriminate against you for exercising your rights. You may use an authorised agent, and we may verify your identity and the agent's authority before responding.
Player data: where we process player data as an Operator's service provider, please direct requests to that Operator.
9.3 How to exercise your rights
Email privacy@afterparty.example.com. We will respond within the period required by applicable law, usually one month under GDPR and 45 days under the CCPA. We may need to verify your identity before acting on a request. If you are an Authorized User, some requests may need to be handled together with your employer, which administers your account.
10. Cookies and Similar Technologies
Our websites and back office use cookies and similar technologies that are strictly necessary to provide the service, such as session and authentication cookies, security tokens, language preference and records of whether you have dismissed a notice. In the back office these are the authentication and session cookies that keep you signed in and a cookie that remembers your language. We do not use analytics, advertising or other non-essential cookies. If we introduce them, we will update this section first and, where the law requires it, ask for your consent before setting them. You can block or delete cookies in your browser settings, but the back office will not work without strictly necessary cookies.
The player-facing widgets that Operators embed on their own sites do not set cookies and do not store information in the browser's local or session storage. They are covered by the Operator's privacy and cookie notices; see the Player-Facing Widget Notice Template.
11. Children
Our websites and back office are intended for business users and are not directed to anyone under 18. We do not knowingly collect personal data from children through them. If you believe a child has provided personal data to us, please contact us and we will delete it. Operators are responsible for preventing minors from using their gambling and sweepstakes products.
12. Marketing Communications
We send marketing emails only where you have consented or where the law otherwise allows it. Every marketing email contains an unsubscribe link, and you can also opt out by emailing privacy@afterparty.example.com. We keep a record of your opt-out so that we do not contact you again.
13. Changes to this Policy
We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, where changes are material, notify Authorized Users through the back office or by email.
14. Contact
- Privacy enquiries: privacy@afterparty.example.com
- Data protection officer: dpo@afterparty.example.com
- Postal address: Codexx Nepal Pvt. Ltd., [Registered address]
For our business terms, see the Terms of Service.