Effective date: November 14, 2025

This Privacy Policy describes how P5FI LLC and its brands (including Secrets To Win), together with the following third parties and their subsidiaries (collectively: "Third‑Party Providers") — Google LLC, Alphabet, Inc., The Google Play Store, The Apple App Store, Apple, Inc., Google Analytics, Adalo, Zulip, Kandra Labs, Inc., any and all payment processors used by the Services, and any additional companies added or removed by us from time to time — collect, use, share, and secure personal information through our mobile applications, web application, and online store (together, the "Services").

We intend this policy to comply with major privacy frameworks including the GDPR (EU), CCPA & CPRA (California), CalOPPA (California), and relevant FTC guidance. Where specific regional rights apply, we summarize them below.

1. Scope

This policy applies to personal data collected when you:

• Use our mobile or web applications;
• Purchase goods or services through our online store;
• Communicate with customer support;
• Access or interact with our content, ads, or analytics.

2. Data Controller & Contact

Data Controller: P5FI LLC (and where applicable, the relevant brand operating the Service).

Contact:

• Email: contact@secretstowin.com
• Mailing address: 15 Madeline Ct., St. Augustine, FL 32095

If you are a resident of the EU or another jurisdiction that requires a Data Protection Officer (DPO) or representative, please contact us at the email above; we will supply DPO contact details if and when one is appointed.

3. What we collect

We collect information that you provide directly and information collected automatically. Categories below follow a practical classification to help you understand uses and legal bases.

A. Information you provide directly

• Account registration data: name, email address, username, password (hashed).
• Billing and payment information: payment card details, billing name and address. Note: Payment card data is processed by our payment processors and typically not stored on our servers except last‑four or tokenized references where required for recurring billing.
• Purchase history and order details.
• Customer support communications, chat logs (including via Zulip or in‑app chat), and survey responses.
• Content you upload: images, documents, or other user‑generated content.

B. Information collected automatically

• Usage data: pages/screens visited, interactions, session length, crash logs, feature usage.
• Device & technical information: device model, OS version, unique device identifiers (IDFA/GAID where applicable), IP address, mobile carrier, browser type, and mobile app identifiers.
• Location information: coarse location derived from IP address; precise location only if you give explicit permission in device settings and the app requests it.
• Cookies and tracking technologies: see Cookies & Tracking below.

C. Sensitive data

We do not intentionally collect special categories of sensitive personal data (e.g., race, religion, health) unless you explicitly provide it (for example, in a support message). If you provide such data, we will process it only where permitted and with appropriate safeguards.

4. How we use your data (Purposes & Legal Bases)

We process personal data for the following purposes:

1. To provide and maintain the Services — delivering features, processing orders, authenticating accounts. (Performance of a contract)
2. Payment processing & fraud prevention — to complete purchases and prevent unauthorized transactions. (Performance of a contract; legitimate interests)
3. Customer support — to respond to inquiries and resolve issues. (Performance of a contract; legal obligation)
4. Analytics & product improvement — to understand usage and improve the Services. (Legitimate interests; consent where required)
5. Marketing & communications — sending transactional messages, updates, and promotional materials where permitted. (Consent or legitimate interests depending on jurisdiction)
6. Legal compliance & safety — to comply with law enforcement requests, enforce our Terms of Service, and protect rights. (Legal obligation; legitimate interests)
7. Personalization & advertising — to show personalized content or ads with partners (subject to opt‑outs). (Consent where required; legitimate interests)

Where required by law (for example, the GDPR), we will identify the legal basis for specific processing activities and, for EU residents, provide additional rights and safeguards.

5. Sharing & Third Parties

We may share your personal information with the following categories of recipients:

• Service providers and subprocessors who perform services on our behalf, such as payment processors, cloud hosting providers, analytics providers (including Google Analytics), push notification services, crash reporting, CRM providers, and customer support platforms (e.g., Zulip, Adalo integrations). These parties act under our instruction and are contractually restricted from using your data for other purposes.
• App store platforms: Google Play Store and Apple App Store in order to distribute the mobile apps and process in‑app purchases.
• Payment processors (e.g., credit card networks, third‑party payment gateways) to process transactions. Payment processors may be separate corporate entities or subsidiaries.
• Advertisers and advertising networks to the extent you consent to targeted advertising. These may include services provided by Google and other ad networks.
• Affiliates and subsidiaries of P5FI LLC and of the named Third‑Party Providers where required for shared services, billing, or analytics.
• Legal and safety recipients: law enforcement, regulators, or other parties when required by law or to protect the rights, privacy, safety, or property of our company, users, or the public.

Third‑party list & monthly updates

The Services currently integrate with the Third‑Party Providers named at the top of this policy. This list may change (companies added or removed). We review and update a list of integrated third parties at least monthly and post changes to this privacy policy. Please review this policy regularly for updates.

6. International Transfers

Your data may be transferred to, and stored in, countries other than your country of residence, including the United States. Where required by law (for example, transfers from the EEA), we use appropriate safeguards such as standard contractual clauses, binding corporate rules, or ensure the recipient is in a jurisdiction with an adequacy decision. Contact us for more information about specific transfers.

7. Cookies & Tracking Technologies

We and our partners use cookies, local storage, pixel tags, and similar technologies to operate the Services, analyze usage (e.g., Google Analytics), and provide advertising. You can manage cookie preferences via your device, browser settings, or our cookie consent tool where provided. Some cookies are strictly necessary for the Services to function and cannot be disabled (e.g., session cookies for shopping cart functionality).

8. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy or as required by law. Typical retention periods:

• Account information: retained while account is active and for a reasonable period after account deletion (e.g., for fraud prevention and legal defense).
• Transaction & billing data: retained for tax, accounting, and legal compliance (commonly 6–7 years where required).
• Support records and communications: retained for a period necessary to resolve issues (commonly 1–7 years).
• Analytics and log data: aggregated/retained in a non‑identifiable form where possible; raw logs retained according to operational needs (commonly 90–540 days).

If you request deletion under applicable law, we will delete or anonymize your personal data unless we are legally permitted or required to retain it.

9. Security

We implement administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. Examples include encryption in transit (TLS), access controls, network monitoring, secure development practices, and periodic security assessments.

No system is 100% secure. In the event of a data breach that creates a risk to your rights and freedoms, we will follow legal requirements for notification (e.g., notify supervisory authorities within 72 hours where required by the GDPR and notify affected individuals when required by applicable law).

10. Your Rights

Depending on your location, you may have the following rights. To exercise any right, contact us at the email above and include sufficient information to identify yourself and your request.

EU / EEA (GDPR) rights

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data subject to legal exceptions.
• Right to restriction of processing.
• Right to data portability — receive data in a commonly used, machine‑readable format.
• Right to object to processing — including profiling and direct marketing.
• Right to withdraw consent where processing is based on consent.

We will respond to verifiable requests without undue delay and within the statutory timeframes (generally one month, extendable where permitted).

California (CCPA & CPRA) rights

If you are a California resident, you have the right to:

• Know categories and specific pieces of personal information collected, sold, or shared.
• Request deletion of personal information (with exceptions).
• Opt out of the sale or sharing of personal information to third parties for cross‑context behavioral advertising.
• Non‑discrimination for exercising your rights.

To submit a request under CCPA/CPRA, please contact us at the email above and provide verification information. We will verify and respond in accordance with applicable law.

Other jurisdictions

Where applicable, you may have rights under local law (e.g., the right to access, correct, restrict, or delete your personal data). We will comply with obligations under local laws where applicable.

Authorized agents & verification

For certain requests (especially deletion or access)