Privacy Policy

The short version. The detail is in the sections that follow, and the detail is what governs.

• Who we are. TigerTree Solutions Ltd, a company registered in England and Wales (company number 16058881). We decide how your information is used, which makes us the data controller.
• What we collect. Your email address and password, what you do on the site, your IP address and device information, the country you are in, the payout details you give us, and (if you choose to do surveys) your date of birth, gender and postcode. If your withdrawal is flagged for review we ask you to complete a face scan.
• Why. To run your account, credit what you earn, pay you, stop fraud and multi-accounting, meet our legal obligations, and improve the service.
• Who we share it with. The offer and survey partners whose tasks you choose to do, our payout providers, our fraud and identity provider, our hosting and email providers, and analytics providers if you agree to analytics cookies.
• What we do not do. We do not collect your precise location. We do not ask for a passport or driving licence. We do not sell your information for money.
• Your control. You can access, correct, download or delete your information, object to some uses of it, withdraw consent, change your cookie choices at any time, and opt out of the sharing that United States law calls a sale or a share.

EarnX is operated by TigerTree Solutions Ltd, a company registered in England and Wales under company number 16058881, with its registered office at Unit A 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. In this notice, we, us and our mean TigerTree Solutions Ltd. We are the controller of the personal information described here.

For anything to do with your personal information, including requests to access or delete it and complaints about how we have handled it, contact contact@earnx.gg or write to us at the registered office above. Daniel Vakili is responsible for data protection at TigerTree Solutions Ltd and can be reached at the same address.

Information you give us

• Account. Email address and a password, which we store only as a one-way hash and never in readable form. If you sign up with Google or Discord we receive your name, email address, profile picture and the provider account identifier instead of a password.
• Profile. Username, display name, avatar, language, currency and reward preferences, and whether your profile is private.
• Payout details. Whatever the payout method needs: a PayPal email address, a cryptocurrency wallet address, a Roblox username, or the name and email a gift card should be sent to.
• Survey profile, only if you choose to do surveys. Date of birth, gender, country, postcode, and in some cases name, city and street address, because survey providers require them to match you to studies.
• Things you write. Public chat messages, support messages, guide submissions, bounty submissions and clip links.

Information we collect automatically

• Technical. IP address, browser and device type, operating system, screen and language settings, and the pages you visit and when.
• Country and region. Derived from your IP address by our network provider. This is country and region level only.
• Activity. Offers you click and complete, surveys you start, balance changes, withdrawals, games you play, referrals, and how you first arrived at the site.
• Anti-fraud signals. Device and browser characteristics collected by our fraud provider, and the risk scores it returns. See Automated decisions and fraud scoring.

Information from other people

• Offer and survey partners tell us when you have completed something, and send us the reward amount, the offer name, a transaction reference and often the IP address and country they saw.
• Google and Discord give us the profile information described above when you sign in with them.
• Our fraud provider tells us whether your device and behaviour look genuine, and whether your account appears linked to other accounts.
• Our email validation providers tell us whether an email address is real and whether its domain is disposable.

Sensitive information

Two categories need calling out because the law treats them differently.

• Biometric information. If your account is selected for identity verification, we ask you to complete a face scan. This is explained in full, with a separate consent step, at Identity checks and face scans and in our Biometric Data Policy.
• Account credentials. Your email address combined with your password is treated as sensitive personal information under several United States state laws. We use it only to log you in and secure your account.

We get personal information from four places: directly from you when you type it in; automatically from your device and browser when you use the site; from the offer, survey and payout partners we work with; and from the fraud and email validation providers we use to keep the platform clean.

We only use your information for the purposes below. If you are in the UK or the EEA, the third column is the legal basis we rely on under the UK GDPR and the EU GDPR.

Where we rely on a legitimate interest, we have weighed that interest against your rights and concluded it does not override them. You can ask us for that assessment, and you can object: see Your rights.

We share personal information with the categories of recipient below. We do not sell your information for money to anyone.

Most of what you can earn on EarnX comes from third parties. When you open an offer wall or click an offer or survey, we pass that partner an identifier for your account so that your completion can be tracked back and credited, along with your country, your device type and the IP address of that click. Some partners also receive a display name or email address where their integration requires it.

Once you leave EarnX for a partner's offer or survey, that partner and the advertiser behind it are handling your information as independent controllers under their own privacy policies. We do not control what they collect on their own sites, and we cannot delete information held by them on our own initiative, though we will pass your request on and tell you what happened.

Survey partners may ask you screening questions before a survey starts. Some of those questions touch sensitive topics. We pass your answers straight to the partner and never store them. If you would rather not answer, close the survey. It will not affect the rest of your account.

We work with a number of offer and survey providers, and the list changes as we add and remove them. You can see which provider is behind any particular task before you start it.

We do not verify everyone. If our fraud checks flag an account, or a withdrawal looks unusual, we ask for a face scan before the money goes out. This exists to stop one person running many accounts and to stop somebody taking over yours.

The scan is run by our verification provider, Verisoul Inc., 1401 Lavaca Street, Suite 989, Austin, Texas 78701, United States. It captures an image and a short video of your face and converts your facial geometry into an encrypted mathematical representation. That representation is biometric information.

• We ask first. Before any scan we show you what is collected, what it is for and how long it is kept, and you have to tick a box to agree. We record that agreement.
• You can say no. If you would rather not be scanned, you can ask for your withdrawal to be reviewed by a person instead. It takes longer, but refusing a scan does not cost you your balance.
• Where it is held. The images and the biometric template are held by Verisoul, not by us. We store only a session reference, and whether the check passed.
• How long. Verisoul destroys biometric information when the verification purpose has been met, or within three years of your last interaction with them, whichever comes first.
• What it is not used for. Not advertising, not profiling for marketing, and not sold or licensed to anyone.

Our full Biometric Data Policy sets out the retention and destruction schedule required by Illinois, Texas and Colorado law. If you are in the UK or EEA, we rely on your explicit consent under Article 9(2)(a) of the GDPR, and you can withdraw it at any time by emailing us, which will not affect anything done before you withdrew it.

We use an automated fraud detection service, Verisoul, which looks at your device, browser, network and behaviour and produces risk scores and an overall assessment. These checks run at various points while you use the site, including when you create an account and when you request a withdrawal.

Depending on the result we may:

• ask you to verify your identity before releasing a withdrawal;
• hold a withdrawal for manual review;
• restrict access to certain offer providers, to Battles, or to bonuses;
• suspend or close an account where the evidence indicates fraud.

We do not use these scores to make decisions with legal effects outside your EarnX account, and we do not use them for advertising.

We use cookies and similar technologies to keep you signed in, to remember your settings, to protect against fraud, to see which offers were credited correctly, and (if you agree) to measure how the site is used.

Our Cookie Policy sets out the cookies we use, who sets them, what they do and how long they last. In the UK, the EEA and Switzerland nothing beyond what is strictly necessary runs until you choose. Elsewhere analytics and attribution run by default. Either way you can change your choice at any time using the Cookie settings link in the footer.

We may email you about new offers, bonuses and changes to the service. Every marketing email has an unsubscribe link, and one click is enough. We honour unsubscribes immediately and in any event well within the ten business days United States law allows.

Emails about your account itself, such as verifying your address, resetting your password, or confirming a withdrawal has been sent, are not marketing and will keep coming while your account is open.

Our servers are in Germany, so your information is stored in the European Economic Area. Some of the companies we rely on are outside the UK and the EEA, mostly in the United States: our fraud and verification provider, our analytics provider, our content delivery provider, several payout providers and many offer and survey partners.

Where information leaves the UK or the EEA, we rely on one of the following:

• the recipient being certified under the EU to US Data Privacy Framework or its UK Extension;
• the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK is involved; or
• where you have chosen a payout method or an offer from a partner in another country, the transfer being necessary to perform that contract at your request.

You can ask us for a copy of the safeguards we rely on by emailing contact@earnx.gg.

We keep information for as long as we need it for the purpose we collected it, and then delete or anonymise it. Where the law fixes a period we say so. Where it does not, the period is set by how long the purpose lasts.

Passwords are stored only as one-way hashes. Traffic to the site is encrypted. Database backups are encrypted before they leave our servers. Access to production data is limited to the people who need it, and administrative actions are logged. The face scan review screen is restricted to the highest administrator level.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your personal information and is likely to put your rights at risk, we will tell you and the relevant regulator as the law requires.

EarnX is for people aged 18 or over. We do not knowingly collect personal information from anyone under 18. If we find out that an account belongs to someone under 18, we will close it and delete the information.

We do not knowingly sell or share the personal information of anyone under 16, and we do not use the information of anyone under 18 for targeted advertising. If you believe someone under 18 has an account, tell us at contact@earnx.gg and we will deal with it.

These rights are available to every EarnX user, wherever you live.

• Know and access. Ask what we hold about you and get a copy.
• Correct. Fix anything inaccurate. Most of it you can edit yourself in your profile.
• Delete. Ask us to delete your account and information.
• Take it with you. Get a machine readable copy of the information you gave us.
• Object and restrict. Object to uses based on our legitimate interests, and ask us to pause processing while a dispute is resolved.
• Withdraw consent. Where we rely on consent, take it back at any time.
• Stop marketing. Absolute, no reason needed.
• Human review. Have a person review a decision that was made automatically.

To use any of them, email contact@earnx.gg from the address on your account, or use the tools in your profile settings. We may need to check who you are before we act, which protects you from someone else requesting your data. We answer within one month in the UK and EEA, and within 45 days in the United States, and will tell you if we need longer.

Using your rights costs nothing and we will not treat you worse for it. Some things we cannot delete: records we must keep for tax and accounting, and records of fraud, which we keep so the same person cannot simply start again.

If you are in the United Kingdom or the European Economic Area, the UK GDPR or the EU GDPR applies, and the rights above are your rights under Articles 15 to 22. The legal basis for each purpose is in the table at Why we use it.

Complaining to a regulator

You can complain to a data protection authority. In the UK that is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk/make-a-complaint. In the EEA you can complain to the authority in the country where you live or work, for example the Bundesbeauftragte für den Datenschutz or your state authority in Germany, or the Garante per la protezione dei dati personali in Italy. We would rather you came to us first, but you do not have to.

Automated decisions

Our fraud scoring is described at Automated decisions and fraud scoring. You have the right to obtain human intervention, to express your point of view and to contest any decision.

This section applies if you live in a United States state with a comprehensive privacy law. That currently includes California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Which rights you have depends on your state, and we give all of them to everyone in the list.

Your rights

• Know. Confirm whether we process your personal information, and get the categories, the sources, the purposes, the categories of recipient, and the specific pieces we hold.
• Delete. Ask us to delete personal information about you.
• Correct. Ask us to fix inaccurate personal information.
• Portability. Get a copy in a portable, readily usable format.
• Opt out of sale, sharing and targeted advertising. See Do not sell or share my information.
• Limit sensitive information. We use sensitive personal information only to verify identity, stop fraud and run your account, which are purposes the law permits without a right to limit. We do not use it to infer characteristics about you.
• Opt out of profiling. Object to profiling that produces legal or similarly significant effects. Our fraud scoring can hold a withdrawal, so you can ask for human review of any such decision at any time.
• No retaliation. We will not deny you service, charge you differently or give you a worse experience because you used these rights.

How to make a request

Email contact@earnx.gg with the word Privacy in the subject, or use the tools in your profile settings. An authorised agent can act for you if they give us written proof. We respond within 45 days and may extend once by a further 45 days, telling you why within the first period.

Appeals

Nevada

Nevada residents may tell us not to sell certain personal information. We do not sell information for money, but you can still register the request at the address above.

This is what California and similar state laws require us to publish: the categories of personal information we have collected in the last 12 months, where each comes from, why we use it, whether it is sold or shared, and how long we keep it. Sold or shared has the specific legal meaning explained at Do not sell or share my information, which is not the same as exchanging information for money.

We do not collect audio or visual recordings other than the face scan described above, professional or employment information, education records, or precise geolocation.

United States privacy laws define selling and sharing broadly. Sharing means disclosing personal information for cross context behavioural advertising, whether or not money changes hands, and selling can cover a disclosure made for any valuable consideration.

On that definition, two things we do count. First, when you choose to do an offer or a survey, we pass your account identifier, country and click IP to that partner, and we are paid when you complete it. Second, if you accept analytics or advertising cookies, identifiers are made available to those providers.

We do not exchange your personal information for money in the ordinary sense of selling a mailing list, and we never have.

Opting out stops the advertising and analytics sharing entirely. It does not stop the tracking that pays you: if you choose to do an offer, that partner still has to be told which account completed it, or you would not get credited. That is the honest position, and we would rather say it than hide it.

When you opt out we also ask the third parties who received your information in the previous 90 days to delete it.

EarnX pays you for completing offers and surveys, and those activities involve your personal information. California law treats that as a financial incentive and requires us to explain it.

• What the programme is. You complete an offer, survey or task from one of our partners. We are paid by that partner, and we pass a share to you as a cash balance you can withdraw.
• What information is involved. Identifiers, your country, device and click information, and, for surveys, the demographic profile you chose to give.
• How to join. Create an account and complete an offer or a survey. Completing the survey profile is entirely optional.
• How to leave. Stop doing offers and surveys, delete your survey profile, or close your account. You can do this at any time and it costs nothing. Anything you already earned stays yours.
• Why it is permitted. The difference in service is reasonably related to the value your participation creates. We estimate that value using the revenue our partners actually pay us for completions, divided by the number of participating users over the same period, and we compare it against what we pay out. The great majority of what a partner pays us for your completion is passed on to you.

If you are unhappy with how we have handled your personal information, tell us at contact@earnx.gg with Complaint in the subject line. We will acknowledge it within 30 days, look into it, keep you updated, and write to you with the outcome.

If you are not satisfied with our answer, you can take it to the Information Commissioner's Office in the UK, your national authority in the EEA, or your state Attorney General in the United States. Details are at UK and EEA users and United States: state privacy rights.

We update this notice when what we do changes. The version number and date at the top tell you which text is current. If a change materially affects your rights or how we use your information, we will tell you by email or with a notice on the site before it takes effect, and where the law requires your consent we will ask for it again rather than assume it.

For anything in this notice:

• Email contact@earnx.gg
• Post: TigerTree Solutions Ltd, Unit A 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE

Related documents: Terms of Service, Cookie Policy, Biometric Data Policy and Your Privacy Choices.