Do Not Sell or Share My Personal Information

Last updated: May 31, 2026

This notice is provided by CastPact LLC, an Idaho limited liability company ("CastPact"), and supplements our Privacy Policy. It serves as the "Do Not Sell or Share My Personal Information" notice and opt-out mechanism required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), and the comparable opt-out provisions of other U.S. state privacy laws.

How We Handle Most of Your Personal Information

Except for the limited creator campaign attribution data described in the next section, CastPact does not sell your personal information to any third party for monetary or other valuable consideration, and does not share your personal information for cross-context behavioral advertising. This applies to identifiers, commercial information, internet activity, professional information, and financial information that we collect when you use the platform.

For these categories, no opt-out action is required to stop a sale or sharing because we do not sell or share them. You may still submit a request to confirm our practices.

Creator Campaign Attribution Data: Your Right to Opt Out

CastPact may include creator-identified campaign performance data (for example, the number of sales or conversions attributable to a specific named creator for a specific game) in marketplace reports that we provide to third parties such as game publishers or analytics partners. Because this disclosure of identifiable creator data may be made for valuable consideration, we treat it as a "sale" or "sharing" of personal information under the CCPA and we give every creator the right to opt out of it.

This use is limited to data arising directly from a creator's campaign activity on our platform. It does not include personal contact information, payment details, or any other personal data.

To opt out of the sale or sharing of your creator campaign attribution data, use any of the following:

• In-platform: Settings > Privacy > Marketplace Data, or the "Do Not Sell or Share My Personal Information" link in the site footer
• Email: privacy@castpact.com with the email address associated with your account
• An opt-out preference signal such as Global Privacy Control (see the next section)

We will process your opt-out request within 15 business days. Once processed, your named performance data will be excluded from any future third-party marketplace reports. Opting out does not affect your ability to participate in campaigns, receive payments, or use any platform feature.

Opt-Out Preference Signals (Global Privacy Control)

CastPact recognizes opt-out preference signals, including the Global Privacy Control ("GPC"), as a valid request to opt out of the sale or sharing of personal information for the browser or device that sends the signal. When we detect a recognized signal, we treat it as an opt-out request and, where required, we display confirmation that the signal has been honored (for example, "Opt-Out Preference Signal Honored").

We do not require you to provide additional information to honor an opt-out preference signal beyond what is necessary to send it. We do not interpret a preference signal as a choice to opt back in to a sale or sharing.

Marketplace Data: Aggregated and De-Identified Information

Separately from creator attribution data, CastPact may share or license aggregated, de-identified marketplace data with game industry analysts, publishers, or market research firms. This data is processed to remove all personal identifiers before disclosure and includes:

• Transaction volume and revenue trends by game title, genre, or platform
• Campaign performance metrics (for example, average conversion rates and click-through rates by campaign type across the platform)
• Aggregate attribution data (for example, total copies of a game sold through creator-driven campaigns across the platform)

This aggregate data does not identify any individual user, creator, or buyer. We maintain and use it in a manner that does not attempt to reidentify any consumer, and we contractually prohibit recipients from reidentifying it. Aggregated consumer information that is not linked or reasonably linkable to a consumer is not "personal information" under the CCPA, so its disclosure does not constitute a sale or sharing of personal information.

Your Rights Under U.S. State Privacy Laws

Residents of California, Virginia, Colorado, Connecticut, Texas, Oregon, and other U.S. states with comprehensive privacy laws have the following rights regarding their personal information. CastPact honors these rights for all U.S. residents regardless of state:

• Right to Know / Access: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You have the right to request deletion of personal information we hold about you, subject to certain exceptions (such as information we are legally required to retain).
• Right to Correct: You have the right to request correction of inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information. As described above, the only category we may sell or share is creator campaign attribution data, and you can opt out of that at any time using the methods above or by sending an opt-out preference signal.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of sensitive personal information. We do not use or disclose sensitive personal information beyond the purposes permitted under the CCPA without limitation (for example, performing the services you request, security and fraud prevention, and other purposes that do not require offering the right to limit).
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights. Exercising your privacy rights will not result in denial of service, different pricing, or any other adverse treatment.
• Right to Appeal (where applicable): If we decline to act on your request, residents of states that provide an appeal right (for example, Virginia, Colorado, Connecticut, Texas, and Oregon) may appeal our decision by replying to our response or contacting privacy@castpact.com. If we deny your appeal, we will provide information on how to contact your state attorney general.

Sensitive Personal Information

Sensitive personal information that CastPact may handle can include financial account information together with an access credential, and precise geolocation. We use such information only as necessary to provide the platform, process payments, secure accounts, and prevent fraud, and not to infer characteristics about you. Because our use stays within the purposes the CCPA permits without a right to limit, no limitation request is necessary to stop a non-permitted use; you may still submit a request to confirm our practices.

How to Submit a Privacy Request

You may submit any privacy rights request through the following channels:

• In-platform:Settings > Privacy > My Data
• Email: privacy@castpact.com (include the email address associated with your account)

We will acknowledge your request within 10 business days and fulfill it within 45 calendar days. If we need additional time (up to 45 additional days), we will notify you in writing with the reason. We may need to verify your identity before fulfilling your request to protect against unauthorized access or deletion. Opt-out of sale or sharing requests do not require identity verification and are acted on within 15 business days.

Buyer data requests: If you purchased a game on CastPact without creating an account, you may request access to or deletion of your purchase data by emailing privacy@castpact.com with the email address used at checkout. We will verify your identity by sending a confirmation link to that address before processing your request. For game-key sales, the publisher is the seller and merchant of record and may be a separate controller of certain buyer data; where that is the case, we will route or forward your request as appropriate.

Authorized agents:California residents may designate an authorized agent to submit requests on their behalf. Agents must provide written authorization signed by the consumer. We may verify the consumer's identity directly before processing.

What We Do With Your Personal Data

Stripe is a service provider, not a data buyer. For game-key sales, the publisher acts as the merchant of record and Stripe processes buyer payment data under the publisher's connected account; CastPact does not collect or store buyer card numbers in that flow. Disclosure to Stripe for payment processing does not constitute a "sale" or "sharing" of personal information under the CCPA.

Minors

CastPact is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18, and we do not knowingly sell or share the personal information of any consumer we know to be under 16. If you believe we have inadvertently collected information from a minor, please contact privacy@castpact.com immediately and we will delete it promptly.

California-Specific Disclosures

Shine the Light (Cal. Civ. Code 1798.83): CastPact does not share personal information with third parties for their own direct marketing purposes. No opt-out under this law is required, but you may contact us at privacy@castpact.com to confirm.

Financial Incentives: CastPact does not offer financial incentives in exchange for the collection, sale, or retention of personal information.

Categories of Personal Information

Data Retention

Personal information is retained as described in our Privacy Policy. In general, account data is retained for the duration of your account and for a reasonable period thereafter for legal compliance and dispute resolution purposes. Payment and tax records are retained for the minimum period required by law and Stripe's terms. You may request deletion at any time subject to legal retention requirements.

Changes to This Notice

We may update this notice from time to time. The "Last updated" date above reflects the most recent revision. Material changes will be communicated as described in our Privacy Policy.

Contact

For questions about our data practices or to exercise any of your rights:

• Email: privacy@castpact.com
• Postal: CastPact LLC, Attn: Privacy, 784 Clearwater Loop, #4458, Post Falls, ID 83854, USA
• Response time: Within 10 business days of receipt