Effective Date: September 9, 2026 | Version 2.0

1. At a Glance

Who we are: Mobavenue Global Holdings Limited, a company incorporated in the United Kingdom ("EarnX," "we," "us"), is the data controller for the EarnX app and website at earnx.ai.

What we collect: account and profile data, identity-verification (KYC) data, device and app-activity data, location, installed-apps data (fraud prevention only), and payout information.

Why: to run your account, verify you, validate and pay out rewards, stop fraud, comply with law, and — where you opt in — send you marketing messages.

Who we share it with: identity-verification, fraud-prevention, hosting, payment, and analytics/attribution service providers, and, in limited form, advertising partners. We do not sell your personal information.

Your choices: access, correct, delete, or export your data; opt out of marketing; opt out of "sharing" for cross-context advertising; withdraw consent.

Where it's processed: hosted on AWS in the United States, with our India-based engineering team and UK Global accessing it solely to build, secure, and support the Services.

2. Definitions

"Account" means the unique account you create to access the Services.

"Affiliate" means an entity that controls, is controlled by, or is under common control with a party.

"Personal Data" means any information relating to an identified or identifiable individual.

"Rewards Currency" means the points/units described in our Terms of Service.

"Service Provider" means a third party that processes Personal Data on our behalf.

"Services" means the EarnX mobile application and the website at earnx.ai.

"You"/"User" means the individual using the Services.

3. Scope and Who We Are

This Privacy Policy explains how Mobavenue Global Holdings Limited collects, uses, discloses, and protects Personal Data when you use the Services. We are the data controller (and, for California residents, the "business") responsible for your Personal Data. Certain functions — hosting, engineering, and support — are performed by affiliated Mobavenue group entities in India and the United States, and by third-party Service Providers, acting on our instructions.

This Policy applies to all Service users, with primary reference to users in the United States, our initial launch market. It does not apply to third-party websites, apps, or advertiser offers accessed through the Services — see our Advertising Disclosure.

4. Information We Collect

4.1. Provided Directly by You

Account and profile data: name, email address, mobile number, date of birth, gender.

Identity verification (KYC): government-issued ID details, a selfie/facial image, and verification results — collected only when required before a redemption, a targeted account review, or where legally required. Our KYC processor may process biometric information (a special category of data) to perform facial matching; we rely on your explicit consent for this specific processing.

Mobile verification: mobile number and one-time verification codes.

Payout information: PayPal account, bank/card details for gift-card or cash payout, or a crypto wallet address, handled by our third-party payment/crypto-payout processors — we do not store full card, bank account, or private wallet key data ourselves.

Survey responses and support communications you choose to provide.

4.2. Collected Automatically

Device & app activity: IP address, device identifiers (advertising ID, IMEI/IDFA), device model/OS, diagnostics, crash data, app interactions, gameplay/activity data.

Attribution data: information linking installs and in-app actions to the offer/campaign that referred you, used to validate rewards and detect fraud.

Location: approximate or precise, only where you grant device permission, used for offer eligibility, fraud detection, and sweepstakes/geographic-eligibility compliance.

Installed applications (optional, permission-based): read only with your consent, used solely to personalize offers and/or, where you separately enable a usage-access permission, to measure your activity within offer apps to verify completion and calculate rewards. This feature is off by default, can be enabled or disabled at any time in your device or app settings, and declining it does not prevent you from using your Account — though offers relying on usage measurement will not credit until it is enabled.

Fraud and security signals: device, behavioral, and usage patterns used to detect suspicious activity, multi-accounting, and automation.

Cookies and similar technologies (website): see our Cookie Policy.

4.3. From Third Parties

Advertisers, offer providers, and mobile measurement partners (attribution and offer-completion data).

Identity-verification and fraud-prevention vendors (verification status and risk indicators).

Payment/payout processors (transaction confirmations only; we do not receive full financial account numbers).

Analytics providers.

4.4. Surveys and Special Category Data

Where EarnX offers surveys as one of the ways to earn Rewards Currency, surveys are available only to users 18 or older and are switched off until you actively enable them. To match you to eligible surveys, we may ask a short set of profiler questions (e.g., gender, date of birth, and general demographic information). Some third-party survey providers ask additional qualification questions before a survey begins, and these questions — and your answers to them — may relate to special categories of data (for example, health, racial or ethnic origin, religious or philosophical beliefs, political opinions, or data concerning sex life or sexual orientation). Where such questions are answered through the Services, your answers are relayed to the relevant survey provider to determine eligibility; we do not store or log the content of these qualification answers ourselves.

We process the profiler information described above, and rely on your explicit consent for any special category data involved, only for the purpose of identifying, matching, and enabling surveys for you — never for games, advertising, analytics, or model training. Profiler answers we do store are held in encrypted form, with decryption access restricted to a limited, need-to-know group. You can withdraw survey consent at any time in your Account settings, after which surveys will no longer be shown to you and we will stop the related processing going forward; withdrawal does not affect the lawfulness of processing carried out before it. Where a survey is conducted on a survey provider's own platform (e.g., after a redirect), that provider processes your responses as an independent controller under its own privacy policy.

5. How We Use Your Information

Create, administer, and secure your Account.

Verify your identity (KYC) and mobile number.

Validate offers, gameplay milestones, and surveys, and calculate and process Rewards Currency and payouts, including routine or targeted account reviews before crediting or paying out Rewards Currency.

Detect, investigate, and prevent fraud, multi-accounting, automation/bot activity, and other abuse.

Comply with tax, anti-money-laundering, sweepstakes, and other legal recordkeeping obligations tied to payouts.

Send transactional and account/security notifications (not optional — necessary to operate the Services).

Send marketing push notifications, email, and/or SMS where you have separately opted in (Section 8).

Analyze usage to maintain, troubleshoot, and improve the Services.

Enforce our Terms of Service and this Policy, and comply with applicable law and regulatory requests.

We do not use government-ID or biometric (selfie) data for anything other than identity verification, fraud prevention, and legal compliance, and we do not sell it.

6. Legal Bases for Processing (UK/EEA Users)

Performance of our contract with you (providing the Services and paying Rewards).

Our legitimate interests in operating a secure, fraud-free platform, subject to a balancing of your rights.

Your explicit consent, in particular for biometric/KYC facial-matching, precise location, installed-apps/usage-access data, survey profiler and any special category data involved in surveys (Article 9(2)(a) GDPR), and marketing communications.

Compliance with a legal obligation (e.g., tax, anti-fraud, sweepstakes recordkeeping).

You may withdraw consent at any time via in-app settings or by contacting support@earnx.ai, without affecting the lawfulness of processing before withdrawal. Where processing relies on our legitimate interests, you may object at any time; we will stop unless we have compelling legitimate grounds that override your interests, or the processing is necessary to establish, exercise, or defend legal claims. If you object to direct marketing, we will stop immediately without requiring justification.

7. How We Share Your Information

We do not sell your Personal Data. We share it only as follows:

Identity-verification / KYC and fraud-prevention providers, to verify you and detect abuse.

Payment, payout, and crypto-transaction processors, to deliver gift cards, cash, or crypto payouts.

Cloud hosting (AWS, United States).

Analytics and attribution (MMP) providers and advertising/offer partners, limited to device, attribution, and offer-completion data reasonably necessary to validate a reward and measure performance — advertisers do not receive your KYC or payout data.

Affiliated Mobavenue group entities, including our India-based product/engineering team, on a need-to-know basis to build, debug, and support the Services (Section 12).

Authorities and legal counterparties, where required by law, court order, or to enforce our Terms of Service, or to protect the rights, property, or safety of EarnX, our users, or the public.

A successor entity, in connection with a merger, financing, acquisition, or asset sale, subject to confidentiality safeguards.

Anyone else, only with your consent.

8. Marketing Communications

Where required by law, we obtain your separate, opt-in consent — distinct from acceptance of this Policy and the Terms of Service — before sending marketing push notifications, email, and/or SMS. You may opt out at any time via an email unsubscribe link, replying STOP to SMS, adjusting device notification permissions, or updating in-app preferences. Opting out of marketing does not opt you out of transactional or account-security messages necessary to operate the Services.

9. Your Privacy Rights and Choices

9.1. General Rights

Depending on your location, you may have the right to access, correct, delete, or export your Personal Data; restrict or object to certain processing; withdraw consent; and opt out of marketing and, where applicable, targeted/cross-context advertising. Contact support@earnx.ai or use in-app account settings. We will verify your identity before actioning a request and respond within the timeframe required by applicable law. We may deny a request where permitted by law, including to complete a transaction, detect fraud, or comply with a legal obligation, and, for security, we are not required to disclose the specific fraud-detection signals underlying a decision (see Terms of Service, Section 8).

9.2. California (CCPA/CPRA)

Right to know/access, correct, delete, and limit use of sensitive Personal Data (e.g., government ID, precise location, biometric data).

Right to opt out of "sale" or "sharing" (including cross-context behavioral advertising). We do not sell Personal Data for money. To the extent our attribution/advertising partners' access constitutes a "share," you may opt out via support@earnx.ai or an in-app/on-site "Do Not Sell or Share My Personal Information" control.

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out-of-sharing request on our website.

Notice of Financial Incentive: because you earn Rewards Currency in exchange for completing offers that involve providing data to advertisers, this may constitute a "financial incentive" program under the CCPA. Participation is voluntary, the reward value is reasonably related to the value of the data involved, and you may withdraw at any time by ceasing to complete offers, without losing access to the core Services.

We will not discriminate against you for exercising any CCPA right.

9.3. Other U.S. State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws in effect have equivalent rights of access, correction, deletion, portability, and opt-out of targeted advertising and profiling, which we honor as required in each applicable state.

9.4. United Kingdom / European Economic Area

UK/EEA users have the rights in Section 9.1 above, plus the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or their local supervisory authority.

9.5. India

Our India-based product and engineering affiliate accesses U.S.-hosted production data solely to build, support, and secure the Services. Because the Services are directed exclusively at users located outside India, we do not currently treat the Digital Personal Data Protection Act, 2023 as applicable to this processing; we will revisit this position if the Services are extended to users in India.

10. Children's Privacy

10A. Age Screening and Users Under 13

Before any account creation begins, the Services ask for your date of birth through a neutral age-screening question (we do not simply ask "are you 18 or older"). If this indicates you are under 13, we do not permit account creation and do not collect any further personal information from you; we do not knowingly collect personal information from anyone under 13. If we later learn that we have collected personal information from a user under 13 without Verifiable Parental Consent, we will delete that information promptly. A parent or guardian who believes their child under 13 has provided us personal information should contact us immediately at support@earnx.ai.

10B. Minor Accounts (Ages 13–17)

Users aged 13 to 17 may hold a Minor Account only with Verifiable Parental Consent ("VPC") from a parent or legal guardian, obtained before any Account is created or any personal information beyond the age-screening question is collected. We obtain VPC using one or more methods recognized under the U.S. Children's Online Privacy Protection Act (COPPA), such as a signed consent form returned to us, verification of a government-issued ID cross-checked against a database and deleted promptly after verification, a live video call with trained personnel, a small payment-card transaction with immediate notice to the cardholder, or another method that provides comparable assurance that the person providing consent is the child's parent or guardian.

For a Minor Account, we collect only what is reasonably necessary to operate the account: the minor's name, date of birth, and the parent/guardian's contact information for consent and communication purposes, plus the limited device and security data described in Section 4.2 needed to keep the account secure. We do not collect precise location, installed-apps/usage-access data, or identity-verification (KYC) data — including biometric data — from a Minor Account. We do not send marketing communications to a Minor Account, do not serve targeted or behavioral advertising to a Minor Account (Offers shown are generic/contextual, not personalized based on profiling), and do not sell or share a Minor Account's personal information for cross-context behavioral advertising.

A parent or guardian may, at any time and free of charge: review the personal information we have collected about their child; request correction or deletion of that information; refuse to permit further collection or use of it; and revoke their consent, which will result in closure of the Minor Account. To exercise any of these rights, contact support@earnx.ai; we will take reasonable steps to verify that the requester is the child's parent or guardian before acting on the request.

10C. General

Full use of the Services — including identity verification, redemption of Rewards Currency, and participation in sweepstakes or promotions — is available only to users who have reached the Age of Majority (18, or the age of majority in their jurisdiction if higher), consistent with our Terms of Service, Section 2.

11. Sweepstakes, Rewards, and Payout-Related Disclosures

Where redemption of Rewards Currency is structured as a sweepstakes, prize draw, or similar promotion under applicable state law, we collect and retain the additional information required by the applicable Additional Promotional Terms/Official Rules (published separately, where issued), which may include a mailing address and tax identification information for reportable payouts. Where you choose crypto payout, your public wallet address is retained for transaction and tax-recordkeeping purposes; we do not custody crypto assets beyond what is necessary to route a payout through our processor.

12. International Data Transfers

Your data is hosted on AWS infrastructure in the United States and may be accessed by our affiliated engineering team in India and UK Global, solely to provide, secure, and support the Services. Where required, we implement safeguards for these transfers, including intra-group data processing agreements and, where applicable, the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

13. Data Retention

Account and profile data: retained for the life of your Account and for a limited period after closure to resolve disputes and comply with law.

KYC/identity-verification records: retained for the period required by applicable anti-fraud, sweepstakes, and financial recordkeeping obligations.

Transaction and payout records: retained as required by tax and financial recordkeeping law.

Device/usage/fraud-signal data: retained for a shorter operational period unless needed longer for security, dispute, or legal reasons.

Marketing consent records: retained until you withdraw consent, plus a limited compliance record of that withdrawal.

When data is no longer needed, we delete or anonymize it in accordance with our internal retention schedule.

14. Security

We use administrative, technical, and organizational safeguards designed to protect your data, including encryption in transit, need-to-know access controls, and regular security review of our AWS environment. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. Cookies

Our website at earnx.ai uses cookies and similar technologies. See our separate Cookie Policy.

16. Third-Party Links and SDKs

The Services may include or link to content, offers, and software development kits (SDKs) from third parties (e.g., analytics, attribution, push-notification, and offer-network providers). We do not control, and are not responsible for, the privacy practices of these third parties.

17. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified through the Services or other reasonable means before taking effect. Your continued use of the Services after the effective date of an update constitutes acceptance.

18. Contact Us

Email: support@earnx.ai

Postal address: Mobavenue Global Holdings Limited,
803 WIMHURST COURT, 168 UPPER NORTH STREET United Kingdom London E14 6TX United Kingdom

UK/EEA users who remain unsatisfied with our response may contact the ICO or their local data protection authority; California users may contact the California Attorney General's office.