Privacy Policy
This Privacy Policy explains how ZenithStar Group LLC ("ZenithStar Group," "we," "us," or "our") collects, uses, and protects information when you use SweepCard (the "Service"). It's written to reflect how SweepCard actually works technically, not as a generic template.
1. Information You Provide to Us
- Account information: name, email address, and password (or authentication credentials) when you create an account.
- Identity verification (KYC) information: collected only once you approach the redemption threshold or another point that legally requires verification — government-issued ID, a selfie for comparison, date of birth, and address, collected through our identity verification partner (see Section 5). We do not collect this information at signup.
- Gift card information: the card number, expiration date, and CVC/PIN of any card you submit for redemption, plus the amount you report as remaining on the card.
- Communications: anything you send us directly, such as support requests.
2. How We Handle Gift Card Data Specifically
This is the most sensitive data category SweepCard handles, so we want to be specific about it:
- Your full card number, expiration date, and CVC/PIN are tokenized and transmitted securely (via TLS encryption) for the purpose of attempting a single redemption.
- We do not store your full card number, expiration date, or CVC/PIN on your device or on our servers in raw form. Only the last four digits of the card number are retained locally, for display purposes in your redemption history.
- Raw card details are discarded from active memory immediately after a redemption attempt completes (success or failure) and are not retained by us beyond what is necessary to process that attempt and to investigate fraud.
- We use certificate pinning, encrypted local storage (e.g., Android EncryptedSharedPreferences / Jetpack Security), and third-party tokenization to protect sensitive data in transit and on-device.
3. Information We Collect Automatically
We may collect device information (device type, operating system version), app usage data (screens visited, features used, crash reports), and approximate location derived from your IP address, for fraud prevention, product improvement, and troubleshooting.
4. How We Use Your Information
- To operate the Service: process redemption attempts, maintain your Coin balance, and fulfill Coin redemptions (gift cards, charity donations, in-app spend).
- To verify your identity and comply with anti-money-laundering (AML) and know-your-customer (KYC) obligations.
- To detect, investigate, and prevent fraud, including flagging reused or suspicious card numbers.
- To communicate with you about your account, redemption results, and material changes to our Service or these policies.
- To comply with legal obligations, including responding to lawful requests from regulators or law enforcement.
5. Who We Share Information With
We share information with the following categories of third parties, only as needed to operate the Service.
- Redemption partners — gift card processing networks, to attempt card redemptions and to purchase wholesale gift cards for Coin redemption.
- Tokenization / payment security vendors — to process and tokenize raw card data in a PCI-DSS-compliant manner, so raw card data does not reach our own databases.
- Identity verification providers — to perform KYC/AML checks.
- Banking-as-a-Service / payment partners, if and when we introduce features requiring a licensed money-transmission partner (see our Terms of Service, Section 3). No such partner is currently in use.
- Service providers who help us operate the app, such as cloud hosting and crash-reporting tools, under confidentiality obligations.
- Legal and regulatory authorities, when required by law, subpoena, or to investigate suspected fraud or illegal activity.
We do not sell your personal information to third parties for their own marketing purposes.
6. Data Retention
We retain account and Coin ledger information for as long as your account is active and as needed to comply with legal, tax, and anti-fraud obligations after closure. As noted in Section 2, raw gift card numbers and CVC/PIN data are not retained beyond the redemption attempt itself.
7. Your Choices and Rights
You may request access to, correction of, or deletion of your personal information by contacting us at sweepcard@zenithstar-group.com. Depending on your state of residence, you may have additional rights under state privacy laws; to exercise any of them, contact us at the same address.
8. Children's Privacy
SweepCard is not directed to, and may not be used by, anyone under 18 years of age. We do not knowingly collect information from anyone under 18. If we learn we have done so, we will delete that information.
9. Data Security and PCI Compliance
We use industry-standard safeguards, including strong encryption for data at rest and TLS encryption for data in transit, encrypted local storage for sensitive data, certificate pinning on our redemption and payout endpoints, and code obfuscation in release builds. We rely on third-party PCI-DSS-compliant tokenization so that raw card data does not touch our own backend databases (see Section 2). No system is completely secure, and we cannot guarantee absolute security of your information.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the app before they take effect.
11. Contact Us
Questions about this Privacy Policy can be sent to sweepcard@zenithstar-group.com.
ZenithStar Group LLC · A Texas Limited Liability Company · SweepCard is a product of ZenithStar Group LLC