GratiData Privacy Policy

This Privacy Policy applies to GratiData services (the "Services"), which include the GratiData mobile application, website, software, and related services, accessed via any platform or device, that link to this Privacy Policy, as well as the GratiData Ad Network. The Services are operated by Agtiv Media Pte. Ltd. ("Agtiv Media", "we" or "us").

We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, share, and otherwise process the personal information of users and other individuals in connection with the Services.

Capitalised terms that are not defined in this Privacy Policy have the meaning given to them in the Terms of Service.

You provide

• Name, email address, mobile number
• Phone number OTP verification at registration
• Mobile number or e-wallet details for redemptions
• Bank account or e-wallet details for identity verification
• Profile photo and display name (optional)
• Any content or comments you submit in-app
• Messages you send to our support team

Collected automatically

Device

• Model, brand, OS version
• Android Advertising ID (GAID) or Apple IDFA
• Screen resolution, language settings

Usage

• Videos watched, ads clicked, content engaged with
• Coins earned and redeemed
• Session times, duration, frequency
• In-app navigation and feature usage

Network

• Mobile carrier, network type (WiFi or mobile data), IP address
• SIM card country and carrier (Android) / device region and IP address (iOS)

Location

• Country-level only, inferred from IP address or SIM card

Logs

• App version, crash reports, error logs, event timestamps

Cookies and SDKs

• Used to maintain your session, personalise content, and measure ad performance

From third parties

• Telecom partners: mobile number ownership
• Ad networks and DSPs: ad impression, click, and conversion data
• Analytics and attribution providers: pseudonymised install and engagement data
• Fraud detection providers: device risk scores and signals
• Third-party login providers (e.g. Google): public profile and email if you use social login

• Run your account: registration, OTP verification, profile management
• Operate the platform: serve content and ads, track engagement, calculate and maintain your coin balance
• Process redemptions: share your mobile number and redemption details with the relevant telecom partner to fulfil data top-ups
• Serve and measure ads: use device IDs, engagement data, and carrier info to deliver relevant ads and report campaign performance to advertisers
• Personalise content: recommend content based on your engagement history
• Prevent fraud: detect fake accounts, bots, click fraud, and reward manipulation
• Maintain security: monitor for suspicious activity, enforce Terms of Use
• Improve the app: analyse usage, fix bugs, test new features
• Communicate: send coin updates, redemption confirmations, policy changes, and security alerts
• Legal compliance: meet obligations under applicable laws and respond to lawful authority requests
• Aggregate analytics: produce anonymised usage statistics for internal and partner reporting

We will not use your information for other purposes without telling you first and, where required, obtaining your consent.

GratiData is ad-funded. Ad revenue is what enables us to pay out coins to users.

We work with third-party ad networks, mobile measurement partners (MMPs), and analytics providers who may embed SDKs in our app. These SDKs may independently collect:

• Advertising IDs (GAID / IDFA)
• Device model, OS, screen size
• IP address and approximate location
• Ad impression, click, and conversion events
• App install and in-app event data
• Crash and performance data

We require all SDK partners to comply with Google Play Developer Program Policies and Apple App Store Review Guidelines. We do not permit SDK partners to sell user data collected from our app.

To opt out of personalised ads:

• Android: Settings > Privacy > Ads > Opt out of Ads Personalisation
• iOS: Settings > Privacy & Security > Tracking

You will still see ads after opting out, they will just be less personalised. Your coin earnings are not affected.

We do not sell your personal information. We share it only in these cases:

• Telecom partners: your mobile number and redemption details, to fulfil data top-up requests
• Ad partners: pseudonymised advertising IDs and event data for targeting and measurement. We do not share your name, email, or phone number with advertisers
• Analytics and attribution partners: pseudonymised app event data
• Fraud detection providers: device signals and usage data, on our behalf under confidentiality obligations
• Infrastructure providers: cloud hosting, support tools, communications platforms — bound to use data only as we direct
• Legal: where required by law, court order, or government authority — limited to what is strictly necessary
• Business transfers: if we merge or are acquired, your data may transfer. We will notify you before it is subject to a different policy
• With your consent: for any other purpose where you have explicitly agreed

• Coin values, earn rates, and eligible actions may change — we will notify you in advance
• Coins have no cash value and cannot be withdrawn as cash
• Coins may expire as described in our Reward Terms (Settings > Reward Terms)
• We may withhold or cancel coins earned through fraud, manipulation, or bot activity
• Your coin balance is permanently forfeited when you delete your account

• Account data: deleted or anonymised within 30 days of account deletion
• Transaction and redemption records: up to 7 years (financial/tax regulations)
• Ad event logs: up to 90 days in identifiable form, then aggregated or deleted
• Fraud and security logs: up to 2 years
• Crash and diagnostic logs: up to 90 days
• Support communications: up to 2 years after last contact

Fully anonymised and aggregated data may be kept indefinitely.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and personal data
• Export your data in machine-readable format
• Object to processing for marketing or other purposes
• Restrict how we process your data
• Withdraw consent at any time (without affecting past processing)

To exercise any of these rights, email [[email protected]]. We respond within 30 days.

You can also delete your account directly in-app: Settings > Account > Delete Account. Your personal data will be removed within 30 days. Coin balance is permanently forfeited. This cannot be undone.

We comply with local privacy laws in all markets where we operate, including the Singapore PDPA (contact our DPO at [[email protected]]), Indonesia UU PDP (Komdigi regulations), Philippines Data Privacy Act, and Malaysia PDPA. Residents in these countries hold specific rights to access, correct, delete, or object to the processing of their data. Contact us at [[email protected]] to exercise your local legal rights.

The Services are not for users under 16, or the applicable minimum age in your jurisdiction. We do not knowingly collect data from children. If we discover a child has an account, we delete it immediately.

If you believe a child has registered, contact us at [[email protected]].

• Data in transit is encrypted using TLS
• Access to personal data is restricted to authorised team members only
• We conduct regular security reviews of our app and infrastructure
• Fraud detection systems monitor for suspicious activity continuously

If you suspect unauthorised access to your account, contact us immediately at [[email protected]]. If a breach affects your rights, we will notify you and relevant regulators as required by law.

We operate across multiple countries in Southeast and South Asia. Your data may be processed in Singapore and in countries where our service providers operate. We ensure appropriate safeguards are in place for any cross-border transfers.

If we make material changes to this policy, we will update the date above, send an in-app notification, and, where required by law, seek your renewed consent. Continued use after the effective date means you accept the updated policy.

GratiData Pte. Ltd.

UEN: 202622271H | Singapore

Email: [[email protected]]

Response time: within 30 days