SweepsyPrivacy policy
Effective 30 October 2026 · previous versions 19 October 2026 and 9 September 2026
This page explains what personal data Sweepsy collects, why, who receives it, how long we keep it, and what you can ask us to do.
Who we are
Sweepsy is operated by L.T.B. capital ltd, a company registered in Cyprus under number HE 489022, with its registered office at 28is Oktovriou 261, View Point Tower, 8th floor, 3035 Limassol, Cyprus. In this policy "we" means that company.
We are the controller for data about website visitors, waitlist applicants, brand accounts, and shoppers who enter a Sweepsy prize draw. For order data that we receive from a brand's Shopify store, the brand is the controller and we process it for the brand under the Sweepsy service agreement.
What we collect
Website visitors. Our servers record the IP address, the page requested, the time and the browser type in short-lived logs. Analytics data is collected only if you accept analytics cookies (see Website analytics).
Waitlist and campaign requests. If you apply to the waitlist we store your name, email, store URL and the details you send.
Brand accounts. For a brand that joins a campaign we store the account email, the names and roles of team members, the company details given for the company check, and the signature record of the service agreement: signer name, role, signature image, time, IP address and document hash.
Shopify app. If a merchant installs the Shopify app we store the shop domain, encrypted access tokens, campaign settings, and order data needed to issue draw tickets: email, name when provided, order id, line items, order value, discounts, and refund or cancellation status.
From the order's shipping address we also store the shopper's country with their entry details. We read the state or province to check that the shopper's region may enter the campaign. We do not store the state or province.
Free entries. A shopper who uses the free entry route gives us their first name, last name, email, the statement the official rules ask for, and, where the rules require it, a phone number, postal address and region.
Winners. To award a prize we collect what the official rules require: proof of identity and eligibility, an affidavit and release where the rules name one, a delivery address, and tax details such as a completed W-9 for US winners above the threshold in the rules.
Support. If you email us we keep the message and our reply.
Why, and the legal basis
We use personal data to run prize draws, publish official rules, contact winners, meet GDPR and Shopify privacy webhooks, collect the campaign fee through Stripe, and bill the revenue share through Shopify. We do not sell personal data, and we do not use it for advertising.
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Issue entries, run the draw, verify and contact winners, deliver prizes | Performance of a contract with the entrant (the official rules), and our legal obligations under sweepstakes law |
| Operate brand accounts, invoice the campaign fee, report and bill the revenue share | Performance of the service agreement with the brand |
| Keep the signature record, tax forms, winner affidavits and billing records | Legal obligation (tax, company and sweepstakes law) |
| Detect fraud and duplicate entries, keep the draw verifiable, secure the service | Our legitimate interest in a fair draw and a secure service |
| Answer waitlist applications and support requests | Steps you ask us to take before a contract, and our legitimate interest in answering you |
| Website analytics | Your consent, which you can withdraw at any time |
Shopify
Orders arrive through Shopify webhooks. Shopify is the source of the shopper data. We process it to issue tickets and to fulfil a prize. Protected customer data is used only for entry and winner contact. We honour Shopify's customer data request, customer redact and shop redact webhooks.
Stripe
A participating brand pays the campaign fee through a Stripe invoice that Sweepsy emails to the brand. Stripe processes that payment for us. Stripe collects the card details, the billing name and address, the email and, where Stripe supports it, a business tax ID. We do not receive card numbers. We store the amount, the currency, the payment status and Stripe's payment references.
Transfers outside the EEA
We are in Cyprus. Most of our providers are in the United States. When we transfer personal data outside the European Economic Area, we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the clauses we use.
Website analytics
If you accept analytics cookies on our public website, we use Google Analytics 4 to measure visits, the pages you view, the website that sent you and clicks on links to our request form and demo store. Google processes this data for us. We do not send your name, email, store URL or form answers. Google signals and advertising features are off. We keep this data for 14 months. You can change your choice on the Cookies page.
Public draw records
Every draw has a public verification page. It shows the campaign, the draw procedure, the sealed commitment and the winning ticket numbers. It does not show names or emails.
We publish a winner's first name and country, or the winner's name in the form the winner approves, only when the winner agrees in the winner release. Otherwise the public record shows the winning ticket number only.
How long we keep data
| Data | How long |
|---|---|
| Entry records | Identity fields are removed 60 days after the prize is awarded and the campaign is closed. The ticket numbers stay, because a completed draw is a public record. |
| Order data from a brand's store | 24 months after the campaign ends, unless tax or company law requires longer |
| Winner records: verification, affidavit, release, tax forms, delivery | 6 years after the prize is awarded, as tax and company law require |
| Brand account, signature record, invoices and billing records | The life of the account, then 6 years |
| Shop credentials | Cleared when the app is uninstalled and on a shop redact webhook |
| Waitlist applications | 24 months after our last contact with you |
| Support emails | 24 months after the request is closed |
| Server and error logs | Up to 90 days |
| Website analytics | 14 months |
After a shopper deletion request we keep the ticket numbers and remove identity fields at once, unless we must keep a record to award or report a prize.
Security
Data travels over TLS. Shopify access tokens are stored encrypted. Access to personal data is limited to the people who need it for their work, and admin access requires two-factor authentication. If a personal data breach puts you at high risk, we tell you and the supervisory authority as the GDPR requires.
Your rights
You can ask us for a copy of your personal data, ask us to correct it, delete it, restrict how we use it, or give it to you in a portable format. You can object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time; this does not affect processing before the withdrawal.
Email help@trysweepsy.com. We answer within one month. We may ask you to confirm your identity first. Shoppers should also use Shopify's own tools, because Shopify holds the order record.
You can complain to the Office of the Commissioner for Personal Data Protection, Cyprus, or to the authority in the EEA country where you live or work.
We do not use personal data for automated decisions with legal or similar effects. The draw itself selects a ticket at random; it does not evaluate the person.
US state privacy rights
If you live in a US state with a consumer privacy law, such as California, you have the right to know what personal information we collect and how we use it, to request a copy, to correct it, and to delete it. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information for anything other than the purposes above. We do not discriminate against you for exercising your rights.
To exercise a right, email help@trysweepsy.com. An authorised agent may act for you if you give the agent written permission. We respond within 45 days, or tell you if we need 45 more. The categories of personal information we collected in the past 12 months are the ones listed under What we collect, and the recipients are the ones listed under Who receives data.
Age
Sweepsy and every draw we run are for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe we hold such data, email help@trysweepsy.com and we will delete it.
Changes
When we change this policy we update the date at the top and keep the previous dates there. If a change affects how we use data we already hold, we tell brands by email and shoppers through the campaign page before the change takes effect.
Contact
L.T.B. capital ltd, 28is Oktovriou 261, View Point Tower, 8th floor, 3035 Limassol, Cyprus. Email help@trysweepsy.com. See also the terms of use and the cookies page.