Privacy POLICY

CQ Nexus Privacy Policy Effective Date: March 1, 2026 CEI Limited / Casino Education Investments LLC

Introduction

CQ Nexus is a digital casino education and training platform operated by Casino Education Investments LLC on behalf of CEI Limited (collectively, “we,” “us,” or “CQ Nexus”). We are committed to protecting the privacy and security of your personal information.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, how long we retain it, and what rights you have regarding your data. It applies to all interactions with the CQ Nexus application, the website at play.cqnexus.com, and any related services.

By creating an account or using any CQ Nexus service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use our services.

This policy covers: play.cqnexus.com, the CQ Nexus iOS and Android apps, the Nexus+ companion platform, the token economy system, and all Creator tools. It does not cover third-party services or platforms linked from our app, which have their own privacy policies.

Table of Contents

1. Who We Are and How to Contact Us
2. What Personal Data We Collect
3. How We Collect Your Data
4. Legal Basis for Processing Your Data
5. How We Use Your Personal Data
6. Who We Share Your Data With
7. Token Economy and Financial Data
8. Children’s Privacy
9. Data Security
10. Cookie Policy
11. Data Retention
12. Your Privacy Rights
13. California Privacy Notice (CCPA)
14. International Data Transfers
15. Third-Party Links and Integrations
16. Responsible Use and Platform Limitations
17. Changes to This Privacy Policy
18. Contact Us

Section 1 — Who We Are and How to Contact Us

1.1 Data Controller

The data controller responsible for your personal information is:

Legal Entity: CEI Limited (Merchant of Record) / Casino Education Investments LLC (Operations) Platform: CQ Nexus — play.cqnexus.com Privacy & Support Contact: [email protected] Response Time: Within 30 days for all privacy rights requests

Section 2 — What Personal Data We Collect

We collect personal data in three ways: information you provide directly, information collected automatically when you use our platform, and information received from third parties such as payment processors.

Account & Identity Name, email address, username, password (hashed), profile photo. Retained for the life of your account plus 2 years post-deletion.

Contact Information Email address, phone number if provided for two-factor authentication. Retained for the life of your account plus 2 years.

Payment & Billing Last 4 digits of card, billing address, transaction IDs, order history. Full card data is processed by Stripe and PayPal — we never store raw card numbers. Retained for 7 years for tax and legal compliance.

Token Wallet & Ledger Token balance, transaction history, transfer records, redemption requests, associated USD values. Retained for 7 years from each transaction.

Gameplay & Session Data Games played, session duration, betting patterns, strategies used, session outcomes, achievement progress, XP earned. Retained for the life of your account plus 2 years.

Subscription & Entitlement Active tier, purchase date, renewal date, entitlement flags per game. Retained for the life of your account plus 7 years.

Creator Profile Data Creator bio, linked payout account info, published content metadata, community space settings. Retained for the life of your creator account plus 7 years.

Tax & Compliance (Creators) W-9 or W-8BEN form data, SSN (last 4), EIN, legal name, country of residence. Retained for 7 years minimum per IRS requirements.

Community Contributions Forum posts, strategy content, comments, direct messages. Retained for the life of your account and may be retained in anonymized form after deletion.

Device & Technical Data IP address, device type, OS version, browser, app version, crash reports. Retained for 90 days (detailed logs) and 2 years (aggregated analytics).

Usage & Behavioral Data Pages visited, features used, click patterns, session frequency, time on platform. Aggregated data retained indefinitely; individual data anonymized after 2 years.

Communications Support tickets, email correspondence, in-app messages to our support team. Retained for 3 years from last interaction.

reCAPTCHA & Security Mouse movements, interaction patterns, IP address, browser fingerprint elements processed by Google reCAPTCHA. Retained per Google’s reCAPTCHA data policy.

Section 3 — How We Collect Your Data

3.1 Directly From You

You provide data to us when you register for a CQ Nexus account, complete a purchase through our checkout, subscribe to a Nexus+ plan, purchase token packs, apply for Creator status and complete onboarding, submit a W-9 or W-8BEN tax form for Creator payouts, contact our support team, participate in community discussions or post content, or fill out surveys, promotions, or early access sign-up forms.

3.2 Automatically

We and our service providers automatically collect data when you use our platform, including cookies and similar tracking technologies, server logs recording IP addresses and pages visited, in-app analytics events triggered by your actions, crash reports and performance data from our monitoring tools, and Google reCAPTCHA behavior analysis during registration and checkout.

3.3 From Third Parties

We receive data from Stripe (payment confirmation, tokenized card references, Connect account status), PayPal (payment confirmation and transaction identifiers), Google reCAPTCHA (risk scoring for bot and fraud detection), analytics providers (aggregated and anonymized usage patterns), and app stores (purchase confirmation and subscription status for in-app purchases).

Section 4 — Legal Basis for Processing Your Data

We process your personal data on the following legal bases.

Contract: Processing your account information, purchase history, entitlements, subscription status, and gameplay data is necessary to perform our contract with you and deliver the services you purchased.

Legal Obligation: We retain financial transaction records, tax documents, and creator payout records to comply with IRS reporting requirements, anti-money-laundering obligations, and applicable financial regulations.

Legitimate Interest: We collect device data, usage analytics, behavioral patterns, and security data to prevent fraud, improve platform stability, optimize user experience, and protect our platform and users from abuse.

Consent: We use non-essential cookies, marketing analytics, and promotional communications based on your consent. You may withdraw consent at any time. Withdrawal does not affect prior processing.

Section 5 — How We Use Your Personal Data

5.1 To Deliver and Operate the Platform

We use your data to authenticate your login and maintain your session, grant access to purchased game licenses and subscription features, credit and manage your token wallet and process redemption requests, track your gameplay sessions and achievement progress, and enable Creator functionality including content publishing, community spaces, and payout processing.

5.2 To Process Payments and Comply with Financial Obligations

We use your data to process one-time purchases, subscription renewals, and token pack sales, issue refunds where applicable, generate and transmit Creator payouts via Stripe Connect, file required tax reporting documents including 1099-K forms for eligible Creators, and maintain a permanent auditable transaction ledger for fraud prevention and dispute resolution.

5.3 To Communicate With You

We use your data to send order confirmations, receipts, and subscription renewal notices, deliver support responses, send platform announcements and policy change notifications (these are service communications and cannot be opted out of while your account is active), and send promotional emails only with your consent and only to the extent you have not opted out.

5.4 To Keep the Platform Safe and Fair

We use your data to detect, prevent, and investigate fraud and token system abuse, enforce velocity limits on purchases and redemptions, review flagged accounts, maintain admin audit logs, and enforce our Terms of Use and Community Guidelines.

5.5 To Improve Our Products

We use your data to analyze aggregated gameplay data to improve game mechanics, review conversion funnels, identify bugs and performance issues, and conduct A/B testing on features using anonymized usage data.

5.6 What We Do NOT Do With Your Data

We do not sell your personal data to third parties for their own marketing purposes. We do not share your gameplay or session data with casinos, gaming regulators, or law enforcement absent a legal obligation. We do not use your data to build advertising profiles for sale to ad networks. We do not use your data to make automated decisions that have significant legal effects on you without human review.

Section 6 — Who We Share Your Data With

We do not sell your personal data. We share it only with service providers who help us operate the platform, and only to the extent necessary for those specific purposes.

6.1 Payment Processors Stripe, Inc. and PayPal Holdings, Inc. process payment card transactions on our behalf. CQ Nexus does not store raw payment card numbers. Stripe Privacy Policy: stripe.com/privacy. PayPal Privacy Policy: paypal.com/privacy.

6.2 Infrastructure and Hosting Our platform is hosted on cloud infrastructure with servers located in the United States. Hosting providers are contractually prohibited from accessing your data for their own purposes.

6.3 Analytics Providers We use third-party analytics tools to understand platform usage at an aggregate level. Data shared with analytics providers is anonymized or pseudonymized where possible.

6.4 Google reCAPTCHA We use Google reCAPTCHA Enterprise to protect our registration and checkout flows. Google Privacy Policy: policies.google.com/privacy.

6.5 Tax and Compliance Services For Creator payouts, we may share tax-related information with compliance services that assist with IRS 1099-K generation and filing. This sharing is required by law and limited to the minimum necessary information.

6.6 Legal and Regulatory Disclosure We may disclose your personal data if required by law, court order, or government request, or if necessary to comply with a legal obligation, protect the rights or property of CQ Nexus or CEI Limited, prevent or investigate wrongdoing, or protect the personal safety of users or the public.

6.7 Business Transfers If CQ Nexus or CEI Limited undergoes a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

6.8 With Your Consent We may share your data in other ways if you have given us specific consent, for example if you opt into a casino partnership program or featured player showcase.

Section 7 — Token Economy and Financial Data

The CQ Nexus token economy involves real monetary value and is subject to additional data handling requirements.

7.1 What Token Economy Data We Maintain

For every token transaction — purchases, tips, service payments, tournament entries, and redemptions — we maintain a permanent ledger entry that includes the transaction type and status, sending and receiving user identifiers, token amount and equivalent USD value at time of transaction, related order ID or payout ID, and timestamp and IP address at time of transaction.

7.2 Why This Data Cannot Be Deleted

Token transaction records are retained for a minimum of 7 years from the date of each transaction regardless of account deletion requests. This retention is required for anti-money-laundering compliance, IRS 1099-K reporting obligations for eligible creators, chargeback dispute resolution, and internal fraud investigation and prevention.

If you delete your account, your personal profile, gameplay data, and community contributions will be removed. However, your wallet transaction records will be retained in anonymized form — linked to an internal ID, not your name or email — for the full retention period required by law.

7.3 Creator Financial Data

Creators who participate in the payout program provide identity and tax information to CQ Nexus and directly to Stripe, including legal name and address, Social Security Number or EIN (last 4 digits stored by us; full number handled by Stripe), W-9 or W-8BEN form data, and bank account or debit card information for payouts processed exclusively by Stripe. Creators who do not complete tax verification are ineligible to redeem tokens.

Section 8 — Children’s Privacy

8.1 Age Requirement

CQ Nexus is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If you are under 18, do not create an account or use our services.

8.2 If We Discover a Minor Has Registered

If we become aware that we have collected personal information from a user under 18, we will immediately suspend the account pending review, delete all personal data associated with the account, reverse any token purchases made by the account where technically possible, and notify the parent or guardian if contact information was provided. To report a suspected underage account, contact [email protected].

8.3 COPPA Notice

CQ Nexus does not operate as a children’s service as defined by the Children’s Online Privacy Protection Act. We do not direct our service toward children and do not knowingly collect data from children under 13.

Section 9 — Data Security

9.1 Our Security Measures

Passwords are hashed and salted using industry-standard algorithms. All data transmission is encrypted using TLS 1.2 or higher. Payment card processing is handled entirely by Stripe and PayPal — raw card data never touches our servers. Token transaction ledgers are maintained in an append-only architecture that prevents retroactive modification. Admin actions that affect wallet balances or entitlements are logged with full audit trails. Velocity limits and fraud detection algorithms monitor token purchase and transfer patterns in real time. Google reCAPTCHA protects registration and checkout from automated bot attacks. Creator payout eligibility requires identity verification through Stripe Connect before any redemption.

9.2 Data Breach Response

In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the breach, notify relevant regulatory authorities where required by applicable law, and provide information about what data was affected and what steps you can take.

9.3 Your Role in Security

You can help protect your account by using a strong unique password, enabling two-factor authentication when available, not sharing your login credentials, logging out from shared or public devices, and reporting any suspicious account activity to [email protected] immediately.

Section 10 — Cookie Policy

10.1 What Cookies Are

Cookies are small text files placed on your device by websites and apps you visit. They serve functions ranging from keeping you logged in to remembering your preferences to helping us understand how people use our platform.

10.2 Types of Cookies We Use

Strictly Necessary Cookies are essential for the platform to function and cannot be disabled. They include session authentication cookies, security tokens that protect against cross-site request forgery, and checkout session cookies that maintain your cart during purchase.

Functional Cookies remember your preferences and settings, including language and display preferences, your chosen game settings and layout preferences, and whether you have dismissed certain notifications or tutorials.

Analytics Cookies help us understand how users navigate and use the platform. The data collected is aggregated and does not directly identify you. You may opt out of analytics cookies in your account settings or through our cookie consent tool.

Third-Party Cookies from Google reCAPTCHA are set as part of its bot detection functionality and are processed in accordance with Google’s Privacy Policy.

10.3 Managing Cookies

You can control and delete cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in or completing purchases.

Section 11 — Data Retention

Active accounts: All account data is retained while your account is active and for 2 years following account deletion.

Financial and transaction records: Retained for 7 years from the date of each transaction to meet IRS, anti-money-laundering, and payment processor requirements.

Creator tax documentation: Retained for a minimum of 7 years from the date of filing per IRS requirements.

Support communications: Retained for 3 years from the date of last interaction.

Security and fraud logs: Retained for 90 days (detailed logs) and up to 2 years (aggregated risk signals).

Analytics data: Aggregated and anonymized analytics retained indefinitely; individual behavioral data anonymized after 2 years.

Community content: Retained for the life of the account and may be retained in anonymized form after deletion if the content has been engaged with by other users.

When your account is deleted, we anonymize your personal identifiers — name, email, IP address — and retain the anonymized data for the periods above. We do not retain identifiable personal data beyond these windows except where required by law.

Section 12 — Your Privacy Rights

Depending on where you live, you may have specific rights regarding your personal data. We honor these rights for all users regardless of location to the extent technically and legally feasible.

Right to Access: Request a copy of all personal data we hold about you. Email [email protected] with the subject line “Data Access Request.” We respond within 30 days.

Right to Correction: Request correction of inaccurate or incomplete data. Update most information directly in your Account Settings, or contact us for records you cannot edit.

Right to Deletion: Request deletion of your account and associated data. We will delete or anonymize your data within 30 days, except where retention is required by law (see Section 11).

Right to Data Portability: Request a machine-readable export of your gameplay data, session history, achievement records, and token transaction history. Email [email protected].

Right to Restrict Processing: Request that we limit how we use your data while a dispute or correction request is pending. Contact [email protected].

Right to Object: Object to processing based on legitimate interest, particularly for direct marketing. You may opt out of marketing emails at any time via the unsubscribe link in any email.

Right to Withdraw Consent: Withdraw consent for non-essential cookies, analytics, and marketing communications at any time via Account Settings or by contacting us. Withdrawal does not affect prior lawful processing.

CCPA — Right to Know (California residents): Request disclosure of personal data categories collected, sources, purposes, and third parties with whom data is shared.

CCPA — Right to Non-Discrimination (California residents): You will not receive different service or pricing for exercising your privacy rights.

GDPR — Right to Lodge a Complaint (EU/EEA residents): You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data appropriately.

12.1 How to Submit a Request

Contact us at [email protected] with your full name and account email address, the specific right you are exercising, and any relevant details to help us locate your data. We will respond within 30 days and may request verification of your identity before processing certain requests.

Section 13 — California Privacy Notice (CCPA)

This section provides additional disclosures required by the California Consumer Privacy Act and the California Privacy Rights Act for California residents.

13.1 Categories of Personal Information Collected

In the preceding 12 months, CQ Nexus has collected identifiers such as name, email, IP address, and device identifiers; personal information listed in the California Customer Records Act including payment information and partial financial account data; internet or other electronic network activity including usage data and gameplay patterns; inferences drawn from personal information such as skill level, progression stage, and product preferences; and professional or employment-related information for Creators including business type and content category.

13.2 Sale or Sharing of Personal Information

CQ Nexus does not sell personal information as defined by the CCPA. We do not share personal information with third parties for cross-context behavioral advertising.

13.3 Sensitive Personal Information

We collect Social Security Numbers (last 4 digits) and full SSN/EIN via tax forms for Creator payout compliance only. We do not use sensitive personal information for any purpose other than what is required by law or necessary to fulfill our payout obligations.

13.4 Exercising CCPA Rights

California residents may submit requests to know, delete, or correct their personal information by contacting [email protected]. We will not discriminate against you for exercising these rights.

Section 14 — International Data Transfers

CQ Nexus is operated from the United States. If you access our platform from outside the United States, your personal data will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

For users in the European Union or European Economic Area, we ensure that transfers of personal data outside the EEA are subject to appropriate safeguards, including Standard Contractual Clauses approved by the European Commission or other transfer mechanisms recognized under applicable law.

By using CQ Nexus, you consent to this transfer and processing of your data in the United States.

Section 15 — Third-Party Links and Integrations

Our platform may contain links to third-party websites, casino partner pages, or external resources. We are not responsible for the privacy practices of those third parties. This Privacy Policy applies only to CQ Nexus and its services.

When you click a link to an external website or use a third-party feature integrated into CQ Nexus, you leave the CQ Nexus environment and that site’s own privacy policy applies. We encourage you to review the privacy policy of any third-party site you visit.

Section 16 — Responsible Use and Platform Limitations

CQ Nexus is a casino education and simulation platform. We do not facilitate real-money wagering. Tokens are platform currency with defined exchange rules, not gambling chips, and our games do not involve real stakes.

If you wish to limit your account activity, restrict token purchases, or close your account, contact [email protected]. We will work with you to implement appropriate account-level controls.

Section 17 — Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or platform features. When we make material changes, we will post the updated policy at play.cqnexus.com/privacy, update the effective date at the top of this document, send an email notification to your registered address at least 14 days before the change takes effect, and display an in-app notification requiring acknowledgment for significant changes.

Your continued use of the platform after the effective date constitutes acceptance of the updated terms. If you do not agree with the updated policy, you may close your account before the effective date.

Section 18 — Contact Us

For all privacy questions, requests, and support:

Email: [email protected] Website: play.cqnexus.com/privacy Response Time: Within 30 days for all privacy rights requests Merchant of Record: CEI Limited

CQ Nexus — play.cqnexus.com | “When You Win, We All Win” | Privacy Policy Effective March 1, 2026