Privacy Policy | Shark Earnings

Last updated: May 30, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

This comprehensive data protection policy outlines our GDPR compliance measures and privacy practices for all Shark Earnings users. We are committed to protecting your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR").

We use Your Personal Data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Shark Earnings, a service operated by Stark Krisztián, sole proprietor, whose detailed information can be found in our Terms of Service.
• Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
• Country refers to: Hungary
• Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the Website.
• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Website refers to Shark Earnings, accessible from https://sharkearnings.com
• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Data Controller

The Data Controller responsible for Your Personal Data under this Privacy Policy is:

• Name: Stark Krisztián, sole proprietor
• EU VAT Number: HU91383895
• Registration Number: 61025181
• Email: krisztian@sharkearnings.com

As the Data Controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that such processing complies with applicable data protection laws, including the GDPR.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data:

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• Username
• Usage Data
• IP Address
• Biometric data (facial image and facial geometry for identity verification via Face Match)
• Government-issued identification documents (passport, driver's license, national ID card)
• Proof of address documents (utility bills, bank statements, tax documents, government correspondence)
• Selfie photographs with identification documents for enhanced verification
• Device fingerprint and session data for fraud prevention
• Payment information (PayPal email address, cryptocurrency wallet address)
• Communication data (support messages, chat messages)

Usage Data:

Usage Data is collected automatically when using the Service. Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. For more details, please see our Cookie Policy.

Purposes and Legal Basis for Processing

We process your personal data only where we have a valid legal basis under Article 6 of the GDPR. The sections below set out each processing purpose, the data involved, and the applicable legal basis.

2.1 Security and Operation of the Service

Purpose: Technical provision of the Service, server security, bot protection, error prevention, and fraud detection. This includes processing server logs containing IP addresses, device identifiers, and connection data.

Legal Basis: Article 6(1)(f) GDPR -Legitimate interest. Our legitimate interest is to operate a secure and functional platform and to protect our users and business from fraud, abuse, and unauthorized access. This interest outweighs any privacy impact given the security-critical nature of this processing.

2.2 Account Registration and Service Provision

Purpose: Creating and managing your account, providing access to earning activities, processing reward conversions and withdrawals, and fulfilling our contractual obligations to you.

Legal Basis: Article 6(1)(b) GDPR -Performance of a contract. Processing is necessary to provide the Service you have registered for.

2.3 Identity Verification and KYC (Know Your Customer)

Purpose: Verifying your identity through biometric Face Match (via Verisoul), processing government-issued identification documents, proof of address, and selfie photographs before enabling withdrawal services. This is required to prevent fraud, ensure account security, and comply with applicable financial regulations.

Legal Basis: Article 6(1)(b) GDPR -Performance of a contract (verification is a prerequisite for the withdrawal service); and Article 6(1)(f) GDPR -Legitimate interest in preventing fraud and protecting the platform and its users. For biometric data specifically: Article 9(2)(a) GDPR -Your explicit consent, given at the time of verification.

2.4 Payment Processing

Purpose: Processing withdrawal requests via PayPal (through Tremendous) and cryptocurrency (through NOWPayments), including transmitting necessary payment information to our payment processors.

Legal Basis: Article 6(1)(b) GDPR -Performance of a contract. Processing is necessary to fulfill your withdrawal request.

2.5 Direct Marketing and Communications

Purpose: Sending you promotional emails, platform updates, reward notifications, and information about new features or offers. Essential communications (security alerts, account notifications, policy updates) are always sent regardless of marketing preferences.

Legal Basis: Article 6(1)(a) GDPR -Consent for promotional communications (you may withdraw consent at any time via your account settings); Article 6(1)(b) GDPR -Performance of a contract for essential service communications.

2.6 Compliance with Legal Obligations

Purpose: Retaining records to comply with applicable tax laws, anti-money laundering (AML) legislation, and other regulatory requirements. Disclosing data to competent authorities when legally required.

Legal Basis: Article 6(1)(c) GDPR -Compliance with a legal obligation.

2.7 Improving the Service

Purpose: Analyzing usage patterns, identifying trends, evaluating the effectiveness of features and promotions, and improving the overall user experience.

Legal Basis: Article 6(1)(f) GDPR -Legitimate interest. Our legitimate interest is to improve and develop our Service. We minimize data used for this purpose and do not use data in a way that is disproportionate to your privacy interests.

2.8 Business Transfers

Purpose: If we are involved in a merger, acquisition, or asset sale, your Personal Data may be evaluated or transferred as part of that transaction.

Legal Basis: Article 6(1)(f) GDPR -Legitimate interest in conducting ordinary business operations including restructuring or transfers.

Third-Party Service Providers (Data Processors)

We do not sell your personal data to third parties. We engage the following third-party service providers ("data processors") who process personal data on our behalf, under binding contractual obligations that require them to protect your data in accordance with GDPR.

Verisoul, Inc. -Identity Verification & Fraud Prevention

Address: 1401 Lavaca St. #989, Austin, TX 78701, USA
Purpose: Biometric identity verification (Face Match, liveness detection), device fingerprinting, bot detection, and fraud prevention.
Data processed: Facial images, facial geometry, device identifiers, behavioral signals.
Transfer safeguard: Standard Contractual Clauses (Art. 46(2)(c) GDPR). Verisoul has appointed Prighter Group as EU GDPR representative pursuant to Art. 27 GDPR. Biometric data is deleted within 45 days of a deletion request.
Privacy Policy: https://policies.verisoul.ai/privacy.html

Tremendous, LLC -Payment Processing (PayPal & Rewards)

Address: 1592 Union Street, San Francisco, CA 94123, USA
Purpose: Processing PayPal withdrawals and reward payments on our behalf.
Data processed: PayPal email address, withdrawal amount, transaction identifiers.
Transfer safeguard: Standard Contractual Clauses (Art. 46(2)(c) GDPR). Data Processing Addendum available at tremendous.com/data-processing-addendum.
Privacy Policy: https://www.tremendous.com/privacy/

NOWPayments -Payment Processing (Cryptocurrency)

Operator: NOWPAYMENTS LIMITED, Estonia / International
Purpose: Processing cryptocurrency withdrawal transactions.
Data processed: Cryptocurrency wallet address, withdrawal amount, transaction identifiers. No sensitive personal data beyond what is necessary for the transaction is transmitted.
Privacy Policy: https://nowpayments.io/privacy-policy

Cloudflare, Inc. -Web Infrastructure & CDN

Address: 101 Townsend St, San Francisco, CA 94107, USA
Purpose: Content delivery network (CDN), DDoS protection, DNS management, and web security. All traffic to our website passes through Cloudflare's infrastructure.
Data processed: IP addresses, HTTP request metadata, browser information.
Transfer safeguard: Standard Contractual Clauses (Art. 46(2)(c) GDPR); additionally participates in the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795).
Privacy Policy: https://www.cloudflare.com/privacypolicy/

Hostinger International Ltd. -Web Hosting

Address: 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (European Union)
Purpose: Web server hosting and data storage. All user data stored on Shark Earnings servers is hosted through Hostinger's infrastructure.
Data processed: All personal data stored in our systems (account data, transaction records, server logs).
Transfer safeguard: No third-country transfer -Hostinger International Ltd. is an EU-based entity (Cyprus), fully subject to GDPR.
Privacy Policy: https://www.hostinger.com/privacy-policy

Automated Decision-Making and Profiling

In accordance with Article 22 of the GDPR, we inform you that our platform uses automated processing that may produce decisions with significant effects on you, including account restrictions, earning holds, or account termination. These automated systems are used for the following purposes:

• Fraud Detection: Our systems automatically analyze behavioral patterns, device fingerprints, IP addresses, earning activity, and offer completion rates to detect suspicious or fraudulent behavior. Accounts flagged by these systems may be automatically placed under review, have withdrawals held, or be temporarily restricted.
• Risk Scoring: Each withdrawal request is subject to automated risk assessment based on account history, verification status, transaction patterns, and security flags. High-risk transactions may be automatically held for manual review.
• Account Security: Unusual login patterns, device changes, or IP anomalies may trigger automated security responses including temporary account locks or additional verification requirements.
• Identity Verification via Verisoul: The biometric Face Match process involves automated analysis of facial images to determine whether a real person is present (liveness detection) and to verify identity. A negative result from this automated check will prevent access to withdrawal services.

Human Review: You have the right not to be subject to a decision based solely on automated processing where that decision produces legal or similarly significant effects (Article 22(1) GDPR). In practice, all significant account actions resulting from automated flags -including permanent bans, large withdrawal holds, and account terminations -are subject to human review by our team before being finalized. You may request human review of any automated decision that affects your account by contacting us at privacy@sharkearnings.com. We will respond within 14 days.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

• Account data (email, username): Duration of account + up to 5 years after deletion. Legal basis: Art. 6(1)(c) GDPR - legal obligation; Art. 6(1)(f) GDPR - legitimate interest (fraud prevention).
• Transaction and withdrawal records: 5-8 years (tax and AML legal requirements). Legal basis: Art. 6(1)(c) GDPR - legal obligation.
• KYC identity documents: Deleted immediately after successful verification, unless legally required to retain (up to 7 years). Legal basis: Art. 6(1)(c) GDPR - legal obligation; Art. 6(1)(b) GDPR - contract performance.
• Biometric data (via Verisoul): Deleted by Verisoul within 45 days of deletion request; retained max 3 years from last interaction. Legal basis: Art. 9(2)(a) GDPR - explicit consent.
• Server logs and IP addresses: Up to 90 days. Legal basis: Art. 6(1)(f) GDPR - legitimate interest (security).
• Blacklisted email addresses (deleted accounts): Up to 5 years. Legal basis: Art. 6(1)(f) GDPR - legitimate interest (abuse prevention).

Account Deletion

You may request the deletion of Your Account and associated Personal Data at any time directly through your account profile settings, or by contacting us at privacy@sharkearnings.com. Upon fulfilling your deletion request, most of Your Personal Data will be permanently removed from our systems within 30 days.

However, to prevent abuse of our Service and maintain platform security (based on our legitimate interest under Art. 6(1)(f) GDPR), we may retain the email address associated with a deleted account on a restricted-access blacklist for up to 5 years. This data is used solely to prevent banned users from creating new accounts with the same email address and is not used for any other purpose or shared with third parties.

Certain data may be retained beyond your deletion request where we are required to do so by law (e.g. tax records, AML compliance), as described in the retention list above.

International Data Transfers

Our primary hosting infrastructure is operated by Hostinger International Ltd. (Cyprus, EU), meaning your core account and transaction data remains within the European Economic Area. However, some of our third-party service providers are located outside the EEA, specifically in the United States. Where personal data is transferred to a third country, we ensure adequate safeguards are in place in accordance with Article 46 GDPR:

• Verisoul, Inc. (USA): Standard Contractual Clauses (SCCs) per Commission Implementing Decision (EU) 2021/914. Verisoul has appointed an EU GDPR representative (Prighter Group) pursuant to Article 27 GDPR.
• Tremendous, LLC (USA): Standard Contractual Clauses; Data Processing Addendum in place.
• Cloudflare, Inc. (USA): Standard Contractual Clauses; additionally participates in the EU-U.S. Data Privacy Framework certified under Commission Implementing Decision (EU) 2023/1795.
• NOWPayments (Estonia/International): NOWPayments is operated from Estonia, which is an EU Member State fully subject to GDPR. No third-country transfer occurs. Processing is limited to cryptocurrency wallet addresses and transaction amounts.

You may obtain copies of the applicable Standard Contractual Clauses or further information about transfer safeguards by contacting us at privacy@sharkearnings.com.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency). Legal basis: Article 6(1)(c) GDPR -compliance with a legal obligation.

With Other Users

When you share personal information or otherwise interact in public areas of the Service (such as the public chat), such information may be viewed by all users and may be publicly distributed outside the Service.

Security of Your Personal Data

The security of Your Personal Data is important to Us. We implement commercially reasonable technical and organizational measures to protect your data, including encrypted data transmission (HTTPS/TLS), access controls, and regular security monitoring. However, no method of transmission over the Internet or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

In the event of a personal data breach, we will notify the NAIH (National Authority for Data Protection and Freedom of Information) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay in accordance with Article 34 GDPR.

Your Rights as a Data Subject (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights regarding your personal data under the GDPR. To exercise any of these rights, please contact us at privacy@sharkearnings.com. We will respond to all requests within 30 days (extendable by a further two months for complex requests, with notice).

• Right of Access (Art. 15 GDPR): You may request a copy of the personal data we hold about you, along with information about how we process it.
• Right to Rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete personal data we hold about you.
• Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): You may request deletion of your personal data. We will comply within 30 days, except where we are required to retain data by applicable law (e.g. tax, AML regulations) or where retention is necessary for ongoing fraud investigations or to establish, exercise, or defend legal claims.
• Right to Restriction of Processing (Art. 18 GDPR): You may request that we restrict the processing of your personal data in certain circumstances (e.g. while contesting accuracy or pending a legitimate interest assessment).
• Right to Data Portability (Art. 20 GDPR): You may request your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.
• Right to Object (Art. 21 GDPR): You may object at any time to the processing of your personal data where we rely on legitimate interest (Art. 6(1)(f)) as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or processing is necessary for legal claims. You have an unconditional right to object to processing for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw marketing consent, use your account settings or contact us directly.
• Rights Related to Automated Decision-Making (Art. 22 GDPR): You have the right to request human review of significant automated decisions affecting your account. See the "Automated Decision-Making" section above.

Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR (Article 77 GDPR).

The competent supervisory authority for Hungary is:

• Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
  National Authority for Data Protection and Freedom of Information
  Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
  Phone: +36 (1) 391-1400
  Email: ugyfelszolgalat@naih.hu
  Website: https://www.naih.hu

You may also lodge a complaint with the supervisory authority in your own country of residence if you are located in another EU/EEA Member State.

Children's Privacy

Our Service does not address anyone under the age of 16. We do not knowingly collect personally identifiable information from anyone under the age of 16. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 16 without verification of parental consent, we take steps to remove that information from Our servers.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will notify you by email or via a prominent notice on the Service prior to the change becoming effective.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or need to contact the Data Controller for any reason, please use the following information:

• Data Controller: Stark Krisztián, sole proprietor
• EU VAT Number: HU91383895
• Contact person: Stark Krisztián
• Email: krisztian@sharkearnings.com

We aim to respond to all data protection enquiries within 30 days.