Quick Summary
Mind Flex Games LLC ("FanDrill," "we," "us," or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how we use and share it, and the rights and choices available to you. It applies to all users of our website, mobile applications, and related services (collectively, the "Services").
If you are a resident of California, Virginia, Colorado, Connecticut, Texas, Montana, Oregon, Nevada, or another U.S. state with applicable privacy laws, please see the supplemental disclosures in Section 13 for additional rights specific to your state.
1. Scope and Applicability
This Privacy Policy applies to personal information collected, processed, and maintained by Mind Flex Games LLC (doing business as FanDrill), a Delaware limited liability company with its principal place of business in the United States, in connection with the Services.
This Policy does not apply to information collected by third-party companies or websites linked to or from our Services; information collected by third-party applications or advertisements displayed on our Services that we do not control; or personal information processed solely on behalf of business customers under a separate agreement.
By accessing or using the Services, you acknowledge that you have read this Privacy Policy and that your use of the Services is subject to its terms. If you do not agree with our practices, please discontinue use of the Services.
2. Information We Collect
We collect the following categories of personal information, which may vary based on how you use the Services.
2.1 Information You Provide Directly
- Account Registration Data: full name, username, email, password, date of birth, phone number — used for account creation, authentication, and age verification.
- Identity & Age Verification Data: government-issued ID, Social Security Number (last 4 digits), state of residence — used for legal compliance and verification.
- Financial Information: bank account details, credit/debit card numbers, payment history, withdrawal requests — used to process deposits, withdrawals, and prizes.
- Tax Information: SSN or EIN for prizes above IRS reporting thresholds — used for IRS Form W-2G / 1099 reporting.
- Profile & Preferences: profile photo, display preferences, contest preferences, favorite sports.
- Communications: messages, support tickets, survey responses, feedback.
- Responsible Gaming Info: self-exclusion requests, deposit limits, session limits.
2.2 Information Collected Automatically
When you use our Services, we automatically collect device & technical data (IP address, device type, OS, browser, unique device identifiers), usage data (pages visited, contest entries, session duration), location data (general IP-based and precise geolocation where required), server and error logs, cookie and tracking data, and inferred data such as interests and risk profiles.
2.3 Information from Third Parties
We may receive personal information about you from identity verification providers (e.g., GambleID) for KYC/AML compliance; payment processors and financial institutions; sports data providers; advertising and analytics partners; social media platforms if you connect a social account; state gaming regulators; and other users (e.g., referrals).
3. How We Collect Information
3.1 Cookies and Similar Technologies
We use cookies, web beacons, pixels, SDKs, and similar tracking technologies to collect information about your interactions with our Services. Categories include strictly necessary, functional, performance/analytics, advertising/targeting, and social media cookies. You may manage cookie preferences through our Cookie Preference Center. Disabling certain cookies may impair the functionality of our Services. We honor Global Privacy Control (GPC) signals as opt-outs from targeted advertising where required by applicable law.
3.2 Analytics Services
We use analytics services including Google Analytics, Mixpanel, and AppsFlyer to collect aggregated, pseudonymized data about how users interact with our Services.
4. How We Use Your Information
We use personal information to create and manage your account; process contest entries, deposits, withdrawals, and prize payments; perform age and identity verification (KYC/AML); verify geolocation for state-by-state compliance; provide IRS tax reporting; provide customer support and dispute resolution; detect fraud and enforce anti-cheating; develop and improve our products; deliver marketing and promotional communications (with consent or opt-out); personalize the Services; comply with responsible-gaming obligations; conduct analytics and research; and comply with legal obligations.
We will not use your personal information for purposes materially different from those described in this Policy without providing prior notice and, where required by law, obtaining your consent.
5. How We Share Your Information
5.1 Service Providers
We share personal information with vendors, contractors, and other service providers who process data on our behalf under written data processing agreements, including payment processors (e.g., Nuvei, PaySafe, PayPal/Venmo), identity verification providers (e.g., GambleID), cloud hosting (e.g., AWS, Google Cloud), analytics providers, customer support platforms, email/push services, fraud detection vendors, and tax administration and reporting services.
5.2 State Gaming Regulators and Law Enforcement
We are required by law to share certain personal information with state gaming regulators, the IRS, and other government authorities. We may also disclose information in response to lawful requests, subpoenas, court orders, or to protect the rights, property, or safety of FanDrill, our users, or the public.
5.3 Business Transfers
If FanDrill is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of company assets, your personal information may be transferred as part of that transaction. Any successor entity will be required to honor the terms of this Privacy Policy.
5.4 Advertising Partners and Data Sales
We may share or disclose certain personal information — including cookie identifiers, device identifiers, and inferred interests — with advertising partners for the purpose of serving targeted advertisements. Under some state privacy laws (e.g., the CCPA), this may constitute a "sale" or "sharing" of personal information. California and other eligible state residents have the right to opt out of such sharing via 'Do Not Sell or Share My Personal Information' in the footer, cookie settings, or by contacting privacy@FanDrill.com.
5.5 Aggregated and De-Identified Data
We may share aggregated or de-identified data that cannot reasonably be used to identify you with third parties for research, analytics, product development, or marketing purposes. We commit not to re-identify de-identified data.
6. Online Tracking and Advertising
6.1 Interest-Based Advertising
We participate in interest-based advertising programs and may use information about your use of our Services and other websites to deliver advertisements tailored to your interests.
6.2 Opt-Out Options
- Digital Advertising Alliance (DAA): www.aboutads.info/choices
- Network Advertising Initiative (NAI): www.optout.networkadvertising.org
- Global Privacy Control (GPC) browser signal
- Platform-level ad settings on iOS (App Tracking Transparency) and Android
- Our Cookie Preference Center (in the website footer)
7. Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Account and registration data: duration of account + 7 years post-closure. Financial transaction records: 7 years. Identity verification documents: 5 years from account closure. Contest and gameplay history: 7 years. Marketing preferences: indefinitely (to honor preferences). Support records: 3 years. Server and security logs: 12 months. Cookie data: up to 2 years. Responsible-gaming records: 7 years from self-exclusion end date.
8. Data Security
FanDrill implements a comprehensive information security program designed to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. Our safeguards include:
Technical Safeguards: 256-bit AES encryption for data at rest and TLS 1.2+ for data in transit; MFA required for all account access; PCI DSS compliance for cardholder data; regular penetration testing; WAF and DDoS protection; tokenization of sensitive payment data; end-to-end audit logging and anomaly detection.
Organizational Safeguards: role-based access controls; annual employee privacy and security training; vendor security assessments; incident response plan with defined breach notification procedures.
No method of electronic transmission or storage is 100% secure. In the event of a data breach affecting your personal information, we will notify you as required by applicable state breach notification laws, generally within 30 to 90 days of discovery of the breach.
9. Children's Privacy
Our Services are strictly intended for individuals who are 18 years of age or older (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children under 13, and we do not target our Services to minors. In compliance with COPPA, we do not knowingly collect, use, or disclose personal information from children under 13. If you believe we have collected personal information from a child under 13, please contact us immediately at privacy@FanDrill.com.
10. Third-Party Links and Services
Our Services may contain links to third-party websites, applications, and services. This Privacy Policy does not apply to the practices of third parties that we do not own or control. We encourage you to review the privacy policies of any third-party services you access.
11. Geolocation and Age Verification
11.1 Geolocation Data
Because daily fantasy sports contests are regulated on a state-by-state basis, we are required to verify your location before you can participate in certain contests. We collect IP-based geolocation data to determine your general location, and precise geolocation data (GPS, Wi-Fi triangulation) via your mobile device where you grant permission. Precise geolocation data collected solely for compliance purposes is not used for targeted advertising without your separate consent.
11.2 Age and Identity Verification
We are required to verify the age and identity of all users who deposit funds or win prizes above IRS reporting thresholds. We use date-of-birth verification at account creation, third-party identity verification services ("KYC") requiring government-issued ID, and watchlist screening (OFAC, PEP lists) for AML compliance.
12. Responsible Gaming Data Practices
FanDrill is committed to responsible gaming. We collect and process deposit limits, loss limits, session time limits, self-exclusion requests, behavioral patterns indicative of problem gambling (for proactive outreach), and verification of self-exclusion against state and national exclusion registries. Self-exclusion data is shared with state gaming regulators and the National Council on Problem Gambling's GameTech self-exclusion systems as required by applicable regulations. This data is retained for the periods mandated by applicable state law, typically a minimum of five to seven years following the end of a self-exclusion period.
If you wish to set limits or self-exclude, please visit the Responsible Gaming section of your account settings or contact our Responsible Gaming team at responsibleplay@FanDrill.com.
13. U.S. State-Specific Privacy Rights
13.1 California Residents (CCPA / CPRA)
Over the past 12 months, we have collected the following CCPA categories of personal information: identifiers; personal information under Cal. Civ. Code §1798.80; characteristics of protected classifications (age); commercial information; internet or electronic activity; geolocation; inferences drawn to create a profile; and sensitive personal information (SSN last 4, government ID, financial account data, precise geolocation).
California residents have the following rights, subject to certain exceptions: Right to Know, Right to Access, Right to Deletion, Right to Correction, Right to Opt-Out of Sale/Sharing, Right to Limit Use of Sensitive Personal Information, and Right to Non-Discrimination.
To submit a request, email privacy@FanDrill.com with the subject "CCPA Request". We will respond within 45 days, with an extension of an additional 45 days when reasonably necessary. California Civil Code §1798.83 permits California residents to request a list of third parties to whom we disclosed personal information for direct marketing purposes.
13.2 Virginia, Colorado, Connecticut, Texas, Montana, Oregon, Florida, Indiana, Iowa, and Tennessee Residents
Residents of these states are granted rights under their respective state laws: Right of Access, Right to Correction, Right to Deletion, Right to Data Portability, Right to Opt-Out of targeted advertising / sale / profiling, and Right to Appeal. To exercise these rights, please email privacy@FanDrill.com. We will respond within 45 days of receipt of a verifiable request, with an extension of 45 additional days when reasonably necessary.
Note: Certain rights may be limited. Where data is processed solely for legal compliance, fraud prevention, or contractual performance, we may not be required to honor deletion or opt-out requests in full.
13.3 Nevada Residents
Pursuant to NRS 603A and Nevada SB 220, Nevada residents have the right to opt out of the sale of certain covered personal information to third parties. We do not currently sell covered information as defined under Nevada law. You may submit an opt-out request by contacting privacy@FanDrill.com with the subject "Nevada Opt-Out Request".
14. International Users
Our Services are intended for users located in the United States. If you access our Services from outside the United States, please be aware that your personal information may be transferred to, stored, and processed in the United States. We do not currently offer our Services to residents of the European Economic Area, the United Kingdom, or other jurisdictions where additional international data transfer mechanisms would be required.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy with a new "Last Revised" date, provide a prominent notice on our homepage or within the Services, and send an email notification to registered users where feasible.
16. Contact Us
Privacy & Data Protection Officer Mind Flex Games LLC 1901 Main St, 18th Floor #2039, Columbia, SC 29201, United States Email: privacy@fandrill.com
Responsible Gaming Hotline responsibleplay@FanDrill.com 1-800-522-4700 (National Problem Gambling Helpline)
© 2026 Mind Flex Games LLC All rights reserved.