Privacy Policy

Table of Contents

Last Updated 16 June 2026

1. Introduction

Vuly Play is committed to providing you with superior customer service, including the highest standards of privacy protection.

We comply with applicable data protection and privacy laws in the regions where we operate, including:

- applicable United States federal and state privacy laws, including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA); and

- applicable US state biometric privacy laws, including the Illinois Biometric Information Privacy Act (740 ILCS 14/) ("BIPA") and the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001) ("CUBI").

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information collected through our website. It applies US law and is intended to govern the use of vulyplay.com by our users in the US unless otherwise agreed through contract. This Privacy Policy is incorporated into, and is subject to, our Terms and Conditions.

By accessing or using this website you confirm that you have read and understand the entirety of this Privacy Policy and you consent to adhere to its terms. If you do not agree to this Privacy Policy in its entirety you must refrain from using this website. If you are a resident of California you may have additional rights under the CCPA/CPRA, as described in Section 8 below.

This Privacy Policy does not apply to information submitted or collected through websites maintained by other companies or organisations to which we may link or who may link to us. We are not responsible for the actions and privacy policies of third-party websites.

2. Personal Information We Collect

2.1 Categories of Personal Information

In the preceding 12 months, we have collected the following categories of personal information:

Identifiers

Examples: Name, email address, phone number, IP address, account username

Collected: Yes

Customer records

Examples: Billing address, shipping address, payment information

Collected: Yes

Commercial information

Examples: Purchase history, products considered, abandoned cart data

Collected: Yes

Internet or network activity

Examples: Browsing history on our site, search queries, interactions with our chatbot, cookie data

Collected: Yes

Geolocation data

Examples: General location inferred from IP address

Collected: Yes

Audio and sensory data

Examples: Call recordings, voiceprints and AI voice models (campaign participants only)

Collected: Yes

Inferences

Examples: Preferences and characteristics drawn from the above to create a customer profile

Collected: Yes

Sensitive personal information

Examples: Biometric data (voiceprints, AI voice models) — campaign participants only

Collected: Yes

We do not knowingly collect personal information from consumers under 16 years of age.

2.2 Sources of Personal Information

We collect personal information from the following categories of sources:

Directly from you: when you place an order, create an account, contact us, use our chatbot, participate in a campaign, or interact with our website;

Automatically from your device: through cookies, web beacons, and similar tracking technologies when you browse our website;

From third-party partners: including advertising networks (Meta, Google), payment processors (PayPal, AfterPay, ZipMoney), and logistics partners; and

From campaign participants: audio recordings submitted in connection with a promotional campaign or social media agreement.

2.3 Business Purposes for Collection

We collect personal information for the following business or commercial purposes:

3. Your Information — General Use

We collect personal information primarily to supply you with the products and services you order from us.

If you provide your contact details by phone or via our website checkout, a sales representative may contact you to assist with or follow up on your order. We may also contact you about goods and services that may be of interest to you, where permitted by law.

4. Abandoned Cart Follow-Up

When you begin the checkout process and provide contact details but do not complete your purchase, we may use this information to remind you about your basket.

If you have not opted in to marketing communications, we may send one or two follow-up emails relating only to the items left in your basket. These emails will include a clear unsubscribe option.

We will only contact you by telephone for abandoned cart purposes where you have expressly consented to receive marketing calls. Without such consent, your phone number will not be used.

Information collected during checkout that is not associated with a completed order is retained for no longer than 30 days, after which it is securely deleted or anonymised.

Where processing is based on legitimate interests, we balance those interests against your rights. Where consent is required under local law, we rely on consent.

5. Secure Information

We use up-to-date security measures to protect personal information from misuse, loss, unauthorised access, modification, or disclosure.

Our website uses Secure Sockets Layer (SSL) technology to encrypt data transmitted between you and Vuly Play.

6. AI-Powered Services and Chatbot Use

6.1 Overview

Vuly Play uses AI-powered technology to assist with customer support and website navigation through our chatbot. The chatbot does not make automated decisions that produce legal or similarly significant effects.

6.2 What Data We Collect

You are not required to provide personal information to use the chatbot.

6.3 How We Use This Data

Chatbot data is used to:

6.4 Third-Party AI Providers

Chatbot interactions are processed using a third-party AI service provider (currently OpenAI, Inc.):

data is processed in real time to generate responses;

limited retention may occur for safety and abuse monitoring; and

customer data is not used to train general AI models under current contractual terms.

Data may be processed on servers outside your country of residence, including the United States, subject to appropriate safeguards.

6.5 Data Retention

Chatbot data is retained only for as long as necessary to fulfil the purposes described above and is periodically reviewed. Where data is used for service improvement, it is anonymised or pseudonymised.

6.6 Your Rights and Choices

You may request access to, correction of, or deletion of chatbot data, object to processing, withdraw consent, or request human assistance at any time.

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:

Data Category Retention Period

Where a legal obligation requires longer retention, we retain data for the minimum period required by that obligation.

8. Your Privacy Rights — US Residents

8.1 State Privacy Law Rights

Depending on your state of residence (including California, Virginia, Colorado, Connecticut, Texas, and Utah), you may have the right to:

Know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the categories of third parties with whom we share it;

Access: obtain a copy of the personal information we hold about you;

Correct: request correction of inaccurate personal information;

Delete: request deletion of personal information we have collected, subject to certain exceptions;

Opt out of sale or sharing: direct us not to sell or share your personal information for cross-context behavioural advertising;

Limit use of sensitive personal information: direct us to limit the use and disclosure of sensitive personal information (including biometric data) to permitted purposes only; and

Non-discrimination: we will not discriminate against you for exercising any of these rights.

8.2 Do Not Sell or Share My Personal Information

We may share personal information with advertising partners (including Meta and Google) in ways that may constitute "sharing" for cross-context behavioural advertising under the CCPA/CPRA. You have the right to opt out of this sharing at any time.

You may opt out by contacting us at sales@vulyplay.com or (866) 866-8858.

8.3 Limit the Use of My Sensitive Personal Information

You have the right to direct us to limit the use of your sensitive personal information (including biometric data) to purposes necessary to perform the services you requested, or as otherwise permitted by the CPRA.

You may submit a request by contacting us at sales@vulyplay.com or (866) 866-8858.

8.4 How to Submit a Rights Request

To exercise any of the rights above:

Email: sales@vulyplay.com

Telephone: (866) 866-8858

We will acknowledge your request within 10 business days and respond within 45 days. If we require additional time (up to a further 45 days), we will notify you of the extension and the reason.

We may need to verify your identity before processing your request. We will not require you to create an account solely to submit a request.

Authorised agents may submit requests on your behalf with written authorisation or a valid power of attorney.

8.5 Shine the Light (California Civil Code § 1798.83)

California residents may request information about personal information disclosed to third parties for their direct marketing purposes in the preceding calendar year. To make such a request, contact us at sales@vulyplay.com.

8.6 Financial Incentives

We do not currently offer financial incentives, loyalty programmes, or price differences in exchange for the collection, retention, or sale of personal information. If this changes, we will update this section and provide the disclosures required under the CCPA/CPRA before any such programme is offered.

9. Disclosure of Personal Information

We may disclose personal information to the following categories of third parties:

Service providers and contractors: who process data on our behalf to deliver our products and services;

Advertising networks: including Meta and Google, for targeted advertising and analytics;

Payment processors: including PayPal, AfterPay, and ZipMoney;

Logistics and fulfilment partners: including AIT WorldWide, Spreetail, Handy Buddy, and Family Leisure;

Professional advisers: including accountants, auditors, and lawyers; and

Government and regulatory authorities: as required or authorised by law.

Our current third-party Contacts include, but are not limited to:

ZipMoney: privacy policy

Google: privacy policy

AfterPay: privacy policy

Meta:  privacy policy

PayPal:  privacy policy

Spreetail: privacy policy

Handy Buddy: privacy policy

Family Leisure: privacy policy

AIT WorldWide:  privacy policy

We do not sell personal information in the traditional sense. Certain disclosures to advertising partners may constitute "sharing" under the CCPA/CPRA. See Section 8.2 for opt-out options.

10. Call Recording

We may record telephone conversations between you and our representatives ("Recorded Calls") for legitimate business purposes including:

Recorded Calls are stored securely, accessible only to authorised personnel, retained for the period set out in Section 7, and protected by appropriate technical and organisational security measures.

Recorded Calls will not be disclosed to third parties unless required by law, necessary for legal proceedings, you have provided consent, or necessary to protect our rights or the rights of others.

You will be notified at the beginning of each call if recording is taking place. If you do not wish your call to be recorded, you may request alternative contact methods where available.

11. Biometric Data

11.1 What We Collect

In connection with certain campaigns and promotional activities, we may collect or generate the following types of biometric data from participants:

These are referred to in this section as "Biometric Data".

11.2 Why We Collect It

We collect Biometric Data solely for the campaign purpose described in the relevant campaign brief or social media agreement. We do not use Biometric Data for identity verification, marketing profiling, or any purpose beyond the stated campaign scope without your separate, express written consent.

11.3 Legal Basis for Collection

Where applicable US state biometric privacy law applies — including BIPA, CUBI, and equivalent state laws — we collect Biometric Data only after obtaining your prior written consent and providing you with this notice. This written policy is made publicly available in satisfaction of BIPA's requirement for a publicly available retention schedule.

11.4 Retention Schedule

We retain Biometric Data for the duration of the relevant campaign agreement plus six (6) months from the date of expiry or termination of that agreement ("Retention Period").

Where BIPA applies, we will destroy Biometric Data no later than three (3) years after the date of collection, or when the purpose for which it was collected has been fulfilled, whichever occurs first — regardless of the Retention Period above.

We will not retain Biometric Data beyond these periods unless required to do so by applicable law, court order, or regulatory obligation.

11.5 Storage and Security

During the Retention Period, we:

(a) store Biometric Data using AES-256 encryption at rest and in transit;

(b) restrict access to authorised personnel only;

(c) maintain Biometric Data on servers located within the United States, unless you have been notified of and consented to cross-border transfer; and

(d) do not sell, lease, trade, or otherwise profit from Biometric Data.

11.6 Third-Party Disclosure

We do not disclose Biometric Data to third parties except:

(a) with your prior written consent;

(b) to subprocessors engaged to perform services in connection with the relevant campaign, who are bound by obligations no less protective than those in this section; or

(c) as required by applicable law, court order, or regulatory authority.

11.7 Destruction

Upon expiry of the Retention Period, or earlier upon your written request, we will permanently and irreversibly destroy all Biometric Data in our possession or control, and direct any subprocessors to do the same within thirty (30) days. Written confirmation of destruction is available upon request.

11.8 Your Biometric Data Rights

Subject to applicable law, you may at any time:

(a) request confirmation of whether we hold your Biometric Data;

(b) request early destruction of your Biometric Data prior to expiry of the Retention Period; and

(c) withdraw consent to the collection or use of your Biometric Data, noting that withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise these rights, contact us at: sales@vulyplay.com or (866) 866-8858.

11.9 Conflict with Applicable Law

To the extent any provision of this section conflicts with applicable US federal or state biometric privacy law, the requirements of that law will prevail to the extent of the inconsistency.

12. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies on our website. These may collect internet or network activity information including browsing behaviour, pages visited, and interactions with our content.

You may manage your cookie preferences through our cookie preference centre [insert link]. Certain cookies are necessary for the website to function and cannot be disabled.

For full details of the cookies we use and how to manage them, please refer to our Cookie Policy [insert link].

13. Contact Us

For questions, to exercise your rights, or to submit a privacy complaint:

Email: sales@vulyplay.com

Telephone: (866) 866-8858

If you are a California resident and are not satisfied with our response, you may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov.

14. Updates

This Privacy Policy is reviewed annually and updated when regulatory requirements or our practices change.