Privacy Policy

1. Who is responsible for your data

Sharklio is operated by Shark Earnings LLP, whose details are at the bottom of this page. For the processing described in this policy, Shark Earnings LLP is the data controller. Privacy enquiries go to [email protected].

When our offerwall runs inside a publisher's website or app, the publisher is a separate controller for its own user accounts, rewards, and payouts. Section 5 explains how responsibilities are divided in that situation. Where a publisher instructs us to process data only on its behalf under a data processing agreement, we act as its processor for that processing.

2. Whose data this policy covers

• Advertisers and publishers: the people who register and manage business accounts, apply as publishers, or contact us on behalf of a business.
• End users: people who open a Sharklio offerwall inside a publisher property and view or complete offers. End users do not have a Sharklio account; they are identified to us only through the publisher.
• Visitors: people who browse sharklio.com without an account.

3. What data we collect

Advertisers and publishers. Username, email address, a one-way hash of your password, the verification status of your email address, and, if you sign in with Google or Discord, the account identifier, email address, and display name we receive from that provider (we never receive your Google or Discord password). If you turn on login verification by email, we keep a list of your trusted devices with the browser and system name and the IP address each was added from. We also keep campaign settings, balance top-ups and invoices, settlement and payout details needed to pay publishers, support correspondence, and sign-in records such as time and IP address. Card and crypto payments are processed by payment providers; we do not store full card numbers.

End users. The pseudonymous user identifier the publisher assigns to you, the publisher and property you came from, your IP address and the approximate location derived from it, device, browser, and language characteristics, a device identifier used for fraud prevention, the offers you view, start, and complete, the proof you submit for an offer, such as answers or screenshots, completion and reversal status with timestamps, and the click identifiers exchanged with offer partners. We ask publishers not to send us names, email addresses, or other direct identifiers, and the offerwall does not ask you for them.

Visitors. IP address, browser and device information, the pages you request, your cookie choice, and the result of security checks that protect our forms.

Data from third parties. Confirmations, rejections, and reversals from advertisers and offer partners, risk signals from anti-fraud and security providers, and payment status from payment providers.

4. Why we use it, and on what legal basis

Where we rely on legitimate interests, we have weighed them against your rights and freedoms. You can object to that processing as described in section 12.

5. End users on publisher properties

The publisher operates the website or app in which you use the offerwall. It is responsible for your account with it, for the rewards it offers you, for paying them, and for its own privacy notice, including telling you that the offerwall is provided by Sharklio and obtaining any consent your jurisdiction requires before your data reaches us.

Sharklio decides independently how offer activity is recorded, attributed, and checked for fraud, so we are a controller for that processing. We send the publisher the completion and reversal events linked to the identifier it gave us, so that it can credit you. Advertisers see the completions of their own campaigns in their dashboard, with the details they need to approve or reject them, such as the proof you submitted, your country and device type, and when the offer was completed. Only include in a proof what the offer asks for. Advertisers do not receive your name or contact details from us. Offer partners receive only what they need to confirm a result, such as click identifiers, country, device type, and completion status.

Because we only know you through the publisher's identifier, please include the name of the publisher and, if you can, your user identifier there when you contact us about your data. Requests about your reward balance or payouts belong with the publisher.

6. Fraud prevention and automated decisions

Advertisers pay only for genuine results, so we run automated checks on device, network, location, and behaviour signals to detect automation, emulators, duplicate completions, disguised locations, and falsified answers. These checks can lead to an offer not being shown, a completion being rejected, or a device being blocked from offers.

Decisions with a significant effect on a business account, such as closing it or withholding a publisher settlement, are reviewed by a person before they become final. Any end user or account holder may ask for human review, express their point of view, and contest a decision by writing to [email protected].

7. Cookies and similar technologies

When you first visit sharklio.com we ask for your cookie choice, and we store it in your browser's local storage so we do not ask again. You can change it at any time with the Cookie settings link at the bottom of every page.

• Strictly necessary: a session cookie that keeps forms and sign-in secure, a sign-in cookie that keeps account holders logged in for up to 12 months until they log out, a random device identifier kept for up to 2 years that we use to detect fraud and enforce bans, the storage entry that remembers your cookie choice, and cookies set by our security and delivery provider to protect the site and to run security checks on forms. These are required for the site to work and are used without consent.
• Offerwall operation: inside a publisher property, the offerwall may use browser storage that is strictly necessary to attribute completions and prevent duplicate or fraudulent activity.
• Analytics: only if you choose "Accept all", we load Google Tag Manager and Google Analytics. They set cookies, such as _ga, to measure how visitors use sharklio.com, for example which pages are visited and how people arrive. Nothing is loaded if you choose "Necessary only", and you can withdraw your consent at any time with the Cookie settings link. Advertising and remarketing cookies are not used.

Advertiser and offer partner websites you open from the offerwall set their own cookies under their own policies. You can also block or delete cookies in your browser, although blocking the strictly necessary ones may stop parts of the site from working.

8. Who we share data with

We do not sell personal data. We share it only as follows:

• Publishers, limited to the offer activity and completion events linked to the identifiers they assigned to their own end users.
• Advertisers, limited to campaign statistics and the completion details they need to review their own campaigns, as described in section 5. They do not receive end users' names or contact details from us and are prohibited from trying to identify them.
• Offer partners, limited to what is needed to attribute and confirm results.
• Payment providers, to process balance top-ups and publisher settlements.
• Google, if you choose to sign in with Google, which handles that sign-in under its own privacy policy, and, only if you accept analytics cookies, as the provider of Google Analytics and Google Tag Manager, which receive your IP address, browser and device details, and the pages you visit on our behalf.
• Discord, only if you choose to sign in with Discord, which handles that sign-in under its own privacy policy. We only request your Discord username and email address, and we do not keep an access token.
• Anti-fraud and security providers, to perform the checks described in section 6 and to protect our forms.
• Infrastructure providers, including hosting, content delivery, and email, acting on our instructions.
• Professional advisers, authorities, and courts, where the law requires it or where it is necessary to establish, exercise, or defend legal claims.
• A successor, if the business is reorganised, merged, or sold. You will be told before your data becomes subject to a different privacy policy.

9. International transfers

We are established in Canada, and some of our providers and partners are located in the United States and other countries. When personal data is transferred out of the EEA or the UK, we rely on an adequacy decision where one covers the destination, including the European Commission's decision for Canadian commercial organisations, or otherwise on Standard Contractual Clauses together with an assessment of the transfer. You can ask for a copy of the safeguards at [email protected].

10. How long we keep data

• Business account data: for as long as the account exists. When you delete your account in your account settings, it is removed immediately, together with its campaigns, notifications, sessions, and trusted devices.
• Trusted devices and saved logins: up to 12 months, or until you revoke them or log out.
• End user offer activity and attribution records: up to 24 months after the last activity, so that late reversals and disputes can be settled.
• Records linked to confirmed fraud, including device identifiers: up to 5 years, so that the same actor cannot simply return.
• Top-ups, invoices, and settlements: up to 7 years, to meet accounting and tax obligations.
• Support correspondence: up to 3 years after the last message.
• Server and security logs: normally up to 12 months.

When data is no longer needed, we delete or anonymise it. Where a legal obligation or an active dispute requires a longer period, we keep the relevant records until it ends.

11. How we protect data

All traffic is encrypted in transit. Passwords are stored only as one-way hashes. Secrets and credentials are kept outside the public web root, access to production systems is limited to the people who need it and is logged, and we apply a restrictive content security policy. Our providers are bound to keep the data they handle secure and confidential. No system is perfectly secure; if a breach is likely to put your rights at risk, we will notify the competent supervisory authority and, where the risk is high, the people affected. Account holders help by using a unique, strong password.

12. Your rights in the EU, EEA, and UK

If the GDPR or UK GDPR applies to you, you have the right to access your data, to have it corrected, to have it erased, to restrict processing, to data portability, to object to processing based on legitimate interests or to direct marketing, to withdraw consent at any time without affecting earlier processing, and not to be subject to a decision based solely on automated processing that has legal or similarly significant effects.

Write to [email protected] to exercise these rights. We answer within one month and may ask you to verify your identity or, for end users, to confirm the publisher and identifier concerned. You may also complain to the supervisory authority where you live or work, although we would welcome the chance to address your concern first.

13. Your rights in US states

If you live in California or another US state with comparable privacy legislation, you may request to know the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of third parties we share it with, and you may request a copy, correction, or deletion. We do not sell personal information and do not share it for cross-context behavioural advertising as those terms are defined in that legislation. You may use an authorised agent, and we will not discriminate against you for exercising your rights. Requests go to [email protected].

14. Your rights in Canada

Under PIPEDA and, where applicable, British Columbia's Personal Information Protection Act, you may access the personal information we hold about you, ask for corrections, and withdraw consent subject to legal and contractual limits. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

15. Do Not Track signals

There is no common industry standard for responding to Do Not Track browser signals, so we do not change our processing when we receive one. We do not track visitors across unrelated websites. Advertiser and offer partner sites you open from the offerwall may behave differently under their own policies.

16. Content screening

Where you submit content such as campaign material, proofs of completion, or messages, we may review it with automated tools and trusted providers to detect and prevent illegal or abusive content, including child sexual abuse material, and we may report it to the competent authorities where the law requires.

17. Marketing messages

We send marketing email to business contacts only where the law allows, and every such message contains a working unsubscribe link. Service messages, such as verification codes, security alerts, invoices, settlement notices, and notices about changes to our terms, are not marketing and are sent regardless. Our practice is designed to comply with Canada's Anti-Spam Legislation.

18. Children's privacy

The offerwall is not intended for anyone under 16, and publishers must not show it to them. Advertiser and publisher accounts require an age of at least 18. We do not knowingly collect data about anyone below these minimum ages. If we learn that we have, we delete it, except for any record we must keep by law. If you believe a child's data has reached us, contact [email protected].

19. Links to other sites

Offers and partner pages take you to websites and apps we do not operate, and this policy does not cover them. Read their privacy notices before you share personal data with them.

20. Changes to this policy

We update this policy when our practices or the law change. The "last updated" date at the top always shows the current version. For material changes we notify account holders by email or in the dashboard before the change takes effect.

21. How to contact us

For anything in this policy, including requests to exercise your rights, write to [email protected]. For everything else, write to [email protected].