Privacy Policy
Version 2.0 · Effective: August 17, 2026 · Supersedes July 1, 2026 version
WinStash is a closed-loop gift card system operated by WinStash, LLC ("we," "us," or "our"). This Privacy Policy describes what personal information we collect, how we use it, and who we share it with. It applies to the WinStash registered gift card and to winstash.app. The WinStash non-reloadable gift card is issued without registration. If a non-reloadable cardholder chooses optional text message receipts, the only personal information collected is the mobile phone number the cardholder provides, which is used solely to deliver those messages and related card notices and is not linked to any name or identity.
Information We Collect
We collect the following personal information when you register for a WinStash registered gift card at a participating location:
| Data Category | What We Collect | Why We Need It |
|---|---|---|
| Identity | Full name, date of birth, address | Age verification (18+), account identification, and regulatory compliance, including unclaimed-property reporting |
| Identity verification | Last four digits and state of issuance of the ID number (full ID number and ID image are not retained) | Your government-issued photo ID is examined at registration to verify identity and age. We record that verification occurred. |
| Contact | Mobile phone number | Transaction receipts, verification codes, and account alerts |
| Transaction | Card loads, purchases, balances, timestamps, and location | Account management, receipts, and regulatory reporting |
| Device | IP address and device type when you use winstash.app | Security and fraud prevention |
| Non-reloadable text receipts | Mobile phone number provided at opt-in, stored with the card number only | Used only to send transaction receipts and card notices. Not linked to any name or identity. Deleted when receipts are canceled or the card is reprovisioned. |
How We Use Your Information
Transactional communications. We send SMS messages to your mobile phone number for load confirmations, balance alerts, PIN verification codes, dormancy notices, and other account-related notifications. These messages are triggered by your account activity or by legal compliance requirements.
Account management. We use your identity and contact information to create and maintain your account, process loads and purchases, and provide customer support.
Regulatory compliance. We use your information to comply with Georgia COAM regulations, federal law applicable to prepaid products, the Georgia Gift Card Integrity Act, and Georgia unclaimed property laws, and to screen against lists maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control and other government agencies.
Security and fraud prevention. We use device information and transaction patterns to detect and prevent unauthorized access, duplicate registrations, and fraudulent activity.
Marketing & Promotional Messages
We do not use your contact information for marketing or promotional messages, and we do not sell, rent, share, or transfer your personal information or SMS opt-in data to any third party for marketing or promotional purposes. If we introduce optional promotional messages in the future, we will do so only with your separate, express written consent, requested independently of card registration, and consent will not be a condition of receiving or using a WinStash card.
Information Sharing
Locations. The location where you registered and use your card has access to your name and mobile phone number as needed to issue cards, process loads and purchases, and provide in-person support. Locations are contractually required to keep this information confidential, to use it only for WinStash card operations, and not to use it for their own marketing or share it with anyone else. Locations do not have access to your date of birth, address, or ID verification details.
Service providers. We use third-party service providers to operate WinStash, including cloud hosting, SMS delivery, and payment processing. These providers access your data only to perform services on our behalf and are bound by contractual confidentiality and data protection obligations.
Aggregated information. We may share aggregated or de-identified information that cannot reasonably identify you with business partners for analytics purposes.
Legal requirements. We may disclose your information when required by law, regulation, or legal process, including unclaimed property reporting to the Georgia Department of Revenue and disclosures required by the Georgia Lottery Corporation or other government agencies.
Business transfers. In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction, subject to this Policy.
SMS Communications
When you register for a WinStash registered gift card and provide your mobile phone number, you consent to receive transactional SMS messages at that number. Message and data rates may apply. Reply STOP to opt out at any time; reply HELP for help.
Message types include load confirmations, purchase receipts, verification codes, account and security alerts, dormancy notices, and other legally required notices. Message frequency varies with your card activity. Opting out may limit our ability to deliver transaction confirmations and legally required notices. Supported carriers are not liable for delayed or undelivered messages. We do not sell, share, or transfer your phone number or SMS opt-in data to any third party for marketing purposes. Non-reloadable cardholders who opt in to text receipts receive transaction receipts and card notices on the same terms and may reply STOP at any time to cancel.
Data Retention
We retain your personal information for as long as your WinStash account is active and for a minimum of seven years after your last transaction, consistent with Georgia unclaimed property law and our records retention obligations. Transaction and payment records may be retained longer as required for regulatory compliance, tax reporting, or legal obligations.
Data Security
We implement technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Personal information is encrypted in transit and at rest, PIN data is never stored in plain text, and access to registration records is restricted to authorized personnel on a need-to-know basis and is logged. However, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
Your Rights
You may request access to the personal information we hold about you, request correction of inaccurate information, or ask questions about this Privacy Policy by contacting us at the address below. Certain information may be retained as required by law even after an account closure request.
Children's Privacy
WinStash is not available to individuals under the age of 18. We do not knowingly collect personal information from children. Age is verified during registration by examining a valid government-issued ID.
Changes to This Policy
We may update this Privacy Policy from time to time. The effective date at the top of this page indicates when the policy was last revised. Continued use of your WinStash card after changes are posted constitutes acceptance of the revised policy.