Privacy Policy

Responsible organization and scope

Social Atlas is an internal social media operations service available at https://socialatlas.luckfun.vip. It is operated by Prudent Owl Limited, whose registered address, as disclosed in the Lavish Luck Privacy Policy, is RM22 2/F, FU TAO BUILDING, NO.98 ARGYLE STREET, KOWLOON, Hong Kong. In this policy, “we” refers to that organization.

This policy explains how Social Atlas handles information about staff using the service, people whose public social media content appears in the service, and people involved in supported customer service or campaign workflows. The monitored brands are Gleaming Slots, Jackpot Go, Cider Casino, Lavish Luck and Tangluck. Each brand’s consumer website has its own privacy policy. The brand companies authorize Prudent Owl Limited to operate Social Atlas and provide internal social media management and brand monitoring services on their behalf. Jackpot Go is operated by Hiwingo Limited and developed by Wish Wishes Studio Limited.

Privacy questions and data requests may be sent to brand-monitoring@luckywarriors.com.

Information processed by Social Atlas

Staff access. Company Lark authentication supplies a user identifier, organization identifier and name, and may supply an email address, avatar or additional identity identifier. Social Atlas uses these details to establish an authenticated session and verify access. The current session lasts up to 12 hours. Short authorization state cookies expire after 10 minutes. When staff accept the policy, the service records the staff user identifier, organization identifier, policy version and acceptance time. A signed receipt is bound to the current login session; a new login session requires renewed acknowledgement. Acceptance records support access administration and evidence of the applicable policy. They are retained while needed for these purposes, including applicable legal obligations or disputes, and can be included in a data request.

YouTube content. Social Atlas uses YouTube API Services to retrieve public video identifiers, titles, descriptions, channel identifiers and names, publication dates and available engagement counts. It also retrieves public comment and reply identifiers, text, author display names, publication and update dates, and likes. Source links and refresh times accompany the records. Public comment text may contain personal information that its author included.

Trustpilot reviews. Social Atlas receives public reviews for the five monitored brands through a company-managed collection task on the application server. Stored fields include review identifiers, star ratings, titles and text, author display names, available country labels, publication dates, source verification labels, business replies, source links and collection times. Collection status and delivery receipts are stored to detect failures and duplicate deliveries. A country label does not establish a reviewer’s residence. Collection depends on source accessibility and available pages.

Google Alerts and Gmail. An authorized administrator connects the dedicated company monitoring mailbox through Google OAuth. The Gmail permission allows reading the connected mailbox’s messages. The scheduled synchronization selects Google Alerts messages from the preceding 90 days. This search window describes retrieval, not the retention period of stored records. The service reads matching message content to extract brand mentions and stores message identifiers, subjects, receipt dates, processing status, article titles, links and snippets. A refresh token is encrypted for continuing synchronization.

Facebook and Instagram operations. Connected business assets supply account and post information, engagement metrics, and comments including the available author identifiers and names. Campaign workflows may process participant identifiers, eligibility results, reward records and delivery status. Configured SaleSmartly integrations provide customer identity mappings and relevant message references used by those workflows. Staff are responsible for using campaign imports within the company’s authorized purpose.

Service operation. The hosting infrastructure may process IP addresses, requested pages, timestamps and error information to operate and protect the service. Necessary cookies support login and authorization. Current application code uses these session and authorization cookies; third-party services apply their own policies when a user follows an external link or signs in through them.

How information is used

We use information to authenticate staff, synchronize and display source content, organize brand feedback, support customer service and campaign operations, maintain records of relevant actions, and investigate service failures or misuse. Staff access is governed by company authentication; designated administrator controls apply to mailbox connection and certain operational actions.

YouTube results retain their source identity. External search matches are presented as candidates requiring brand verification. Search region and language preferences do not establish a commenter’s residence, nationality or language. The collection available in Social Atlas depends on API results, visibility, pagination and refresh schedules.

Use and transfer of Google API data follow the Google API Services User Data Policy and its applicable Limited Use requirements. Google data is used for the disclosed service functions. A new purpose or recipient requires the applicable disclosure, authorization and platform permission before processing begins.

AI processing

The current Facebook, Instagram, Trustpilot review and Google Alerts excerpt workflows send brand context, platform name and filtered comment text or extracted webpage titles and snippets through a company-built, company-managed AI gateway to OpenAI's official API for text analysis. OpenAI performs model inference. The preprocessing replaces detected email addresses, long number sequences and links, and omits separate author and post identifier fields from the model request. Free text can still contain identifying details. Model labels and reasons support staff review and may contain errors.

YouTube sentiment and topic analysis is a planned feature awaiting the applicable YouTube analysis approval. Production YouTube data is not sent to the classification gateway. The proposed YouTube analysis would use the same company-managed gateway and OpenAI API after the applicable approval. Trustpilot review titles and text are analyzed for brand relevance, sentiment, unresolved issues and P0/P1/P2 risk categories using the same company-managed gateway and OpenAI API. Source star ratings are context, not a standalone AI verdict. Author fields and business replies are omitted from model requests. Low-confidence results remain for staff review. Eligible new risks are sent promptly to a separately configured internal Lark group; historical reviews remain available in the dashboard. Notification cards include filtered excerpts, reasons, source links and risk labels. A delivery record limits repeated broadcasts. Messages already delivered to Lark require separate handling when a deletion request applies.

Google Alerts webpage titles and snippets are analyzed through the company-managed gateway and OpenAI API for brand relevance, sentiment and risk categories. Full mailbox content, email headers, message identifiers and source URLs are omitted from these model requests. A search match does not establish brand relevance, and an excerpt does not establish what the complete source says or when it was published. Low-confidence results are held for staff review. Eligible new risk leads are sent to the separately configured internal Lark group with filtered excerpts, reasons and source links. YouTube and Reddit source matches remain excluded from this analysis pending the relevant permissions; Trustpilot matches are handled by the dedicated Trustpilot workflow to avoid duplicate alerts. Repeated emails and updated excerpts for the same brand and URL do not repeat a successful broadcast.

This service uses OpenAI's published API defaults: customer content is excluded from model training unless sharing is enabled; abuse-monitoring logs may be retained for up to 30 days, with legal and safety exceptions. The application sends store=false. This does not establish Zero Data Retention, which requires approval and is subject to feature limitations. We do not claim a specially approved retention or data-residency arrangement. Official details: https://developers.openai.com/api/docs/guides/your-data

Services and recipients

Authorized operations, support and technical personnel use information for the functions described above. The following services participate in the relevant processing paths.

Data recipients and access locations outside this list must be reviewed and reflected in the policy before use. Disclosures required by law or necessary to address a security incident are assessed by the responsible organization and limited to the information needed for the request.

Retention and security

YouTube text, metadata and associated cached records are refreshed or removed through a 29-day expiry process. Refreshing a record renews its freshness date. A complete comment rescan removes records no longer returned in that scope; source visibility and API failures can affect the timing of confirmation. Exported copies need the same refresh and deletion management as the underlying data.

Trustpilot reviews and task records are retained for the internal monitoring purposes described above and reviewed in response to correction or deletion requests. The current module has no automatic expiry period. Updates replace the current stored review. An unavailable page is not treated as confirmation of deletion. Confirmed deletion work includes review text, derived AI analysis and evidence, pending notification items, relevant collection delivery batches, exports and controlled recovery copies; minimal identifiers and delivery records may be retained to manage the request and prevent older batches from restoring deleted content.

Google Alerts extracts, Meta content, campaign records, AI classification results and operational logs are retained for the operational purposes described in this policy, subject to applicable platform requirements, data requests and legal obligations. The current service does not apply a single automatic expiry period to all these categories. Recovery and maintenance copies require separate review and cleanup when the underlying data is deleted or no longer needed. OpenAI retention is described in the AI processing section; relevant company gateway copies are handled separately.

The service uses HTTPS, company authentication and restricted server access. Gmail refresh tokens are encrypted, and server-side credential files have restricted file permissions. Confirmed YouTube deletion requests are recorded in a separate suppression ledger so the matching records are not re-imported. Before restoring a content database, the latest suppression ledger must be applied and verified. Relevant backups, exports and other controlled copies are included in the deletion workflow.

Access correction deletion and revocation

Contact brand-monitoring@luckywarriors.com to ask about information held in Social Atlas or to request access, correction or deletion. Include the relevant source URL, comment or record identifier, and a way to contact you. We may request proportionate verification to locate the record and confirm your authority. Please keep passwords, API credentials and full identity documents out of an initial request.

After proportionate verification, the responsible team handles applicable requests and coordinates relevant service providers and stored copies. We delete YouTube API data covered by a valid user request as soon as possible and within 7 calendar days of the request, including applicable controlled copies, in accordance with YouTube requirements. Other requests are handled under applicable platform deadlines and legal requirements. Any legally required retention is assessed and explained to the requester. Deletion from Social Atlas concerns its stored copies; changing original platform content requires the relevant platform process. Suppression records are used to prevent re-import of YouTube items removed through this request process.

The connected Google account can revoke application access through https://security.google.com/settings/security/permissions. Revocation stops further authorized access when credentials cease to work. Existing stored extracts require a deletion request and the associated cleanup process. Staff may sign out to end their browser session and contact the administrator about removing company access.

Depending on the laws that apply, you may have additional rights concerning your information or a right to raise a complaint with a relevant authority. We will assess a request according to the applicable requirements.

International processing and policy changes

Production application hosting and the verified operational database copies are in the United States. The company AI gateway and service providers may process information in additional locations according to their service arrangements. Application hosting does not establish the location of AI inference or gateway logs. No dedicated AI data-residency arrangement is claimed.

The policy version and effective date appear at the top of this page. Material changes in data use, recipients or features will be reflected in the policy and brought to users’ attention, with renewed consent where required.

Related policies and contact

Google Privacy Policy: https://policies.google.com/privacy

Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

YouTube Terms of Service: https://www.youtube.com/t/terms

Google account access controls: https://security.google.com/settings/security/permissions

OpenAI API data controls: https://developers.openai.com/api/docs/guides/your-data

Privacy contact: brand-monitoring@luckywarriors.com

Responsible organization: Prudent Owl Limited

Reddit 公开订阅临时采集

Social Atlas 通过 Reddit 公开 RSS 订阅读取已知品牌帖子和指定社区的候选帖子、评论正文、记录 ID、帖子标题、来源链接和时间，用于内部人工复核。正文可能包含用户自行公开的个人信息。评论归属根据品牌帖子的关键词建立候选关系，尚未进行 AI 相关性判断。用户名和头像不作为独立字段收集。

RSS 为临时数据来源，采集任务计划在 2026 年 11 月 13 日停止。订阅窗口不保证覆盖所有帖子、评论或删除事件。明确读取到删除标记时移除相应正文；访问失败不推断删除。记录最多保留 30 天，隐私与删除请求可联系 brand-monitoring@luckywarriors.com。Reddit 文本暂不发送至 AI 供应商，也不用于自动差评播报。