Updated: December 14, 2023

Privy is committed to privacy. This Privacy Policy describes how we collect, use, protect and disclose your Personal Information (PI) and Personally Identifiable Information (PII) when you visit us, use our Services, or access the features on the websites that Privy owns or controls (collectively, the “Services”). You can access the Services in many ways, including from a computer, mobile phone, or mobile app, and this Privacy Policy will apply regardless of the means of access.

The Privy privacy policy has been compiled to better serve those who are concerned with how their PI and PII are being used online. PII, as described in U.S. privacy law and information security, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. PI and PII do not include lawfully made available public information or information that is deidentified or aggregated in a way that it cannot be used to identify a particular individual.

Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle your PII in accordance with our website.

Categories of Personal Information We May Collect

The categories of Personal Information we may collect and use in connection with our websites and Services may fall into one or more of the categories described below. Please note, the types of Personal Information provided as examples for each category are not a representation that we will collect that specific type of Personal Information about you.

• Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, e-mail address, account name, or other similar identifiers.
• Customer Records, such as a name, address and telephone number. Please note, for purposes of the California Consumer Privacy Act (“CCPA”), this category of personal information constitutes any personal information described in subdivision (e) of Cal. Civ. Code 1798.80.
• Legally Protected Characteristics, such as race, religion, sexual orientation, gender expression and age. Please note, for purposes of the CCPA, this category of Personal Information constitutes characteristics of protected classifications under California or federal law. Please note, we only collect information relating to racial or ethnic origin and religious beliefs in connection with submission of photos (such as your profile photo) that may reveal these types of information. We do not use these types of information for any purpose apart from displaying your photo through the Services.
• Commercial Information, including records of personal property, products or services purchased, obtained, or considered, other purchasing or consuming histories or tendencies, or contents of mail, email, or text messages where we are the intended recipient.
• Professional or Employment-Related Information, such as job title, or other similar information.

Sources of Personal Information We Collect

A large portion of the Personal Information we collect about you in connection with our Services is collected directly from you in connection with your access to, use of or interaction with our websites and Services (including personal information we automatically collect). You have the option not to provide any Personal Information we ask you to provide in connection with your access to, use of or interaction with our Services. However, there are some features on our Services where we have to collect certain personal information, and, if you do not provide us with the required personal information, you will not be able to access, use or interact with that feature. This is especially true where it is impossible for the feature to operate without certain Personal Information (for example, it is impossible for us to connect a consumer investor with a loan officer or real estate agent through the Services if we are not provided relevant information necessary to do so).

We also may collect information (which may include Personal Information) about you from third parties, including, without limitation, online and offline sources, social media platforms, advertising networks, or other public or commercial sources (collectively, “Third Party Sources”).

The following provides additional information about the Third Party Sources we may interact with in connection with your Personal Information:

Third Party Platforms. This category includes third party owned or operated platforms or services, such as Apple, Facebook, and Google. We may now, or in the future, provide you with the ability to register for or sign into our Services using an account you have on a third party platform (instead of creating an account directly with us) and, if you do, that third party is included in this category.

Transactional Third Parties. This category includes third parties who are not related to us but provide us with Personal Information necessary to enable us to provide you with certain features and functionalities of the Services.

Service Providers. This category includes third parties that provide services to us related to the functionality and operation of our Services, such as hosting the online portions of our Services, managing communications we send and receive, and processing orders and payments.

Targeted Advertising Partners. This category includes third parties that facilitate the delivery of our targeted advertisements, promotions and offers.

Analytics Providers. This category includes third parties that operate tracking technologies, such as web beacons, cookies, clear gifs and pixel tags on our Services to collect information used to analyze the use and performance of our Services, including, among other things, measuring the effectiveness of our Services, content, communications and advertising.

Professional Advisors. This category includes third parties that provide us professional advice about the operation of our Services and other business operations, such as our attorneys, accountants, financial advisors and other business advisors.

Government Officials/Law Enforcement. This category includes law enforcement, government officials and other private parties we interact with in connection with complying with legal requirements, pursuing and defending against lawsuits, protecting our and third party’s property and rights, protecting the security and integrity of our Services, and preventing or stopping illegal, unethical, fraudulent and abusive activities.

Privy Users. This category includes other users of our Services, such as those that are connected through the Services, including consumer investors, loan officers, real estate agents, or employers, as well as other users that refer you to our Services or take actions on or through our Services on your behalf.

How do we use your information?

We may use the information we collect from you when you register, make a purchase, sign up for our newsletter, respond to a survey or marketing communication, surf the website, use our Service, or use certain other site features in the following ways:

• To personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested.
• To improve our website in order to better serve you.
• To ask for ratings and reviews of services or products.
• To follow up with them after correspondence (live chat, email or phone inquiries).
• To communicate with you such as responding to your inquiries, provide you with updates or reminders, present you with opportunities to participate in surveys, responding to your request to exercise your rights regarding your account or Personal Information, notifying you of changes to our Terms of Service or this Privacy Policy and other similar communications, and any other communications with us you request or consent to.
• To operate our Services including maintaining and servicing your account(s), processing or fulfilling orders and transactions, verifying information, processing payments, ensuring the security and integrity of our Services, identifying and repairing error that prevent any portion of our Services from operating as intended, providing access to the online features of our Services, enabling you to post reviews or other feedback on common areas of our Services, or conducting other internal business operations permitted under applicable law.
• To improve our Services such as evaluating frequently asked questions, contacting you about usage of the Services, assisting you in better accessing, using and interacting with our Services, troubleshooting errors on our Services, generating statistical reports about access, use and interaction with our Services, analyzing and developing products and services we provide, monitoring and reviewing trends and usage related to our Services, benchmarking our Services, and developing better understanding of how our users access, use and interact with our Services.
• To advertise, market and promote our Services including sending you promotions, serving you targeted advertising, notifying you of new products and services or other features available through our Services, or enabling you to participate in a contest or promotion.
• To protect rights and complying with legal obligations, such as preventing, detecting, investigating and remediating security and other similar concerns, including fraud; protecting the rights, property, and safety of Privy, our users, and any other person; complying with applicable laws, regulations and industry requirements; responding to subpoenas and other legal or government requests; evaluating or conducting a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which the assets transferred include personal information we have about our customers.

How Long We Retain Personal Information

We retain Personal Information only as long as we have a legitimate business purpose to keep it. To determine the appropriate retention period for individual categories of Personal Information we collect, we consider the nature and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of the Personal Information, the purposes for which we process that Personal Information and whether we can fulfill those purposes through other means, and applicable legal, regulatory, tax, accounting, reporting, or other requirements.

Personal Information We May Disclose to Third Party Sources

In order to operate our Services and carry out other activities permitted by applicable laws, we may disclose certain Personal Information we have collected or received to certain Third Party Sources. The following list identifies the categories of Personal Information we may disclose to each category of Third Party Source and the purpose for those disclosures. Please note, these disclosures are in addition to any disclosures to third parties you authorize or instruct us to make.

• Third Party Platforms to provide targeted advertising or other marketing services, perform data analysis and statistical analysis, or enable your ability to register and sign into our Services through the use of your existing account on a Third Party Platform.
• Service Providers to process and fulfill your orders; provide payment processing services; operate and manage our Services and to improve the content and functionality of our Services; help us collect and analyze Personal Information for lawful business purposes, including providing data processing services; provide non-targeted advertising and other marketing, including helping to run sweepstakes and contests and provide public relations services; and perform data analysis and statistical analysis.
• Targeted Advertising Partners to provide targeted advertising or other marketing services and provide data analysis and statistical analysis.
• Analytics Providers to provide targeted advertising or other marketing services and provide data analysis and statistical analysis.
• Professional Advisors to receive advice from our professional advisors, such as our attorneys, accountants, financial advisors and business advisors, in their capacity as advisors to us.
• Government Officials/Law Enforcement to comply with any valid legal process, governmental request, or applicable law, rule, or regulation; comply with legal requirements, as ordered by a court or if we believe in good faith that the law requires it; investigate, remedy, or enforce potential violations of applicable agreements; protect the rights, property, and safety of Privy, our users, or others; and/or detect and resolve any fraud or security concerns.
• Privy Users to respond to a third party’s claim that content on our Platform violates rights or requirements; publish comments, review or other feedback posted to the public areas of our Services.

How do we protect your information?

Our Services are hosted on world-class software-as-a-service providers (currently Amazon Web Services) which provide various levels of security and vulnerability scanning and other measures to help ensure a secure and stable environment. However, no service is completely secure and users should use caution when interacting with any online (and mobile) websites and applications.

Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.

We implement a variety of security measures when a user places an order or enters, submits, or accesses their information to maintain the safety of your personal information.

All transactions are processed through a gateway provider and are not stored or processed on our servers.

Do we use ‘cookies’?

Yes. Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enables the site’s or service provider’s systems to recognize your browser and capture and remember certain information. For instance, we use cookies to help us remember and process the items in your shopping cart. They are also used to help us understand your preferences based on previous or current site activity, which enables us to provide you with improved services. We also use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.

We use cookies to:

• Understand and save users’ preferences for future visits.
• Compile aggregate data about site traffic and site interactions in order to offer better site experiences and tools in the future. We may also use trusted third-party services that track this information on our behalf.

You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Since the browser is a little different, look at your browser’s Help Menu to learn the correct way to modify your cookies.

If you turn cookies off, some of the features of our Services experience may not function properly.

Additional Information About Analytics

We may use, or permit the use of, analytics tools, including, without limitation, third party cookies, web beacons, clear gifs, pixel tags, or other similar technologies provided by our Targeted Advertising Partners and Analytics Providers. This section provides additional information about the types of analytics tools that, subject to your choices and any exercise of rights available to you, may collect information about you in connection with your access to or use of our Services.

Cookies. A “cookie” is a small data file stored on your web browser or on your mobile device that allows us to recognize your computer or mobile device when you visit one of our websites or Services by associating identification numbers with other user information you have provided us. Some cookies will remain on the hard drive of your computer or mobile device for the duration of your browser or user session, while others will remain until deleted by you. You may also be able to configure your computer or mobile device to limit the collection of these “cookies,” but that limitation may also limit our ability to provide all the Services or functionality of the Services.

We use first party cookies, served directly by us to the devices that access the Services, to recognize those devices when they revisit. We also use third party cookies, which are cookies that are placed by other parties we work with. These “third party cookies” may, for example, originate from websites such as Facebook, LinkedIn, or other social media services. Since the cookie policies of these websites change over time, you should reference their policies by visiting the privacy policy webpages of these third parties. You can learn more about cookies, including how to see what cookies have been uploaded to your device and how to manage and delete them, by visiting https://www.allaboutcookies.org/.

Web beacons, clear gifs, and pixel tags. These technologies may be used on or in connection with the Services, including, but not limited to, in emails we send. We may use these technologies to deliver cookies, count visits, understand usage, and observe data on email delivery, open rates, click rates, bounces, unsubscribe rates and other information.

Session Replay Services. Enabling session replay allows a website operator to record and play back a user’s journey through the operator’s website or mobile app. We use that software so we can better understand each individual user’s experiences on our Services (like how much time users spend on which pages, which links they click, what they like and don’t like) and use that knowledge to fix bugs on the Services, improve your user experience on the Services, and improve how the Services function. We use session replay services offered by various Analytics Providers. These session replay services use cookies and other technologies to collect data about the behavior of our users and their devices, in particular IP address of the device, screen size, device type (Unique Device Identifiers), information about the browser used, location (country only), preferred language for displaying our website in addition to mouse movement, click information, and text you enter as you navigate through our Services. Our Analytics Providers store this information on our behalf in a pseudonymized user profile. Our Analytics Providers are contractually prohibited from selling the data collected on our behalf. You can block session replay software in several ways. If you have cookies disabled, you won’t be tracked by any session replay software using cookies. You can visit www.allaboutcookies.org in order to obtain more information on deleting or controlling cookies. Some of our Analytics Providers also respect the Do-Not-Track (DNT) headers in browsers. As a website user browsing websites that utilize session replay, you are able to use the DNT setting in your browser to avoid certain Analytics Providers tracking any data about your visit. DNT is implemented through your browser, so you’ll need to check if the setting is enabled or disabled within your own browser.

Google Analytics, a web analytics tool that assists us in understanding how our Services are used. Google Analytics will place cookies on your device that will generate information we select about your use of the Services, including your device’s IP address. That information will be transmitted directly to and stored by Google. The information will be used for the purposes of evaluating use of the Services, compiling reports on activity on the Services for our use and providing other services relating to activity on, and usage of, the Services. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google’s practices with respect to the Personal Information collected through Google Analytics are covered by Google’s privacy policy, available at https://policies.google.com/privacy. You may opt out of Google Analytics by visiting https://tools.google.com/dlpage/gaoptout.

Google Tag Manager (“GTM”), a tag management system that allows JavaScript and HTML tags to be quickly deployed and updated on portions of our Services for tracking and analytics. GTM enables the use of Google Analytics. If you have opted out of Google Analytics, GTM takes this opt out into account. For more information about the privacy practices applicable to GTM, please refer to https://policies.google.com/privacy/ and the terms of use at https://www.google.com/analytics/tag-manager/use-policy.

Google AdSense. We may use Google AdSense Advertising on our website. Google, as a third-party vendor, uses cookies to serve ads on our site. Google’s use of the DART cookie enables it to serve ads to our users based on previous visits to our site and other sites on the Internet. Users may opt-out of the use of the DART cookie by visiting the Google Ad and Content Network privacy policy. We have or may implement in the future the following:

• Remarketing with Google AdSense
• Google Display Network Impression Reporting

We, along with third-party vendors such as Google use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as the DoubleClick cookie) or other third-party identifiers together to compile data regarding user interactions with ad impressions and other ad services functions as they relate to our website. Users can set preferences for how Google advertises to you using the Google Ad Settings page. Alternatively, you can opt-out by visiting the Network Advertising Initiative Opt Out page or by using the Google Analytics Opt Out Browser add-on.

HubSpot Analytics, a web analytics tool that assists us in understanding how our Services are used. HubSpot Analytics utilizes various tracking technologies to generate information we select about your use of our Services, which may include information about websites or online service visited before a device accesses our Services, metrics about the performance of our Services, and information about how devices access our Services. That information will be transmitted directly to and stored by HubSpot. The information will be used for the purposes of evaluating use of our Services for our use and providing services relating to activity on, and usage of, our Services. You can learn more about HubSpot’s practices with respect to Personal Information by reviewing their privacy policy, available at https://legal.hubspot.com/privacy-policy.

Your Choices Concerning Your Personal Information

We recognize that you may want to limit how your Personal Information is collected, used and shared. You can update your preferences by:

Updating your Personal Information. We provide you the opportunity to update or correct the contact information that you have provided to us. You may do so through your account, or you can contact us directly. We recommend that you do not use email communications to send us sensitive Personal Information. If you need to change that personal information, we recommend that you call us directly.

Opt out of marketing emails. If you create an account or otherwise sign up to receive marketing emails, we may send you marketing emails or other such communications that you request to the email address that you provide. If you no longer wish to receive marketing communications from us, you can unsubscribe by clicking the “Unsubscribe” button found at the bottom of the emails you received from Privy. We will work diligently, but you may still receive marketing communications while we process this request.

Additional Rights for California, Virginia, Colorado, Connecticut, and Utah Residents. If you are a resident of California, Virginia, Colorado, Connecticut, or Utah, please review our “Supplemental Privacy Notice for California, Virginia, Colorado, Connecticut, and Utah Residents” (further below in this document) for a description of the additional rights available to residents of those states with respect to their Personal Information and how to exercise those rights. Please note, if you are not a resident of California, Virginia, Colorado, Connecticut, or Utah, the rights described in the Supplemental Privacy Notice for California, Virginia, Colorado, Connecticut, and Utah Residents do not apply to you.

Targeted Advertising

If you wish to limit third-party advertising, you can visit the National Advertising Initiative Consumer Opt-Out page and the Digital Advertising Alliance’s Consumer Choice Tool. In addition, the electronic device you use to visit our Websites or Apps offer additional privacy settings when using our Websites or Apps; please see the device settings for details. Please note that even if you opt-out of receiving interest-based advertising, you will still receive advertisements, but they will be more general in nature.

Information Security

We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of your Personal Information and data stored on our Services. These safeguards vary based on the sensitivity of the information that we collect and store. Additionally, our Services are designed to comply with the laws applicable to the highly regulated financial services industry. This includes utilizing practices and measures that are designed to comply with the requirements for safeguarding, using and protecting personal information as set out in laws such as the Gramm-Leach-Bliley Act (GLBA) of 1999. However, there is an inherent risk in the transmission of information via the internet, and we cannot and do not guarantee that these measures will prevent every unauthorized attempt to access, use, or disclose your information because despite our efforts.

NO DATA TRANSMISSION OVER THE INTERNET OR DEVICE CAN BE GUARANTEED TO BE 100% SECURE. WHILE WE STRIVE TO PROTECT PERSONAL INFORMATION, WE DO NOT GUARANTEE THE SECURITY OF PERSONAL INFORMATION AND YOU PROVIDE PERSONAL INFORMATION AT YOUR OWN RISK.

We recommend that you change your password periodically and otherwise manage your account authentication information in accordance with your organization’s policy or NIST guidelines. You are responsible for maintaining the security of your account username and password. If you believe that your account username and/or password have been stolen or been made known to others, it is your responsibility to immediately contact us at support@privy.pro and change your password. We are not responsible if someone else accesses your account through information they have obtained from you.‍

Third Party Websites

In general, the third-party providers that we use will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us.

The Services may link to, or be linked to, websites not owned or controlled by us. We do not have any control over the quality, safety or legality of the items advertised, the truth or accuracy of the listings, the ability of suppliers to sell items or the ability of buyers to buy items, or the truth or accuracy of any information on third party websites. For these reasons, Privy and its affiliates cannot ensure that a buyer or supplier will actually complete a transaction or that information on a third party’s website is accurate or reliable. Privy will not be a party to any transactions between you and such third parties and any correspondence concerning such transactions should be conducted between you and the third party. We are not responsible for third-parties’ privacy policies or practices. This Policy does not apply to any third-party websites or to any data that you provide to third parties. You should read the privacy policy for each website that you visit. Once you leave our Services or are redirected to a third-party website or application, this Privacy Policy and our Terms of Service no longer apply.

Fair Information Practices

The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.

In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur:
We will notify you via email within 7 business days.

We also agree to the individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.

CAN-SPAM Act

The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.

We collect your email address in order to:

• Send information, respond to inquiries, and/or other requests or questions

To be in accordance with CAN-SPAM, we agree to the following:

• Not use false or misleading subjects or email addresses.
• Identify the message as an advertisement in some reasonable way (when the message is an advertisement).
• Include the physical address of our business or site headquarters.
• Monitor third-party email marketing services for compliance, if one is used.
• Honor opt-out/unsubscribe requests quickly.
• Allow users to unsubscribe by using the link at the bottom of each email.

Children’s Information
The Services are only intended for individuals over the age of 18. We do not under any circumstances knowingly collect information from children under the age of 13. Children under the age of 13 are prohibited from submitting any Personal Information to us through the Services. If you are a parent or guardian of someone under the age of 13 and discover that your child has submitted Personal Information to us, please contact us support@privy.pro.

International Users
The Services are only intended for residents of the United States. If you are not a resident of the United States, please do not provide us with any Personal Information.

Additional Privacy Rights for Residents of California, Virginia, Colorado, Connecticut, and Utah
If you are a resident of California, Virginia, Colorado, Connecticut, or Utah, please review our “Supplemental Privacy Notice for California, Virginia, Colorado, Connecticut, and Utah Residents” for a description of the additional rights available to residents of those states with respect to their Personal Information (refer below). Please note, if you are not a resident of California, Virginia, Colorado, Connecticut, or Utah, the rights described in the Supplemental Privacy Notice for California, Virginia, Colorado, Connecticut, and Utah Residents do not apply to you.

Updates to this Policy and Contacting Us

We may need to update this Privacy Policy to make sure it complies with applicable laws and conforms to changes in our Services, and we reserve the right to do so at any time. If we do revise this Privacy Policy, we will make it known on our Services or by email and we will update the “Last Updated” date at the top of this page so that you can tell if it has changed since your last visit. Unless otherwise noted, those changes will be effective as soon as they are posted. Please check back regularly to see if our Privacy Policy has been updated.

Your continued use of our Services after any changes to this Privacy Policy become effective constitute your continued acknowledgement that you understand we may continue to collect and use your Personal Information as described in this Privacy Policy.

If you have any questions about this policy or your privacy rights related to our Services, please contact us using the following information:
RE Data Lab, Inc., PO Box 13647, Denver, Colorado 80201

support@privy.pro

Unsubscribing from our Email Lists

If at any time you would like to unsubscribe from receiving future emails, you can follow the instructions at the bottom of each email and we will promptly remove you from all correspondence.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Supplemental State-specific Privacy Notices

Supplemental Privacy Notice for California, Virginia, Colorado, Connecticut, and Utah Residents

Updated: December 14, 2023

If you are a resident of California, Virginia, Colorado, Connecticut, or Utah, this Supplemental Privacy Notice for California, Virginia, Colorado, Connecticut, and Utah Residents (“Supplemental Privacy Notice”) applies to you and supplements our primary Privacy Policy, available at https://privy.pro/privacy-policy. This Supplemental Privacy Notice provides information about certain rights with respect to our collection, use, and disclosure of your Personal Information that may be available to you under applicable state law (generally, the “Privacy Rights”), an overview of our general processes for responding to Privacy Rights requests we receive, and state-specific information about exercising a Privacy Right and other information under applicable laws.

Please note, the scope of some of the rights described in this policy and our process for responding to them differ from state-to-state, so please refer to the specific information where applicable.

Overview of Privacy Rights

In certain jurisdictions, applicable law may provide you with the following rights with respect to your Personal Information – Right to Know, Right to Delete, Right to Correct, Right to Data Portability, and Right to Opt-Out of Certain Processing Activities (each, a “Privacy Right”). This section provides a general overview of each of these Privacy Rights. Please review the specific information for your state of residence for more detailed information about how these Privacy Rights may apply to you.

Please note, you must provide sufficient information to enable us to respond to requests you make the exercise your Privacy Rights, which may include, consistent with applicable law and based on the nature of the applicable Privacy Right, providing us with information that is sufficient to allow us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative of that person and providing sufficient detail in connection with your request to allow us to properly understand, evaluate, and respond to it.

Right to Know

Subject to applicable law, the Right to Know provides you with the right to obtain certain information from us about the Personal Information we have collected from or about you which may include:

• confirming whether or not we are processing your Personal Information;
• the categories of Personal Information we have collected about you;
• the categories of sources of the Personal Information we have collected about you;
• our business or commercial purpose(s) for collecting, selling, or sharing that Personal Information;
• the categories of third parties to whom we disclose, sell, or share that Personal Information; and
• the specific pieces of Personal Information we have collected about you.

All Right to Know requests are subject to verification of your identity, and, subject to applicable law, we are required to fulfill these requests no more than twice within a 12-month period.

Right to Delete

Subject to applicable law, the Right to Delete provides you with the right to request we delete any Personal Information we have collected and retain about you, subject to certain exceptions such as our need to comply with legal obligations, fulfill orders, complete transactions, etc.

All Right to Delete requests are subject to verification of your identity.

Right to Correct

Subject to applicable law, the Right to Correction provides you with the right to request that we correct inaccurate Personal Information that we have collected and maintain about you.

All Right to Correct requests are subject to verification of your identity.

Right to Data Portability

Subject to applicable law, the Right to Data Portability provides you with the right to request a copy of Personal Information you previously provided to us in a portable and, to the extent technically feasible, readily usable format.

All Right to Data Portability requests are subject to verification of your identity, and, subject to applicable law, we are required to fulfill these requests no more than twice within a 12-month period.

Right to Opt-Out of Certain Activities

Subject to applicable law, the Right to Opt-Out of Certain Activities provides you with the right to opt-out of having the Personal Information we have collected from or about you sold to third parties, shared with third parties for behavioral advertising purposes, processed for targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Subject to applicable law, Right to Opt-Out of Certain Activities requests may not be subject to verification of your identity, however, if we have a good-faith, reasonable basis to believe that Right to Opt-Out of Certain Activities request is fraudulent, we may deny the request and provide an explanation of the reason for the denial.

Exercising Your Privacy Rights

To exercise a Privacy Right, in addition to other applicable options provided in our Privacy Policy or this Supplemental Privacy Notice, you may submit a request to exercise a Privacy Right by contacting us by contacting us via our then-current contact methods denoted in this Privacy Policy or on our website.

Overview of Our Process for Responding to Requests to Exercise Privacy Rights

Subject to applicable law, our general process for responding to requests to exercise a Privacy Right is to, where applicable, verify your identity and then respond to your request, either by fulfilling your request or, if we cannot fulfill your request, in whole or in part, providing you about why we cannot fulfill your request. This section provides a general overview of this process. Please review the specific information for your state of residence for more detailed information about how our process may apply to your request.

Verifying Your Identity

Subject to applicable law, when we receive a request to exercise a Privacy Right, we will:

• acknowledge receipt of your request;
• try to match the information you provide in making the request with information we already maintain about you;
• if required to verify your identity, we may ask you to provide additional information, including Personal Information; and
• consider various factors when determining how to verify your identity, such as the sensitivity and value of the data, the risk of harm, the likelihood of fraud, etc.

Making a request does not require you to create an account with us. However, we do consider requests made through your password protected account sufficiently verified when the request relates to Personal Information associated with that specific account.

We will only use Personal Information provided in connection with a request to verify the requestor’s identity or authority to make the request.

Responding to Your Requests

We will try to promptly respond to your request and, subject to applicable laws, in any event within 45 days after we receive the request. If we require additional time, we will inform you of the reason we need additional time and the extension period. Generally, except as otherwise required under applicable law and where applicable to the particular Privacy Right covered by your request, any disclosures or actions we take with respect to your Personal Information will only cover the 12-month period immediately preceding our receipt of your request. Additionally, with respect to our response to a request to exercise a particular Privacy Right:

• Where we fulfill all or part of a Right to Know request, we will select a format to provide your Personal Information to you.

Where we fulfill all or part of a Right to Delete request:

• we may permanently and completely erase the Personal Information from our existing systems (except for archived or backup systems), deidentify the Personal Information, or aggregate the Personal Information;
• for any Personal Information stored on our archived or backup systems, we will delete, deidentify, or aggregate that Personal Information once the archived or backup system is restored to an active system or is next accessed or used for a sale, disclosure, or commercial purpose; and
• we will direct our Service Providers and other Third Party Sources to do the same, subject to certain exceptions permitted by applicable law.

For Right to Correct requests:

• we may deny your request if we determine that the contested Personal Information is more likely than not accurate based on the totality of the circumstances and we may request that you provide us with documentation that is relevant to your request; and
• we may choose to delete the contested Personal Information as an alternative to correcting it if doing so would not negatively impact your or you consent to our deletion.

Where we fulfill all or part of a Right to Opt-Out of Certain Activities we may still:

• disclose or otherwise provide your Personal Information to applicable Third Party Sources, such as our Service Providers and other entities for business purposes consistent with applicable law; and
• disclose or otherwise provide your Personal Information in connection with certain business transactions as described in our Privacy Policy.

Subject to applicable law, we may charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _

California

ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS

Subject to applicable law, you have the right to know what Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific pieces of Personal Information we have collected about you.

Right to Delete: Subject to applicable law, you have the right to request that we delete the Personal Information we have collected about you, subject to certain exceptions.

Right to Correct: Subject to applicable law, you have the right to request that we correct your inaccurate Personal Information.

Right to Opt-Out of Certain Activities: Subject to applicable law, you have the right to opt-out of having your Personal Information sold to or shared with third parties.

In addition to the other methods available to submit a request to exercise a Privacy Right, you may make a request to exercise the Right to Opt-Out of Certain Activities by clicking the Do Not Sell or Share My Personal Information link on our website or by clicking here.

Additionally, we honor the Global Privacy Control (GPC) as set through various browsers or browser plug-ins. You can find more about how to enable the GPC on your browser on the GPC website. When we receive a valid signal sent through GPC, we honor that communication as a valid request to opt-out of the sale or sharing of Personal Information associated that browser or device, and we may ask you to log into your account or otherwise identify yourself so we can link your opt-out preference to your account. We may also notify you if your request to opt-out sent through GPC conflicts with your previous consent to the sale or sharing of your Personal Information.

Right to Non-Discrimination: We will not discriminate against you for exercising any Privacy Right provided under applicable law.

Who May Exercise Your Privacy Rights

Only you or a person that you authorized to act on your behalf may make a Privacy Request concerning your Personal Information. A parent or legal guardian may make a Privacy Right request on behalf of their child.
‍
If you choose to use an authorized agent, you must: (a) provide signed, written permission to that authorized agent to submit Privacy Right requests on your behalf; (b) verify your identity directly with us; and (c) directly confirm with us that you granted permission to the authorized agent to submit the Privacy Right request on your behalf. For clarity, you are required to verify the identity of both yourself and the authorized agent. We may deny a request from an authorized agent if we do not have proof that they are authorized by you to act on your behalf.

California Shine the Light

Under California’s Shine the Light Law (California Civil Code Section 1798.83) you have the right to request the following information regarding our disclosure of your Personal Information to third parties for direct marketing purposes: (a) the categories of Personal Information we disclosed to third parties for their direct marketing purposes during the preceding calendar year; (b) the names and addresses of the third parties that received the information; and (c) if the nature of the third party’s business cannot be determined from their name, examples of the products or services they marketed. This information may be provided in a standardized form that is not specific to you.

You are permitted to obtain this information from us once a year, free of charge. To make such a request, please submit your request in writing (email acceptable).

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Virginia

PRIVACY RIGHTS FOR VIRGINIA RESIDENTS

Collection, Source, Purpose, and Sharing of Your Personal Information

To learn about the categories of Personal Information we collect, see the “Categories of Personal Information We Collect” section in our Privacy Policy.
‍
To learn about the categories of sources from which your Personal Information is collected, see the “Sources of Personal Information We Collect” section in our Privacy Policy.
‍
To learn about our purposes for collecting and using Personal Information, see the “Our Purposes for Collecting and Using Personal Information” section in our Privacy Policy.
‍
To learn about how long we retain Personal Information, see the “How Long We Retain Personal Information” section in our Privacy Policy.

Right to Know: Subject to applicable law, you have the right to confirm whether we are processing your Personal Information and to access such Personal Information.

Right to Delete: Subject to applicable law, you have a right to request that we delete the Personal Information we collected from you. If we have obtained Personal Information about you from another source, we will either: (a) retain a record of the Right to Delete request and the minimum data necessary for the purpose of ensuring that your Personal Information remains deleted from our records and not using such retained data for any other purpose; or (b) offer to opt you out of the processing of such Personal Information for any purpose except for those exempted purposes under applicable law.

Right to Correct: Subject to applicable law, you have the right to request that we correct your inaccurate Personal Information.

Right to Data Portability: Subject to applicable law, you may request a copy of the Personal Information you previously provided to us in a portable and, to the extent technically feasible, readily usable format.

Right to Opt-Out of Certain Activities: Subject to applicable law, you may direct us to cease processing your Personal Information for targeted advertising, sale of Personal Information, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Who May Exercise Your Privacy Rights: Only you may make a Privacy Request concerning your Personal Information. A parent or legal guardian may make a Privacy Right request on behalf of their child.

Request to Appeal Our Response to Your Request: If you disagree with our refusal to take action on your request to exercise a Privacy Right, you have the right to ask us to reconsider. You must submit your request within 60 days of your receipt of our denial. Once we receive your request, we will acknowledge and start processing your request. Within 60 days of receiving your request, we will inform you in writing of any action taken or not taken in response to your request, including a written explanation of the reasons for our decision.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Colorado

Effective: July 1, 2023

PRIVACY RIGHTS FOR COLORADO RESIDENTS

Right to Know: Subject to applicable law, you have the right to confirm whether we are processing your Personal Information and to access such Personal Information.

Right to Delete: Subject to applicable law, you have a right to request that we delete the Personal Information we collected from you. If we have obtained Personal Information about you from another source, we will either: (a) retain a record of the Right to Delete request and the minimum data necessary for the purpose of ensuring that your Personal Information remains deleted from our records and not using such retained data for any other purpose; or (b) offer to opt you out of the processing of such Personal Information for any purpose except for those exempted purposes under applicable law.

Right to Data Portability: Subject to applicable law, you may request a copy of the Personal Information you previously provided to us in a portable and, to the extent technically feasible, readily usable format.

Right to Opt-Out of Certain Activities: Subject to applicable law, you have the right to opt-out of the processing of your Personal Information for targeted advertising, sale of Personal Information.

In addition to the other methods available to submit a request to exercise a Privacy Right, you may make a request to exercise the Right to Opt-Out of Certain Activities by clicking the Do Not Sell or Share My Personal Information link on our website or by clicking here.

Additionally, we honor the Global Privacy Control (GPC) as set through various browsers or browser plug-ins. You can find more about how to enable the GPC on your browser on the GPC website. When we receive a valid signal sent through GPC, we honor that communication as a valid request to opt-out of the sale or sharing of Personal Information associated that browser or device, and we may ask you to log into your account or otherwise identify yourself so we can link your opt-out preference to your account. We may also notify you if your request to opt-out sent through GPC conflicts with your previous consent to the sale or sharing of your Personal Information.

Who May Exercise Your Privacy Rights: Only you or a person that you authorized to act on your behalf may make a Privacy Request concerning your Personal Information. A parent or legal guardian may make a Privacy Right request on behalf of their child.

If you choose to use an authorized agent, you must: (a) provide signed, written permission to that authorized agent to submit Privacy Right requests on your behalf; (b) verify your identity directly with us; and (c) directly confirm with us that you granted permission to the authorized agent to submit the Privacy Right request on your behalf. For clarity, you are required to verify the identity of both yourself and the authorized agent. We may deny a request from an authorized agent if we do not have proof that they are authorized by you to act on your behalf.

Request to Appeal Our Response to Your Request: If you disagree with our refusal to take action on your request to exercise a Privacy Right, you have the right to ask us to reconsider. You must submit your request within 60 days of your receipt of our denial. Once we receive your request, we will acknowledge and start processing your request. Within 45 days of receiving your request, we will inform you in writing of any action taken or not taken in response to your request, including a written explanation of the reasons for our decision.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Connecticut

Effective: July 1, 2023

PRIVACY RIGHTS FOR CONNECTICUT RESIDENTS

Right to Know: Subject to applicable law, you have the right to confirm whether we are processing your Personal Information and to access such Personal Information.

Right to Delete: Subject to applicable law, you have a right to request that we delete the Personal Information we collected from you. If we have obtained Personal Information about you from another source, we will either: (a) retain a record of the Right to Delete request and the minimum data necessary for the purpose of ensuring that your Personal Information remains deleted from our records and not using such retained data for any other purpose; or (b) offer to opt you out of the processing of such Personal Information for any purpose except for those exempted purposes under applicable law.

Right to Correct: Subject to applicable law, you have the right to request that we correct your inaccurate Personal Information.

Right to Data Portability: Subject to applicable law, you may request a copy of the Personal Information you previously provided to us in a portable and, to the extent technically feasible, readily usable format.

Right to Opt-Out of Certain Activities: Subject to applicable law, you have the right to opt-out of the processing of your Personal Information for targeted advertising, sale of Personal Information, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Who May Exercise Your Privacy Rights: Only you or a person that you authorized to act on your behalf may make a Privacy Request concerning your Personal Information. A parent or legal guardian may make a Privacy Right request on behalf of their child.

If you choose to use an authorized agent, you must: (a) provide signed, written permission to that authorized agent to submit Privacy Right requests on your behalf; (b) verify your identity directly with us; and (c) directly confirm with us that you granted permission to the authorized agent to submit the Privacy Right request on your behalf. For clarity, you are required to verify the identity of both yourself and the authorized agent. We may deny a request from an authorized agent if we do not have proof that they are authorized by you to act on your behalf.

Request to Appeal Our Response to Your Request: If you disagree with our refusal to take action on your request to exercise a Privacy Right, you have the right to ask us to reconsider. You must submit your request within 60 days of your receipt of our denial. Once we receive your request, we will acknowledge and start processing your request. Within 60 days of receiving your request, we will inform you in writing of any action taken or not taken in response to your request, including a written explanation of the reasons for our decision.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Utah

Effective: December 31, 2023

PRIVACY RIGHTS FOR UTAH RESIDENTS

Right to Know: Subject to applicable law, you have the right to confirm whether we are processing your Personal Information and to access such Personal Information.

Right to Delete: Subject to applicable law, you have a right to request that we delete the Personal Information we collected from you.

Right to Data Portability: Subject to applicable law, you may request a copy of the Personal Information you previously provided to us in a portable and, to the extent technically feasible, readily usable format.

Right to Opt-Out of Certain Activities: Subject to applicable law, you have the right to opt-out of the processing of your Personal Information for targeted advertising or the sale of Personal Information.

Who May Exercise Your Privacy Rights: Only you may make a Privacy Request concerning your Personal Information. A parent or legal guardian may make a Privacy Right request on behalf of their child. A guardian or conservator may make a Privacy Request on behalf an individual subject to guardianship, conservatorship, or other protective arrangement under applicable law.