PRIVACY POLICY

1. What Personal Information We Collect

a. Information That You Provide or Authorize Us to Collect

This is information that you provide directly to us or authorize us to collect from third-party service providers. The information we collect may vary depending on whether you use the Platform as a Fan or a Creator. The Personal Information that you provide or authorize us to collect may include:

• Contact and Account Information. Full legal name, username, email address, date of birth, and, where provided, physical address. We collect this directly from you when you create an Account. We use this to provide and support the Platform and the Services, verify your eligibility (including that you meet the minimum age requirement of 18), manage our relationship with you, respond to inquiries, send service communications, authenticate users, and comply with legal obligations. Retention generally aligns to the duration of your relationship with us plus a reasonable period to comply with legal, tax, and audit requirements.
• Commercial and Transactional Information. Account history, configuration choices, and records of interactions with us. We use it to operate, maintain, secure, and improve the Platform and the Services, and for billing, audit, and compliance. Retention corresponds to the duration of your business relationship with us, plus a reasonable period to comply with legal, tax, and audit requirements.
• Payment Information. We use a third-party payment processor to process payments from Fans and remit payouts to Creators. When you provide payment information through the Platform, that information is collected and stored by our payment processor subject to its privacy policy and terms of service. We may receive limited payment information from our payment processor, such as the last four digits of your payment card, card type, billing address, and transaction details. We use this information to operate the Platform, facilitate transactions, and for billing, audit, and compliance. Retention corresponds to contractual and legal requirements.
• Sensitive or Financial Information. If you are a Creator, you may be required to provide tax identification information (such as a social security number, employer identification number, or other tax identification number), bank account or payout information, and identity verification information (such as a copy of government-issued identification), as necessary for FanNote's compliance with tax reporting, anti-fraud, and applicable regulatory requirements. This information may be collected directly by FanNote or through our third-party payment or verification service providers. We use this information for identity verification, payout processing, tax reporting, audit, and compliance purposes only. If you are a Fan, you may include personal information, including potentially sensitive personal information, in the content of your Fan Requests or other communications through the Platform. FanNote does not require or solicit sensitive personal information from Fans, but we cannot prevent you from including it in free-form submissions. We process this information solely to provide you the Services (i.e., to deliver your Fan Request to the Creator and facilitate the Creator's response). You should not include information in a Fan Request that you would not want the Creator to see. We will not use or collect sensitive personal information for purposes beyond those disclosed in this Privacy Policy or without your consent where required by applicable law. Where applicable law provides a right to limit the use of sensitive personal information, we will honor that right. Retention corresponds to the duration of your relationship with us, plus a reasonable period to comply with legal, tax, and audit requirements.
• Audio, Visual, and Electronic Information. Photos, images, audio recordings, video recordings, and text that you upload or submit through the Platform, including as part of Fan Requests, Creator Content, Creator profiles, or account profiles. We store and use this information to provide and maintain the Platform and Services, including to deliver Fan Requests and Creator Content. Retention corresponds to the duration of your relationship with us, plus a reasonable period to comply with legal, tax, and audit requirements.
• Social Media and Instagram Verification. If you are a Creator, you are required to link your Instagram account to your FanNote profile as part of our identity and authenticity verification process before your Creator profile can go public. When you link your Instagram account, we collect your Instagram username/handle and follower count through Instagram's authentication process. Your Instagram handle and follower count will be publicly displayed on your Creator profile on the Platform. We store this information to verify your identity, maintain your Creator profile, and provide the Services. Fans are not currently offered the option to link social media accounts. Please note that we do not control, and are not responsible for, other uses of your personal information by Instagram or its parent company, Meta. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their platforms. Retention corresponds to the duration of your relationship with us. When you delete your Account, your linked Instagram account details and associated information are permanently removed from our systems.
• Feedback Information. Personal information included in your communications with us, e.g., surveys or interviews. This may include your name, contact information, voice recording, and any other content or communication that you send to or share with us. We use this to provide you with customer support, and to solicit feedback to improve our products and services. Retention is limited to the purpose and duration necessary for operations, quality, dispute resolution, or compliance.
• Customer Support and AI Chatbot Information. If you interact with our customer support services, including our AI-powered chatbot, we may collect the content of your communications, your name, contact information, and any other information you provide in connection with your inquiry. We use this information to respond to and resolve your inquiry, improve our support services, and for quality assurance. Retention is limited to the purpose and duration necessary for operations, quality, dispute resolution, or compliance.
• Content. The Platform allows you to submit free-form content, including Fan Requests and Creator Content. Fan Requests are submitted directly to the applicable Creator and are not publicly visible to other Fans or users. Creator profiles are visible to Fans on the Platform. You should ensure that any content you submit does not include personal information that you do not want disclosed to the recipient (i.e., the Creator if you are a Fan, or the Fan if you are a Creator). We do not pre-screen content before it is submitted.
• Inferences. We may derive personal information about you in the form of inferences, which are derivations of information, data, assumptions, or conclusions from facts, evidence or other sources of information or data about you. We do not use sensitive personal information for the purpose of building any inferences. We use this to improve and provide the Services to you. Retention is limited to the purpose and duration necessary for operations, quality, dispute resolution, or compliance.

By voluntarily providing us with Personal Information, you represent that the Personal Information you provide is true, accurate, current, and complete, and that you are authorized to provide it to us.

b. Information Automatically Collected

Whenever you interact with the Platform or the Services, we may automatically receive and record information from your computer, browser and/or mobile device, which may include the following:

• Internet or Other Network Activity. IP addresses, device information, browser type, operating system, website usage patterns, and interaction data, including the content, features, and activities that you access, and the time, frequency, and duration of those activities, collected through cookies and similar technologies when you use our platform. This includes which Creator pages you view and how you reached them. We use it for security, to analyze performance, to improve the Platform and the Services, to remember preferences, and for fraud prevention. Retention varies by signal type and is typically short for security logs unless needed to investigate or comply with law.

We may collect and use aggregated and de-identified usage data and analytics to understand engagement patterns, improve the Platform and Services, and for other internal business purposes. Aggregated and de-identified data is not Personal Information and is not subject to this Privacy Policy.

c. Information You Send to Us About Others

Through your use of the Platform and our Services, you may provide us with data, including Personal Information, you collect from others. You are responsible for collecting any and all consents and authorizations required by applicable law before you share such third party's Personal Information with us or with a Creator through the Platform.

d. Cookies And Similar Technologies

We use cookies and similar technologies for functionality and security purposes, such as keeping you logged in, remembering your preferences, and protecting against unauthorized access. We do not currently use cookies, pixels, or similar technologies for targeted advertising or cross-context behavioral advertising. We may use basic analytics technologies to understand how the Platform is used and to improve performance. Our analytics are first-party. We set two cookies on our own domain, one that identifies your browser to us for up to two years and one that groups the pages you view in a single sitting for up to four hours. These cookies contain a random identifier only. We use them to count visits, to understand how people arrive at the Platform (for example from a Creator's link, QR code, or social profile), to see which Creator pages are viewed, and to measure how visits lead to Accounts and Fan Requests. We do not share this data with advertising or analytics companies, and no third-party script is loaded to collect it. We shorten your IP address before storing it, and where we derive an approximate location from it we do so on our own systems at the country and region level only. If your browser sends a Global Privacy Control signal, we do not set these cookies or record analytics about your visit. You can manage your cookie preferences through your browser settings. If you disable cookies, some features of the Platform may not function properly. Where required by applicable law, we will obtain your consent before placing non-essential cookies on your device.

e. Information Collected From Other Sources

We may collect any of the above categories of Personal Information about you from third parties, including payment processors, banks, identity verification partners, advertising networks, internet service providers, data analytics providers, government entities, social networks, and public databases, among others. If you link an authorized payment method or provide payment information to us through a third party, you grant us and these third parties the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by these service providers. You will have the opportunity to view or agree to these service providers' privacy policies before using their services.

2. How We Use Personal Information

We may use the Personal Information we collect for the following purposes:

• To Provide Services:
  • To verify your identity to comply with industry requirements, self-regulatory guidelines, applicable laws and regulations
  • To set up and maintain your Account
  • To personalize the Services when you visit our Platform and/or use one of our online forms, tools, widgets or content items
  • To monitor your use of the Services
  • To maintain our Services, Platform, and operations
  • To process transactions made through the Services
• To ensure the integrity and security of our Services
  • To perform identity verification in compliance with applicable laws and regulations
  • To detect and protect against security incidents and malicious, deceptive, fraudulent, or illegal activity, and prosecute the same
  • To debug to identify and repair errors in our systems
  • To verify or maintain the quality of our services, and to improve, upgrade, or enhance our services
  • To monitor conduct or content in accordance with our Terms, Refund Policy, or this Privacy Policy, and to enforce the same
• For analytics, research, and service improvement
  • To monitor and measure your use of our Platform and Services in an effort to better understand you and our other users.
  • To conduct testing, research, and surveys to understand how our Platform and Services are being used and how they can be improved.
  • To conduct analytics, such as usage trends.
  • To perform financial analysis to better understand pricing and other financial matters.
  • To improve the content and functionality of the Services.
  • To test and improve the quality of our matching process.
  • To better understand user needs.
  • To pre-populate certain fields in our forms, helping to streamline your experience.
• For quality assurance and training purposes
  • To monitor communications and interactions with you to ensure the quality of our support services and the appropriate training of our people, and to respond to and resolve your inquiries.
• To communicate with you
  • To contact you by email, postal mail, push notifications, in-app messages, phone, or SMS, as permitted by applicable law, to provide you with:
    • Information regarding your Account or transactions made through your Account
    • Opportunities, alerts, and promotions available through the Services or of our third-party partners that we think may be of interest to you
    • Contributions or other content that we think may be of interest to you
• For personalization and advertising
  • To promote your Creator Content, or your profile as a Creator, including recommendations of your profile or Creator Content to Fans
  • Provide you with reasonable accommodations
• To comply with applicable laws and regulations
  • To investigate disputes or claims related to our Platform or our Services
  • To respond to legal, government or regulatory requests
  • To comply with applicable laws

We may also use your Personal Information for any other legitimate business purposes not otherwise prohibited by law.

3. How We Disclose Personal Information

We do not sell your Personal Information to any party. We may disclose your Personal Information to the following categories of recipients for our business or commercial purposes:

• Service Providers. We share Personal Information with third-party service providers who perform functions on our behalf, including payment processing, cloud hosting, customer support tools (including AI-powered chatbot services), and technology services. These providers process Personal Information on our behalf and are contractually required to protect your information and use it only for the specific services they provide to us. Where required by applicable law, we enter into data processing agreements with these providers that include appropriate safeguards for your Personal Information.
• Other Users of FanNote. When you use the Platform, certain Personal Information is shared with other users as part of the Services. If you are a Fan, the Creator to whom you submit a Fan Request will receive your username, profile image, and the content of your Fan Request (including any text, images, audio, video, or other materials you include). Fans cannot see other Fans' activity, Fan Requests, or personal information on the Platform. If you are a Creator, your public profile information (including your name, profile image, Instagram handle, Instagram follower count, and other information you choose to include in your profile) is visible to Fans on the Platform. The content of your Creator Content is delivered to the Fan who submitted the corresponding Fan Request. We do not share individual Fan usage data or analytics with Creators. We may provide Creators with aggregated and de-identified information about engagement with their profile or Creator Content.
• Corporate Affiliates. We do not currently have any corporate affiliates. If we establish affiliates in the future, we may disclose your Personal Information to them for purposes consistent with this Privacy Policy, and we will update this Privacy Policy accordingly.
• Third-Party Social Media Platforms. If you link your Account with your social media accounts, you may be asked to give such third-party websites, apps, or services access to information about your Account and/or permission to perform actions within your Account on your behalf. If you choose to take such an action, then we will follow your instructions and grant the access or permission that you have selected.
• Potential Parties to a Corporate Transaction. We may disclose your Personal Information to actual or potential buyers (and their agents and advisors) in connection with any actual or proposed purchase, merger, acquisition, reorganization, financing, bankruptcy, receivership, sale of company assets, or transition of service to another provider. In this event, we will inform the transferee that it must use your Personal Information only for the purposes disclosed in this Privacy Policy.
• Law Enforcement Bodies, Government Agencies, Courts or Other Legal Parties. We may disclose your Personal Information to competent law enforcement bodies, regulators, our insurers, external legal advisors, government agencies, courts, or other third parties where we believe disclosure is necessary: (i) to comply with applicable law; (ii) to exercise, establish, or defend our legal rights; (iii) to protect your rights or vital interests or those or any other person; or (iv) to detect, prevent, or otherwise address security, fraud, or technical issues.

We may share personal information for other purposes with your explicit consent or at your direction. We do not sell personal information to third parties. We do not share personal information for cross-context behavioral advertising or targeted advertising purposes.

We may create and use de-identified or aggregated information for analytics, service improvement, and other lawful purposes. We take reasonable measures to ensure that de- identified information cannot be associated with a particular individual and we maintain information as de-identified and do not attempt to re-identify it, except as permitted by law to test our processes.

4. Other Important Information

a. Your Choices

On our Platform and in your Account, you may make changes to your settings and preferences, including privacy preferences.

You may opt out of marketing at any time in every marketing communication as applicable. Opting out will stop marketing emails and SMS/MMS as applicable. We will process your opt-out request as soon as practicable. If you have an Account, you will continue to receive transactional or service-related emails and texts (if you have opted into receiving texts). You will not be able to opt out of receiving transactional or service-related emails without cancelling your Account.

If you exercise any of these choices, you may be asked to verify your identity, and we reserve the right to deny the request in order to protect against unauthorized access to Personal Information.

b. Registration / Account Information

If you choose to create an Account, you agree to provide and maintain true, accurate, current, and complete information about yourself.

Please note that if you allow others to use your Account, they may be able to view information about your Account, including your profile information, activities, transaction history or payment information.

If you want to deactivate or terminate your Account, you can follow the steps described in the Terms.

c. Your Privacy Rights

Depending on where you live, applicable law may give you some or all of the following rights with respect to your Personal Information. FanNote honors these rights for all users regardless of location, except where a right is specific to a particular jurisdiction's law and noted as such below:

• Right to Know/Access: Request information about our collection, use, and disclosure of your personal information and obtain a copy in a portable format.
• Right to Correct: Request that we correct inaccuracies in your personal information.
• Right to Delete: Request that we delete personal information, subject to legal exceptions.
• Right to Opt Out: Opt out of the sale of your personal information and the sharing or processing of personal information for cross-context behavioral advertising or targeted advertising, as applicable. We will honor opt-out preference signals, such as the Global Privacy Control, as a valid opt-out request where required by applicable law.
• Right to Appeal: Appeal our decision if we decline to act on your request.
• Right of Portability: Request that your personal information is transferred.
• Non-Discrimination: We will not unlawfully discriminate against you for exercising your rights.

You may submit a request by emailing privacy@fannote.io with the subject line “Privacy Rights Request.” We will verify your identity consistent with applicable law before fulfilling a request, which may require you to confirm information associated with your Account. You may designate an authorized agent to make a request on your behalf, subject to verification and authorization requirements. We will respond to verifiable requests within the timeframes required by applicable law. If we decline to act on your request, we will provide a written explanation of our decision. Where applicable law provides a right to appeal, you may appeal by contacting privacy@fannote.io; we will respond to your appeal and inform you of any further recourse available to you, including the right to contact your local data protection authority or state attorney general.

d. Data Retention

We retain each category of Personal Information for no longer than is reasonably necessary and proportionate to achieve the purposes for which the information was collected or processed, as described in this Privacy Policy. We determine retention periods based on the following factors: the minimum data needed to provide and improve the Platform and Services; security and fraud-prevention needs; legal, tax, regulatory, and audit obligations (including, for Creators, retention of tax identification and payout records as required by applicable tax law); contractual obligations; and the resolution of disputes or enforcement of our agreements. Detailed analytics records of individual visits and page views are kept for 180 days and then deleted. We keep daily totals derived from those records, which do not identify you. If you create an Account, we keep a record of how you first arrived at the Platform, such as the Creator whose page brought you here, as part of your Account information. When you permanently delete your Account through the Platform, we will delete or de-identify your Personal Information within a reasonable period, including any linked Instagram account details and associated information. We will retain information only to the extent we are required or permitted by applicable law (for example, tax records, transaction records, or information needed to comply with legal obligations or resolve disputes). We may also retain aggregated or de-identified data that cannot be used to identify you. Upon request, we will provide you with information regarding the specific retention periods applicable to your Personal Information.

e. Children's Privacy

Our Services are not directed to, or intended for, individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from an individual under the age of 18 on our Platform or our Services, we will delete that information as quickly as possible. If you believe that we may have collected any such personal information on our Services, please notify us at privacy@fannote.io.

f. Links to Other Websites

This Privacy Policy applies only to our Platform and to the Services. The Platform may contain links to other websites not operated or controlled by us (the “Third-Party Sites”). The policies and procedures we described here do not apply to the Third-Party Sites. The links from the Services do not imply that FanNote endorses or has reviewed the Third-Party Sites. We suggest contacting those sites directly for information on their privacy policies.

g. Security

We employ administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include access controls, encryption in transit and at rest where appropriate, network and application security, logging and monitoring, personnel training, and vendor due diligence. No security program is perfect; we regularly evaluate and enhance our controls.

h. International Data Transfers

FanNote is based in the United States, and the Personal Information we collect is stored and processed in the United States. If you access the Platform from outside the United States, your Personal Information will be transferred to, stored in, and processed in the United States and potentially other jurisdictions where our service providers operate.

These jurisdictions may have data protection laws that differ from those of your home jurisdiction. By using the Platform, you acknowledge this transfer. Where required by applicable law, we implement appropriate safeguards for cross-border transfers of Personal Information, including: standard contractual clauses approved by the European Commission or the UK Information Commissioner's Office, as applicable; data processing agreements with our service providers that include appropriate technical and organizational security measures; and other transfer mechanisms recognized under applicable law. For more information about the safeguards we use for international transfers, please contact us at privacy@fannote.io.

i. Updates to our Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, Services, or legal requirements. We will post updates with a new effective date and take additional steps where required by law.

5. California Privacy Notice

This section describes how we collect, use, and share the Personal Information of California residents in our capacity as a “business” under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”) and the rights these users may have with respect to their Personal Information.

For purposes of this section, the term 'Personal Information' has the meaning given in the CCPA and does not include information exempted from the scope of the CCPA. This section does not apply to our collection, use, and sharing of personal information of our internal staff.

Categories of Personal Information we collect and disclose: We are a new company and may not have collected all of the categories of personal information as provided in this Privacy Policy. See “What information do we collect” for more information.

Sensitive Personal Information: We do not collect or process sensitive personal information for purposes of inferring characteristics about consumers, and we do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA regulations. For Fans, sensitive personal information may be included in the content of Fan Requests or other user-generated content submitted through the Platform. For Creators, sensitive personal information may include tax identification numbers and government-issued identification provided for compliance purposes. Accordingly, the consumers' “Right to Limit” under the CCPA does not apply to our current practices. If that changes, we will provide a Notice of Right to Limit and honor requests as required by law.

Sales and Sharing: Under the CCPA, 'sales' and 'sharing' are broadly defined, respectively, and include disclosing or making available personal information in exchange for monetary or other valuable consideration or for purposes of cross-context behavioral advertising. We do not sell your personal information or share your personal information as those terms are defined by the CCPA. We also do not have actual knowledge that we sell or share personal information of consumers under 16 years old. If we ever engage in selling or sharing, we will provide the required California notices or process opt-out preference signals in a manner as required by law.

Recordkeeping: We maintain records of consumer requests and our responses as required by law and will implement any additional requirements that become effective under forthcoming California regulations.

Automated Decision-making Technology (ADMT): We do not currently use ADMT to make significant decisions about consumers. If we begin doing so, we will provide a pre-use notice as required by law.

California Shine the Light

A California resident who has provided personal information to a business with whom he/she has established a business relationship for personal, family, or household purposes (“California Customer”) is entitled to request information about whether the business has disclosed personal information to any third parties for the third parties' direct marketing purposes, subject to certain exceptions, as defined in California Civil Code Sec. 1798.83. We do not share Personal Information with third parties for the third parties' direct marketing purposes.

6. Other State Privacy Rights

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Tennessee, Indiana, Iowa, Delaware, and others as they become effective) may have rights similar to those described above. Where these laws impose additional or different requirements, e.g., consent for certain sensitive data, data protection assessments for targeted advertising or profiling, or disclosures about automated decision- making, we will comply and provide state-specific supplements as necessary.

To the extent we process de-identified personal information, we will maintain and use it in a de- identified form and will not attempt to re-identify it unless permitted by applicable law.

7. Canadian Privacy Rights

Residents of Canada may have rights under specific laws including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) applicable provincial legislation, and for residents of Quebec, the Act Respecting the Protection of Personal Information in the Private Sector (“Law 25”).

• Purposes of Collection. We limit our collection of personal information to what is necessary for the purposes identified in the Policy.
• Consent. We obtain consent for the collection, use, and disclosure of your personal information. For sensitive personal information, we will obtain express consent unless an exception under applicable law applies. You may withdraw your consent at any time, subject to legal or contractual restrictions, and upon reasonable notice, by contacting the Privacy Officer. We will review and act all consent withdrawals promptly and inform you of the implications of such withdrawal.
• Specific Rights. In addition to the rights enumerated in Section 4.c , and the rights discussed in this Section 7 , if we use automated decision making systems that produce legal effects or similarly significant effects, we will inform you that such systems are in use, how they made their decision, and allow you to request review of the decision.
• Cross Border Transfers. Your personal information may be stored and processed in the United States or other jurisdictions outside Canada. Where personal information is transferred outside Canada, we implement contractual and other appropriate safeguards to ensure a comparable level of protection. For Quebec residents, we conduct a privacy impact assessment before transferring personal information outside Quebec, assessing risks specific to the destination jurisdiction. A list of jurisdictions where your data may be processed is available upon request by contacting privacy@fannote.io.
• Breach Notification. If there is a breach of our security safeguards involving your personal information that creates a real risk of significant harm, we will, to the extent required by law, report the breach to the appropriate authorities, maintain a register of incidents, and notify individuals regarding the breach and our mitigation efforts.
• Quebec Residents. For residents of Quebec, we require the consent of a parent or tutor for the collection, use, or disclosure of personal information of minors under the age of 14. Additionally, where required by applicable law, we obtain your consent before placing non-essential cookies or similar tracking technologies on your device. FanNote is committed to providing a French-language version of this Privacy Policy for Quebec residents. Until a French-language version is available, Quebec residents may contact privacy@fannote.io to request information about our privacy practices in French.
• Complaints. If you are not satisfied with our response to a privacy inquiry or rights request, you may file a complaint with our Privacy Officer at privacy@fannote.io. We will investigate and respond to your complaint. You may also escalate your complaint to:
  • The Office of the Privacy Commissioner of Canada (www.priv.gc.ca)
  • For Quebec residents, the Commission d'accès à l'information (www.cai.gouv.qc.ca)

8. EEA, UK, And Swiss Privacy Rights

This section applies to individuals in the European Economic Area (“EEA”), United Kingdom (“UK”), and Switzerland. In this section, references to “personal data” have the meaning given in the EU General Data Protection Regulation (“GDPR”) or the UK GDPR, as applicable.

a. Data Controller

Where FanNote, Inc. is the controller of your personal data. You may contact us at privacy@fannote.io.

b. Lawful Bases for Processing

We process your personal data on the following lawful bases:

• Performance of a contract: To create and maintain your Account, process transactions, deliver Fan Requests and Creator Content, verify Creator identity and authenticity (including through required Instagram account linking), and provide the Services you have requested.
• Legitimate interests: To operate, maintain, and improve the Platform and Services, to ensure security and prevent fraud, to conduct first-party analytics as described in Section 1.d, including at the level of individual visits, and on an aggregated or de-identified basis, to enforce our Terms, and to communicate with you about your Account and the Services. Our legitimate interests do not override your fundamental rights and freedoms.
• Legal obligation: To comply with applicable laws, regulations, and legal processes, including tax reporting and identity verification requirements for Creators.
• Consent: Where we process personal data based on your consent (for example, for non-essential cookies where applicable, or for optional marketing communications), you may withdraw your consent at any time by contacting privacy@fannote.io or by using the opt-out mechanism provided. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

c. Your Rights

In addition to the rights described in Section 4(c), you may have the following rights under applicable EEA, UK, or Swiss law:

• Right to restrict processing: Request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to our processing.
• Right to object: Object to our processing of your personal data based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
• Right to data portability: Request a copy of the personal data you provided to us in a structured, commonly used, and machine-readable format, and request that we transmit it to another controller where technically feasible.
• Right to lodge a complaint: You have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. For the UK, you may contact the Information Commissioner's Office at https://ico.org.uk.

d. International Transfers

Your personal data is transferred to and processed in the United States as described in Section 4(h) (International Data Transfers). Where required, we rely on Standard Contractual Clauses approved by the European Commission (or the UK ICO's International Data Transfer Agreement, as applicable) as the legal mechanism for such transfers. You may request a copy of the applicable transfer safeguards by contacting privacy@fannote.io.

e. Automated Decision-Making

We do not currently use automated decision- making, including profiling, that produces legal effects or similarly significant effects concerning you. If we begin doing so, we will provide notice and, where required, obtain your consent or provide a mechanism to request human review.

f. Data Protection Officer

FanNote has not yet appointed a Data Protection Officer. For all data protection inquiries, please contact privacy@fannote.io.

9. Other Country Privacy Rights

Residents of countries other than the United States, Canada, or the EEA/UK/Switzerland may have additional or different rights under their local laws. FanNote is committed to honoring applicable data protection rights wherever you are located. If you believe you have a right under your local law that is not addressed in this Privacy Policy, please contact us at privacy@fannote.io and we will work to address your request.

10. Contact Us

For privacy-related questions, requests, or complaints, please contact us:

Email: privacy@fannote.io

For privacy rights requests, please email privacy@fannote.io with the subject line “Privacy Rights Request.”

Response Time: We will acknowledge receipt of your inquiry within 5 business days and provide a substantive response within the timeframe required by applicable law (for example, 45 days under the CCPA, or 30 days under the GDPR, subject to permitted extensions).

If you are not satisfied with our response, you may have the right to escalate your complaint to your local data protection authority, state attorney general, or other supervisory body, as described in the jurisdiction-specific sections above.