Effective Date: 02/18/2026
Last Revised: 02/18/2026

PLEASE READ THE FOLLOWING CAREFULLY.

UpTo Inc. (DBA Ketchup) ("Company," "We," "Us," or "Our") operates the Ketchup mobile application, website, and related online services (collectively, the "Platform"). This Privacy Policy explains how We collect, use, share, and protect information about You when You access or use the Platform or Our Services. By using the Platform, You acknowledge and consent to the practices described in this Privacy Policy. This Privacy Policy is incorporated into the Platform's Terms of Use, the Refund & Rental Access Policy, the Supplemental Video Streaming Terms, and the Content Provider Upload & Content License Agreement.

1. Definitions & Scope

For purposes of this Privacy Policy:

1. a. "Platform" means the mobile application, website and related technology.
2. b. "Services" means the Platform, and all associated products, features, interfaces and tools.
3. c. "Event Organizer" means any individual, business, or entity using the Services to create, host, promote, or manage events or related content through the Platform.
4. d. "Individual User" means any person using the Services to browse, register for, or attend events, or to engage in networking, social, or dating activities through the Platform.
5. e. "Content Provider" means any creator or licensor who uploads or licenses streaming or rental video content to the Platform.
6. f. "Viewer" means any Individual User who rents, purchases, streams, or otherwise accesses video or audiovisual content through the Platform.
7. g. "Account Holder" collectively refers to all users of the Platform in any capacity.
8. h. "Personal Information" means any information that identifies, relates to, describes, or could reasonably be associated with an individual or household, as defined under applicable law (including CCPA/CPRA §1798.140).

This Privacy Policy applies to all Personal Information collected through the Platform or in connection with any Service We provide. When You access a third-party service through the Platform, that third party's privacy policy governs Your interactions with that party.

2. Role of Ketchup vs. Event Organizers & Content Providers

We may act as a data controller or data processor/service provider depending on how information is collected.

1. a. Ketchup as Data Controller. We act as a data controller when We collect or process Personal Information directly for Our own purposes, e.g.,
   1. i. Creating or managing user accounts;
   2. ii. Processing subscriptions/memberships;
   3. iii. Operating the Platform interface;
   4. iv. Enforcing Our Terms;
   5. v. Fulfilling streaming rentals;
   6. vi. Security, fraud prevention and analytics.

   For each of the above, We protect Your personal information in accordance with this Privacy Policy.

2. b. Ketchup as Data Processor/Service Provider. Event Organizers and Content Providers may collect or access Personal Information through the Platform when managing Events or distributing Content. A clear distinction applies depending on where the data is handled:
   1. i. Data Inside the Platform (Company-Controlled Processing). While attendee, participant, or Viewer Personal Information remains within the Platform environment, the Company acts as a service provider/data processor on behalf of the applicable Event Organizer or Content Provider. In this role, We:
      1. 1. Process Personal Information solely to provide Platform functions such as registration, ticketing, communications, access control, streaming, rights-protection, and fraud prevention;
      2. 2. Do not use such information for Our own independent marketing or advertising; and
      3. 3. Retain such information only for as long as necessary to deliver the Services or comply with legal or accounting obligations.
   2. ii. Data Outside the Platform (Organizer/Provider-Controlled Processing). Once an Event Organizer or Content Provider exports, downloads, or otherwise processes Personal Information outside the Platform, they become the independent data controller for that information. Their own privacy policies and legal obligations govern all subsequent: collection, use, storage, disclosure, retention, security measures. Ketchup does not supervise or control how Event Organizers or Content Providers handle Personal Information once it leaves the Platform environment.
   3. iii. Unauthorized Export. Any export or download of Personal Information must comply with the Platform's Terms of Use, the Content Upload & License Agreement, and any other applicable agreements. Unauthorized export, scraping, screen-grabs, or other non-permitted extraction constitutes a violation of those terms.

3. Information We Collect

We collect the following categories of information from and about individuals who interact with the Company or use any aspect of the Services—including visitors to Our website, users of the Platform, and any person who communicates with Us or accesses Our content or features. Information may be collected directly from You, automatically through Your device or interaction with the Services, or from third-party sources as described below.

1. a. Information You Provide
   1. i. Registration & Account Data. When You create an account, or otherwise sign up to use the Services, We collect identifying and contact information such as Your name, email address, phone number, date of birth, gender, location, and any other information required to verify Your identity or enable core Platform functions.
   2. ii. Profile Content. We collect information you choose to include in Your profile, such as photos, bios, professional or creative descriptions, interests, preferences, social links, and any other details You add to personalize Your account.
   3. iii. Communications & Interactions. We collect and process information contained via Your use of the Platform, including: messages You send through the Platform, event RSVPs, inquiries, support requests, and feedback; and any other correspondence You initiate with Company or other users.
   4. iv. Information From Third-Party Sources. We may receive information about You from third parties—including payment processors, financial institutions, verification vendors, analytics providers, and optional social-media or single-sign-on integrations. We may combine this information with other data We maintain to operate the Platform securely and effectively.
   5. v. Event Registrations, Ticket Purchases & Attendee Data. When you register for an Event, purchase a ticket, or access streaming content through the Platform, we collect the information necessary to complete the transaction (such as contact details and payment information). Event Organizers and Content Providers may request additional information through customized forms, and we process that information within the Platform as described in this Privacy Policy. For Events or content accessed through external systems ("Externally-Processed"), the Event Organizer or Content Provider is responsible for its own data-collection and privacy practices. We generally receive only limited metadata—such as confirmation of registration, purchase, or access.
   6. vi. Event Organizer & Content Provider Information. If You are an Event Organizer, Content Provider, or other professional partner, We collect certain information necessary to operate the Platform and deliver the Services. This may include:
      1. 1. Payout and financial details (such as bank-account information, taxpayer identification numbers, or payment-processing credentials);
      2. 2. Content-related information (such as licensing documentation, rights-clearance confirmations, and distribution permissions);
      3. 3. Identity-verification and fraud-prevention information (such as IDs, business records, or verification results); and
      4. 4. Operational information related to Your Events or Content (such as scheduling, metadata, or workflow preferences).

      We collect and use this information solely to provide Platform services such as payouts, verification, rights-management, compliance, and anti-fraud measures. Once an Event Organizer or Content Provider independently exports, downloads, or processes attendee, participant, or viewer data outside the Platform, they act as the independent data controller for that data. Their own privacy policies and legal obligations—not this Privacy Policy—govern how they use or disclose information they manage outside the Platform.

   7. vii. Business, Partnership & Sponsorship Communications. If you interact with Company as a potential partner, sponsor, collaborator, or professional contact, We collect business or professional information such as Your name, title, organization, email, and phone number. With advance notice and Your consent, We may record certain calls for training or quality-assurance purposes.
   8. viii. Employment Applications. If You apply for a job with Company, We collect application materials, such as résumés, cover letters, references, portfolios, and any related communications.
2. b. Information We Collect Automatically. We automatically collect certain information from all individuals who interact with the Platform or Services—including Individual Users, Viewers, Event Organizers, Content Providers, partners, and visitors to Our website or app. This information helps Us operate, secure, and improve the Platform.
   1. i. Device Information. Internet Protocol (IP) address, operating system, device ID, and browser type.
   2. ii. Usage Data. Log files, clickstream information, pages viewed, features used, and interaction timestamps.
   3. iii. Location Data. Approximate or precise location information, depending on Your device and settings.
   4. iv. Cookies and Similar Technologies. Cookies, pixels, SDKs, beacons, local storage objects, session identifiers, and analytics tags used to operate the Platform, maintain security, personalize content, measure engagement, and improve the Service.
3. c. Information from Third Parties. We may receive information about You from third parties, including:
   1. i. Other Account Holders, such as Event Organizers, Content Providers, other individual users or viewers, business partners, or service providers, e.g., ticketing systems, payment processors, verification vendors, payout providers, production partners, or collaborators.
   2. ii. Hosting providers, analytics vendors, customer-support tools, fraud-prevention services, and identity-verification partners.
   3. iii. Social-media platforms or single sign-on services—if You choose to link or authenticate Your account through a social-media platform or SSO provider, We may receive profile information or verification data from that platform.
   4. iv. Publicly available sources and business databases used for identity verification, fraud prevention, or analytics.
4. d. Retention & Combination of Information. We retain Personal Information only as long as necessary to fulfill the purposes described above, comply with Our legal obligations, and resolve disputes. Information collected from multiple sources may be combined to verify identity, maintain account integrity, prevent fraud, and improve Platform security.

4. Sensitive Personal Information

Some of the information You provide or that We collect may qualify as "Sensitive Personal Information" under applicable privacy laws. This may include, for example, details about Your gender identity, sexual orientation, health or accessibility needs, payment card details, or precise geolocation.

1. a. We do not use or disclose Sensitive Personal Information for any purpose beyond what is necessary to operate the Platform, process payments, verify identity, ensure safety, or comply with law.
2. b. We do not use or disclose such information for targeted advertising, profiling, or cross-context behavioral marketing without Your explicit consent.
3. c. If You provide Sensitive Personal Information to an Event Organizer or Content Provider through the Platform (for example, when completing a customized event registration form), the Event Organizer or Content Provider is responsible for obtaining any necessary consent and for processing that information in accordance with their own privacy policy.
4. d. When Event Organizers or Content Providers collect or access Personal Information within the Platform environment, their use of that data is governed by the Company's Terms of Use, the Upload & Content License Agreement, and applicable privacy and communications laws. Any data they collect or process using Platform tools must be handled in accordance with those Agreements and this Privacy Policy insofar as it describes the Company's processing of that data. When Event Organizers or Content Providers export or download attendee, participant, or Viewer information using the Platform's authorized tools or settings, they become the independent data controller for that exported information. Their own privacy policy and legal obligations govern all subsequent collection, use, storage, and disclosure of the exported data. Personal Information obtained, copied, scraped, captured, or exported in any manner not authorized by the Platform—including circumvention of access controls, scraping tools, or misuse of attendee or Viewer information—does not make the Event Organizer or Content Provider an independent data controller. Such activity constitutes a violation of the Terms of Use, the Content Provider Upload & License Agreement, and any other applicable agreements. The Company retains all enforcement rights and may take action as permitted under those agreements and applicable law.

5. How We Use Information

1. a. General Use. We use Personal Information to provide, maintain, and improve Our Services, operate the Platform, and protect the integrity and safety of Our community. This includes all individuals who interact with the Platform—such as Individual Users, Viewers, Event Organizers, Content Providers, partners, and visitors. Our specific purposes include:
   1. i. To provide, operate, and improve the Platform, including hosting, matchmaking, event management, streaming and rental functionality, content-delivery features, and safety tools.
   2. ii. To create, verify, and manage Your account and profile, including identity verification, credential management, and maintaining accurate contact information.
   3. iii. To process payments and financial transactions, including ticket purchases, rental or streaming payments, subscription billing, and remitting payouts to Event Organizers and Content Providers through third-party payment processors.
   4. iv. To facilitate interactions between users, including connecting You with Event Organizers, Content Providers, Viewers, or other users through listings, recommendations, invitations, or communications necessary to operate Events or access Content.
   5. v. To personalize the Platform experience, including recommending matches, events, or streamed content based on Your profile, preferences, prior interactions, and Platform activity. These recommendations do not involve automated legal, financial, or eligibility determinations.
   6. vi. To communicate with You, including service messages, confirmations, transactional notices, policy updates, alerts, and marketing communications (subject to Your opt-out or preference settings).
   7. vii. To provide customer support and respond to questions, troubleshooting requests, feedback, or technical issues from any category of user.
   8. viii. To use de-identified or aggregated information for analytics, research, development, testing, and other internal business purposes, including improving Platform performance and safety.
   9. ix. To detect, prevent, and address fraud, unauthorized access, abuse, spam, piracy, or security threats, and to protect the safety and integrity of all users, Content Providers, Event Organizers, and the Platform environment.
   10. x. To comply with legal obligations and to enforce Our Terms & Conditions, Content Provider Upload Agreement, Refund & Rental Access Policy, and other applicable policies, including investigating potential violations and resolving disputes.
2. b. Processing on Behalf of Event Organizers & Content Providers. When the Platform provides registration, ticketing, event-management, streaming, rental, or payment-processing functionality, We act solely as a service provider/data processor on behalf of the applicable Event Organizer or Content Provider. In these situations, attendee, participant, and Viewer information is processed only as necessary to deliver the specific Platform services—such as registration and ticketing workflows, communication tools, payment processing, access control, streaming delivery, and security or fraud-prevention measures. We do not use this information for Our own independent marketing or advertising. Our use of such data is limited to essential operational purposes that are permitted under applicable law, including maintaining the Platform, protecting security, and preventing fraud, abuse, or misuse. Our role, and the responsibilities of Event Organizers and Content Providers when Personal Information remains inside the Platform or is exported outside it, are described in Section 2(b).
3. c. Event Organizer & Content Provider Use of Data. Event Organizers and Content Providers may access attendee, participant, or Viewer information through the Platform when managing their Events or distributing Content. Their obligations when handling Personal Information inside the Platform—and their independent responsibilities once data is exported—are described in Section 2(b).
4. d. Automated Decision-Making & Personalization. We do not use automated decision-making, including profiling, to make legal, financial, or eligibility determinations about You (for example, creditworthiness or access to services). Any personalization or recommendation features we use are limited to suggesting events, matches, Content, or other Platform features based on your activity or preferences. These features do not involve automated decision-making that produces legal or similarly significant effects. Personalization settings may be adjusted or opted out of through your account preferences, where available.

6. Legal Bases for Processing (International Users)

If You reside in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with similar data-protection laws, We process Your Personal Information only when We have a valid legal basis to do so under applicable law. These legal bases include:

1. a. Consent - for example, when You opt in to receive marketing communications or allow use of optional cookies.
2. b. Contract Necessity – when processing is required to perform Our agreement with You, such as providing access to the Platform, processing payments, or facilitating Events, or enabling streaming or rentals.
3. c. Legal Obligations – when processing is necessary to comply with laws, regulations, audit obligations, or court orders.
4. d. Legitimate Interests – when processing is necessary to operate, improve, and secure our Services, prevent fraud, or protect safety and integrity, provided such interests are not overridden by Your fundamental rights and freedoms.

When We process Personal Information on behalf of an Event Organizer or Content Provider (for example, attendee information submitted for a Platform-Processed Event or Viewer data required to enable access to Content), the Event Organizer or Content Provider is the party that determines the lawful reason—i.e., "legal basis" under GDPR—for why that information is being collected and used. We simply process the information on their instructions as their service provider/data processor, consistent with Our Terms & Conditions and this Privacy Policy.

7. How We Share Information

We may share Personal Information as described below, consistent with this Privacy Policy and Our Terms & Conditions.

1. a. With Other Users – Information in Your profile (such as name, photo, and interests) will be visible to other users. Messages You send are shared with their intended recipients.
2. b. With Event Organizers or Content Providers.
   1. i. Platform-Processed Events – When You RSVP, register, or purchase tickets for a Platform-Processed Event, or when You rent, purchase, or access streaming video content, We share only the information necessary to facilitate the relevant transaction—such as Your name, contact details, ticket or access status, and any Event- or Content-specific information You choose to provide—with the applicable Event Organizer or Content Provider. This allows them to manage Event access, communications, safety measures, licensed-content requirements, rights-management, and other operational needs. We process such data solely on behalf of the Organizer or Content Provider and only as required to deliver Platform services; We do not share attendee or Viewer information with Organizers or Content Providers for their independent marketing or advertising.
   2. ii. Externally-Processed Events – When You register for an event where registration or payment occurs through a third-party system, We may receive or transmit only limited metadata (such as purchase confirmation or attendance status), and the Event Organizer's own privacy policy governs their use of attendee data. Event Organizers and Content Providers may not disclose or use attendee, participant, or Viewer information for any purpose other than operating their Events, managing licensed Content, or as otherwise permitted under their own lawful privacy policy and applicable law.
3. c. With Affiliates – We may share information with Our affiliates and subsidiaries for operational, security, or analytical purposes consistent with this Policy.
4. d. With Service Providers & Vendors - We share data with trusted third-party service providers who assist in operating the Platform, including payment processors, hosting services, cloud infrastructure, analytics providers, communications vendors, and customer-support partners. Each provider is bound by contractual confidentiality and data-protection obligations and may use Personal Information only as necessary to perform services on Our behalf.
5. e. With Advertising & Marketing Partners – If We engage advertising or marketing partners, they may receive limited usage or cookie data for analytics or to deliver promotional messages. We do not permit these partners to access Sensitive Personal Information or use attendee data collected on behalf of Event Organizers for targeted or cross-context behavioral advertising.
6. f. Legal Requirements & Law Enforcement – We may access, preserve, or disclose Personal Information when We reasonably believe it is necessary to:
   1. i. Comply with laws, regulations, valid legal processes, or government requests;
   2. ii. Respond to Your requests or exercised rights;
   3. iii. Enforce Our Terms & Policies;
   4. iv. Protect the rights, property, or safety of You, Us, other users, or the public; or
   5. v. Detect, prevent, and address fraud, security, or technical issues.

   Where legally permitted, We will provide reasonable notice before disclosing your information so that You may seek legal remedies.

7. g. Business Transfers – We may disclose information as part of a merger, acquisition, financing, reorganization, or sale of assets. Any successor entity will assume the rights and obligations described in this Policy.
8. h. With Your Consent or Direction – We share information when You specifically authorize or direct Us to do so (for example, when connecting Your account to an integrated third-party app).
9. i. No Sale or Cross-Context Sharing – We do not sell Personal Information. Certain state privacy laws, including the California Privacy Rights Act ("CPRA"), define "sharing" as disclosing Personal Information for cross-context behavioral or targeted advertising. We do not engage in this type of sharing. If Our practices change, We will update this Policy and provide any required opt-out rights.

8. Your Rights & Choices

We respect the privacy rights of all Account Holders. Depending on where You live, You may have additional rights described below.

1. a. Profile Settings – You can update, correct, or delete information in Your account at any time through Your account settings.
2. b. Location Services – You may disable location sharing via Your device settings. Disabling location access may limit certain Platform features.
3. c. Marketing Communications – You may opt out of promotional or marketing emails by following the unsubscribe instructions included in those communications. You will continue to receive transactional or service-related messages necessary to operate Your account or Events.
4. d. Cookies & Tracking Technologies – You can adjust Your browser or device settings to refuse cookies or similar technologies. Some portions of the Platform may not function properly without them.
5. e. Access, Correction & Deletion Requests – You may request access to, correction of, or deletion of Your Personal Information at any time by contacting Us at legal@wannaketchup.com. We will verify your identity and respond within the timeframe required by applicable law (for example, 45 days under the CCPA/CPRA). If the information You request relates to data that an Event Organizer or Content Provider controls—for example, attendee details for an Event or data the Content Provider manages independently—We may forward or redirect Your request to the appropriate party, who will respond as the data controller. If You act both as an Individual User or Viewer and an Event Organizer or Content Provider, certain data You control as an Event Organizer or Content Provider may be retained as required for operations or compliance, even if You delete Your individual user account. Whether the Company or an Event Organizer/Content Provider is responsible for responding to a request depends on the division of roles described in Section 2(b).
6. f. Targeted Advertising & Profiling Opt-Out – Depending on Your jurisdiction, You may have the right to opt out of Our processing of Your Personal Information for targeted advertising, profiling, or cross-context behavioral purposes. We do not currently sell or "share" Personal Information for cross-context behavioral advertising as defined under CCPA/CPRA. If this changes, We will provide clear notice and an opt-out mechanism as required by law.
7. g. Event Organizer & Content Provider Responsibilities for Attendee & Viewer Rights – Event Organizers and Content Providers are expected to honor privacy-rights requests submitted by attendees or Viewers whose data they collect through the Platform, including requests for access, correction, deletion, or opt-out. When processing such data outside the Platform (for example, exported attendee lists), each Event Organizer or Content Provider remains responsible for complying with its own privacy policy and all applicable data-protection laws.
8. h. Appeal Rights – If You are a resident of California, Virginia, Colorado, or another state granting a statutory right to appeal, and You believe We have denied a privacy request in error, You may appeal Our decision by contacting Us at legal@wannaketchup.com. If Your appeal is denied, You may also contact Your state's Attorney General as permitted by law.
9. i. Additional State Privacy Rights (U.S. Residents) – Residents of certain U.S. states—including California, Virginia, Colorado, Connecticut, and Utah—may have additional rights under their respective state laws. These may include the ability to:
   1. i. Know what Personal Information We collect and how We use or disclose it;
   2. ii. Request access to, correction of, or deletion of Your Personal Information; and
   3. iii. Opt out of certain data uses or disclosures, such as targeted advertising or profiling.

   To exercise these rights, contact Us at legal@wannaketchup.com or follow the procedures outlined in this Policy. We will verify Your identity and respond within the timeframe required by law.

10. j. Additional Rights for International Users (EEA, UK, & Similar Jurisdictions) – If You reside in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with similar data-protection laws, You may have additional rights regarding Your Personal Information. These may include the right to:
    1. i. Request the transfer (data portability) of Your Personal Information to another controller;
    2. ii. Restrict or object to certain types of processing, including processing for direct marketing;
    3. iii. Withdraw consent where processing is based on Your consent; and
    4. iv. Lodge a complaint with a supervisory authority or data-protection regulator in Your jurisdiction.

    To exercise these rights, contact Us at legal@wannaketchup.com. We will respond in accordance with applicable law.

11. k. Non-Discrimination & Non-Retaliation – We will not discriminate or retaliate against You for exercising Your privacy rights.

9. Data Retention & Deletion

We retain Personal Information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy—including providing Services, complying with legal obligations, resolving disputes, and enforcing agreements—or as otherwise required by applicable law.

1. a. General Retention Examples:
   1. i. Account Data – Retained while Your account remains active or as needed to provide Services.
   2. ii. Transaction & Payment Records – Retained for the period required by tax, accounting, and financial-compliance laws.
   3. iii. Marketing Preferences – Retained until You opt out or request deletion.
2. b. Event Organizer & Content Provider Attendee & Viewer Data
   1. i. Platform-Processed Data (Inside the Platform). For Events or Content delivered through the Platform, We retain attendee or Viewer information collected within the Platform environment only as long as necessary to provide Services on behalf of the applicable Event Organizer or Content Provider, or as required by law (such as for fraud prevention, security, or accounting purposes). While data remains inside the Platform, it is processed under this Privacy Policy and handled in accordance with the "Inside Platform vs. Outside Platform" rules described in Section 2(b).
   2. ii. Organizer/Provider-Controlled Data (Outside the Platform). Once an Event Organizer or Content Provider exports, downloads, or otherwise processes Personal Information outside the Platform, their handling of that data is governed by their own privacy policies and legal obligations. As noted in Section 2(b), they act as the independent data controller for any Personal Information outside the Platform, and We do not supervise or control their subsequent processing.
   3. iii. Data Retention by Event Organizers & Content Providers. Event Organizers and Content Providers are expected to retain attendee or Viewer information only as long as necessary for legitimate event- or content-related purposes and to delete or anonymize such information when no longer required, consistent with the framework described in Section 2(b) and applicable law.
   4. iv. Deletion Requests – You may request deletion of Your account or Personal Information at any time by contacting legal@wannaketchup.com. Upon verified request, We will delete or de-identify Your Personal Information unless retention is necessary to:
      1. 1. Complete a transaction or fulfill a contractual obligation;
      2. 2. Detect or protect against fraudulent or illegal activity;
      3. 3. Comply with legal or regulatory requirements; or
      4. 4. Maintain system integrity and security logs.

   Where Event Organizers or Content Providers act as the data controller (for example, for data collected outside the Platform), deletion requests should be directed to the respective Party.

3. c. Backups & Security Copies – Archived or backup copies of Personal Information may be retained temporarily for business continuity, legal, or technical reasons. Once expired, those backups are purged or overwritten according to our standard data-lifecycle management schedule.

10. Security

1. a. Data Security Measures. We maintain a combination of administrative, technical, and physical safeguards intended to help protect Personal Information from unauthorized access, loss, misuse, or alteration. These measures may include encryption, access controls, monitoring, and other practices appropriate to the type and sensitivity of the data we handle. While we work to protect the information we collect and store, no system can guarantee complete security. We therefore cannot promise absolute protection against unauthorized access or data incidents. Event Organizers and Content Providers are independently responsible for safeguarding any attendee, participant, or Viewer Personal Information that Event Organizers and Content Providers are authorized to export, download or otherwise process per the Platform's Terms of Use and related agreements and policies. Once data leaves the Platform environment, their own privacy policies, security practices, and legal obligations apply, and We do not supervise or control how they protect or use that information. If a data incident occurs that affects your Personal Information, we will provide notice to you and any required regulators in accordance with applicable law. Additional details regarding Organizer and Content Provider responsibilities for data used within or outside the Platform are outlined in Section 2(b).
2. b. Security Breach Notification. While We use commercially reasonable measures to safeguard Personal Information, no method of transmission or storage is completely secure, and We cannot guarantee absolute protection. If We discover or are notified of a data breach or unauthorized access that compromises the security or confidentiality of Your Personal Information, We will notify You and any applicable regulators in accordance with applicable law. Notification may occur by email, in-app message, push notification, or other lawful means. We may delay notice if law enforcement determines that immediate disclosure would impede an investigation or jeopardize national security. When a breach involves a third-party service provider (for example, a payment processor, hosting vendor, or analytics partner), We will coordinate with that provider to ensure affected users receive legally required notice consistent with contractual obligations and applicable law. If an Event Organizer or Content Provider exports, downloads, or otherwise processes attendee or viewer data outside the Platform, they are responsible for managing the security of that data and for providing any legally required notifications to affected individuals or regulators in the event of a breach. We ask that Organizers and Content Providers also notify Us as soon as reasonably possible—ideally within 72 hours—so that we can assess any potential impact on the Platform and comply with our own legal, operational, or contractual responsibilities. Event Organizer and Content Provider incident-response responsibilities for Platform data versus exported data follow the distinctions described in Section 2(b).

11. Cookies & Tracking Technologies

We use cookies, pixel tags, local storage, and similar technologies ("Cookies") to help operate, secure, and improve the Platform; analyze usage; personalize content; and support limited advertising or promotional functions. Some of these technologies are essential for the Platform to function properly, while others are optional and used to improve performance and user experience. We use cookies and similar technologies only for essential and functional purposes—such as operating the Platform, maintaining security, and measuring usage. We do not sell or share Personal Information as those terms are defined under applicable privacy laws. If Our practices change, We will update this Policy and provide any required opt-out options. You can manage Your cookie preferences at any time through Your browser or device settings, via in-app privacy controls (where available), or by following the opt-out instructions provided in the "Your Rights & Choices" section of this Policy. Where legally required, We provide a cookie banner or consent-management tool to allow You to accept, reject, or adjust Your cookie settings. We use third-party analytics and service providers (such as hosting, performance monitoring, and marketing partners) to help Us understand how users interact with the Platform. These providers may use their own cookies or tracking technologies in connection with their services, subject to their own privacy policies. If You are an Event Organizer or Content Provider and use Platform tools that deploy cookies or tracking technologies (for example, email-open pixels, analytics tags, or retargeting pixels), You are responsible for ensuring that Your use of such tools complies with all applicable privacy and communications laws—including any consent or disclosure requirements under the CPRA, GDPR, ePrivacy Directive, or similar laws—and for honoring attendee privacy preferences.

12. Privacy of Minors

The Services are not intended for individuals under the age of 18 (or the age of majority in their jurisdiction, if higher). We do not knowingly collect, solicit, or process Personal Information from anyone under 18. If We become aware that We have inadvertently collected Personal Information from a minor, We will delete it as soon as reasonably practicable unless We are legally required to retain it. If You are a parent or guardian and believe Your child has provided Personal Information to Us, You may contact Us at legal@wannaketchup.com, and We will take appropriate steps to verify and delete that information in accordance with applicable law. Event Organizers may not create, advertise, or operate Events directed at or primarily intended for individuals under 18 through the Platform, and may not knowingly collect or process data from minors. Event Organizers and Content Providers are solely responsible for ensuring that any event content, streaming or related Content, registration forms, or data-collection practices comply with applicable child-protection and data-privacy laws, including the U.S. Children's Online Privacy Protection Act (COPPA) and the EU General Data Protection Regulation (GDPR) provisions on minors' consent.

13. Third-Party Links & Services

The Platform may contain links to or integrate with third-party websites, services, or applications that are not operated or controlled by Us. These may include, for example, ticketing or payment providers, social-media integrations, analytics services, or Event Organizer or Content Provider websites. We are not responsible for the privacy, security, or data-collection practices of any third-party websites or services. Your interactions with those third parties—including any Personal Information You provide to them—are governed by their own privacy policies and terms of service. If You participate in an Externally-Processed Event or otherwise engage with an Event Organizer's or Content Provider's external website, that party's privacy policy will govern how Your information is used and protected. We encourage You to review the privacy policies of all third-party services You access through the Platform. The inclusion of any third-party link, integration, or service on Our Platform does not imply endorsement or affiliation by the Company.

14. International Data Transfers & Safeguards

The Services are operated and hosted in the United States. If You access the Services from outside the United States, Your Personal Information may be transferred to, stored, and processed in the United States or other countries that may not provide the same level of data protection as Your home jurisdiction. Where required by law, we use approved safeguards—such as Standard Contractual Clauses adopted by the European Commission or the UK International Data Transfer Addendum, or reliance on an adequacy decision—to lawfully transfer Personal Information across borders. If You are an Event Organizer or Content Provider, You are responsible for ensuring that any cross-border transfer or processing of attendee data You export or manage outside the Platform complies with all applicable data-transfer laws and contractual commitments. By using the Services or providing information to Us, You acknowledge that Your information will be transferred to and processed in the United States (and any other country where We or Our service providers operate) in accordance with this Privacy Policy and applicable law.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in Our practices, technology, legal requirements, or for other operational reasons. When we do, We will update the "Last Updated" date at the top of this Policy. If We make material changes, We will provide additional notice—such as by email, in-app message, or a prominent notice on the Platform—before the changes take effect, as required by law. The updated Policy will become effective on the date posted unless otherwise stated. By continuing to use the Services after the effective date, You acknowledge and agree to the revised Policy. Event Organizers and Content Providers are responsible for reviewing and complying with the most current version of this Policy before creating or managing new Events or streaming new Content.

16. Contact Us

If You have questions or concerns about this Privacy Policy or Our practices, You can contact Us at:

If You are located in the EEA or UK, You may also contact Our Data Protection Officer (DPO) at legal@wannaketchup.com.