Politique de confidentialité (États-Unis)

Ce que KeepWorthy recueille, pourquoi, à qui nous le communiquons et le contrôle que vous exercez.

Ce document n'est offert qu'en anglais pour le moment. La version française est en préparation.

1. INTRODUCTION

KeepWorthy Inc. ("KeepWorthy," "we," "us," or "our") is committed to protecting the privacy of individuals who access and use our Platform in the United States. This Privacy Policy describes how we collect, use, disclose, and protect personal information about users of the KeepWorthy website, mobile application, and related services (collectively, the "Platform") who are located in the United States.

This Privacy Policy applies exclusively to users of the Platform who are located in the United States. Users in Canada are subject to a separate Privacy Policy that reflects the requirements of the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable Canadian provincial privacy laws.

By creating an account on the Platform, you acknowledge that you have read and understood this Privacy Policy. Our collection, use, and disclosure of your personal information is governed by the practices described in this Privacy Policy and by applicable law. If you do not agree with this Privacy Policy, please do not create an account or use the Platform.

2. WHO WE ARE AND HOW TO CONTACT US

KeepWorthy Inc. is the controller of personal information collected through the Platform. Our Privacy Officer is responsible for overseeing compliance with this Privacy Policy and applicable privacy laws.

Email: privacy@getkeepworthy.com

Mailing address: KeepWorthy Inc., 350 Bay Street, Suite 1300B, Toronto, Ontario M5H 2S6, Canada.

If you have questions about this Privacy Policy or our privacy practices, or if you wish to exercise your rights under applicable law, please contact our Privacy Officer at privacy@getkeepworthy.com.

3. PERSONAL INFORMATION WE COLLECT

We collect personal information from and about you in the following ways:

3.1 Information You Provide Directly

We collect information you provide when creating an account, including your username, email address, password, country and state of residence, confirmation that you meet the applicable minimum age, and acceptance of our Terms of Service and Privacy Policy. We do not request your legal name or date of birth. If you subscribe, the payment provider may collect your name and billing address. We also collect product post information and photos, ratings, collections, attached stores and source links, social interactions, and information you provide when subscribing, reporting content, contacting support or making a privacy request. If you send feedback and choose to include diagnostics, we also collect your device model, operating system version, app version and recent app usage logs with that feedback.

3.2 Information We Collect Automatically

When you access or use the Platform, we automatically collect certain information, including: device identifiers and technical information (such as IP address, browser type, operating system, and device type); usage data (such as pages viewed, features used, time spent on the Platform, links clicked, and referring URLs); log data (such as access times and error logs); and location information derived from your IP address.

With your permission, we use your device’s precise foreground location to rank nearby products and suggest stores. Precise geolocation is sensitive personal information under certain state privacy laws. We explain its use before requesting permission, and you may withdraw permission in your device settings. Current coordinates are used for the request and are not stored by KeepWorthy as location history. Store-search text and, with your permission, your precise location at that moment are sent from your device to Google Maps Platform to provide store suggestions. Google's use of this information is governed by the Google Privacy Policy (https://policies.google.com/privacy). Store information you attach to a post is stored with that post. With your permission, the app accesses your camera or photo library so that you can add product photos and a profile picture. We receive only the photos you choose.

We also record product views and edit history and derive interest information to personalize recommendations. Mobile product analytics is off unless you opt in, and you can change your choice in Settings. With analytics consent, we also collect anonymous search totals. If you enable push notifications, we process device push tokens and notification contents to deliver them.

3.3 Cookies and Similar Technologies

We use cookies and similar technologies to operate the website, remember preferences and understand how it is used. Non-essential website analytics remain off until you accept them through our cookie banner. You can change your choice using the Cookie Preferences link or manage cookies through your browser settings. Blocking necessary cookies may affect website functionality. We do not use advertising pixels or cookies for targeted advertising, and website session replay is disabled.

We do not sell your personal information or share it for cross-context behavioral advertising. You can accept or decline non-essential website analytics through our cookie banner and change your choice using the Cookie Preferences link.

3.4 Information from Third Parties

We may receive purchase and subscription information from Stripe, Apple, Google and RevenueCat; place information from Google Maps Platform; and reports or complaints from other users or rights holders. Payment providers process payment details, while we receive relevant customer and subscription identifiers, transaction information and subscription status. KeepWorthy does not receive or store full payment-card numbers.

3.5 Sensitive Personal Information

Certain information we process may constitute sensitive personal information under applicable state privacy laws. This includes account login credentials and, with your permission, precise device location. Content you choose to submit may also contain sensitive information, including information about your health. Personal health information is not required to use KeepWorthy.

We use account credentials to authenticate and secure your account, and precise device location to provide the location-based features you request. We do not use those credentials or precise device coordinates for analytics or to infer personal characteristics.

Product content and interactions are processed for the purposes described in this Policy, including displaying content, suggesting product categories and personalizing recommendations. These processes may involve health-related products or content. Section 8.6 provides additional information about health-related information and applicable rights.

4. HOW WE USE YOUR PERSONAL INFORMATION

We use the personal information we collect for the following purposes:

To provide and operate the Platform, including authenticating your account and enabling use of features and services.
To process payments and manage your Subscription, including communicating with you about billing, renewals, and cancellations.
To send you transactional communications, including confirmations, receipts, technical notices, security alerts, and support messages.
To send you marketing and promotional communications, if we introduce them in the future, only after you have opted in to receive them.
To personalize product discovery and recommendations using your interests, interactions and, with permission, location. This automated ranking does not produce legal or similarly significant effects.
To analyze usage trends and monitor the performance and security of the Platform.
To detect, investigate, and prevent fraudulent transactions, abuse, and other illegal activities.
To comply with applicable laws, regulations, and legal obligations, and to enforce our Terms of Service.
To respond to your inquiries, requests, and communications.
To determine age eligibility, record legal acceptance, suggest product categories and moderate content.
We may also use aggregated or de-identified information, such as anonymous search totals, that cannot reasonably be linked to you. We maintain this information in de-identified form and do not attempt to re-identify it.

5. DISCLOSURE OF YOUR PERSONAL INFORMATION

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising. In the preceding twelve months, we have not sold personal information, and we have not shared personal information for cross-context behavioral advertising. We share your personal information only in the following circumstances:

5.1 Service Providers and Other Recipients

We disclose information to providers that support hosting and infrastructure, communications, payments, analytics and other Platform functions. These include Supabase and Vercel for infrastructure; Resend for email; Stripe, Apple, Google and RevenueCat for payments and subscriptions; PostHog for analytics; Sentry for error monitoring; Expo, Apple and Google for push notifications; Google Maps Platform for store search; and OpenAI for product categorization. Providers processing information on our behalf are subject to applicable contractual restrictions. Some providers also process information for their own purposes under their privacy policies.

5.2 Artificial Intelligence Services

The Platform uses services provided by OpenAI, L.L.C. to enable certain features. We use the OpenAI API to suggest product categories from the product name and description you enter. Photos are not sent for this purpose. When you interact with AI-powered features on the Platform, your inputs and outputs may be transmitted to OpenAI for processing. KeepWorthy's use of OpenAI is governed by OpenAI's Terms of Use and Privacy Policy. KeepWorthy has elected the available data privacy settings to opt out of the use of customer data for OpenAI model training purposes. You should be aware, however, that OpenAI may retain interaction data for purposes other than model training, including for safety and policy compliance monitoring, in accordance with OpenAI's own data retention practices. If you have concerns about AI processing of your data, please contact our Privacy Officer.

5.3 Error Monitoring and Crash Reporting

We use Sentry, an error monitoring and crash reporting service provided by Functional Software, Inc., to identify and diagnose technical issues on the Platform. Crash reporting is on by default and can be turned off separately from product analytics in Settings. Turning it off stops future reporting through our integration but does not delete information already collected. Sentry may automatically collect technical information, including device data, error logs, and limited contextual information about your session at the time of an error. Sentry is configured to automatically instrument your session, and some technical data collection occurs even if you have opted out of other analytics. If you have concerns about Sentry's data collection, please contact our Privacy Officer.

5.4 Business Transfers

If KeepWorthy is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your personal information may be transferred to a successor entity. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy to the extent required by applicable law.

5.5 Legal Requirements

We may disclose your personal information if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation, court order, or valid governmental request; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Platform; (d) protect the personal safety of users or the public; or (e) protect against legal liability.

We may disclose your personal information for other purposes with your prior consent.

New profiles are public by default. You may change your profile to followers-only or private in Settings. Your username, avatar, posts, attached stores and source links may be visible according to your visibility settings. People who can view your content may copy or share it outside the Platform. Your current device location is not displayed to other users.

6. DATA RETENTION

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to provide the Platform, comply with legal obligations, resolve disputes, and enforce our agreements. When personal information is no longer needed, we delete or anonymize it using industry-standard methods. The following describes our general retention approach by data category:

Account and content information: Generally retained while your account is active or until you delete the relevant content, subject to the exceptions below. Account deletion removes account data from live systems through our deletion process.
Eligibility and legal-acceptance records: Retained while your account is active and ordinarily for one year after deletion.
Analytics and crash reports: Retained for up to twelve months. Anonymous search totals may be retained for up to twenty-four months.
Precise device location: Used for the current request and not stored by KeepWorthy as location history. Store information attached to a post is retained with the post.
Safety reports: Retained for twelve months after closure where no finding is substantiated, or twenty-four months after closure where a finding is substantiated.
Privacy requests: Request and response records are retained for twenty-four months after closure. Following account deletion, request text is removed once the request is closed, unless subject to a retention hold.
Billing records: Retained for applicable tax, accounting and legal requirements, generally six to seven years.
Feedback: Feedback and any attached diagnostics are deleted from our application database when you delete your account. Related diagnostic records already held by our service providers follow their applicable retention periods.
Other support, security and legal records: Retained for as long as reasonably necessary for their purpose. Specific legal obligations, disputes or documented holds may require longer retention.
Backups: Backup copies roll off within up to seven days following deletion from production systems. Information held by service providers may remain subject to their applicable retention and deletion practices. We do not access backup copies except in the event of a disaster recovery situation.

You may request deletion of your personal information at any time, subject to the limitations described in Section 8 of this Privacy Policy.

7. DATA SECURITY

KeepWorthy implements and maintains reasonable technical, administrative, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These safeguards include encryption of data in transit and at rest, access controls, and restricted access to personal information.

No method of data transmission or storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. If a security incident involving your personal information requires notification under applicable law, we will notify you and any required authorities within the applicable legal deadlines.

8. YOUR PRIVACY RIGHTS

8.1 Rights Available to All US Users

Regardless of the state in which you are located, you have the right to: (a) request access to the personal information we hold about you; (b) request correction of inaccurate or incomplete personal information; (c) request that we provide a copy of your personal information in a portable, readily usable format to the extent technically feasible; (d) request deletion of your personal information, subject to applicable exceptions; (e) opt out of any marketing communications we may send in the future; and (f) lodge a complaint with a relevant regulatory authority.

You may delete your account through Settings in the app or Account Settings on our website. To request access, correction or a copy of your information, select Privacy & your data in those settings, or contact privacy@getkeepworthy.com. Requests submitted through the Platform include a status tracker and response due date.

8.2 California Residents — CCPA/CPRA Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act of 2018 ("CCPA") as amended by the California Privacy Rights Act of 2020 ("CPRA"):

Right to Know. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business or commercial purposes for collecting it, the categories of third parties with whom we share it, and whether we sell or share it.
Right to Delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (such as where we need to retain the information to complete a transaction, comply with a legal obligation, or exercise our legal rights).
Right to Correct. You have the right to request that we correct inaccurate personal information we maintain about you.
Right to Data Portability. You have the right to request that we provide your personal information in a portable, commonly used, and machine-readable format so that you may transfer it to another entity.
Right to Opt Out of Sale or Sharing. We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising. If this practice changes, we will update this Privacy Policy and provide a "Do Not Sell or Share My Personal Information" link.
Right to Limit Use of Sensitive Personal Information. Where applicable law gives you the right to limit our use or disclosure of sensitive personal information, you may submit a request to privacy@getkeepworthy.com. Our handling of sensitive personal information is described in Section 3.5. We will apply the limitations required by applicable law.
Right Regarding Automated Decision-Making and Profiling. You have the right to opt out of profiling that produces legal or similarly significant effects. We use profiling for content personalization and recommendations, as described in Section 4. This use does not produce legal or similarly significant effects. If we adopt automated decision-making that does produce legal or similarly significant effects, we will disclose that use and provide you with an opt-out mechanism.
Right to Non-Discrimination. You have the right not to receive discriminatory treatment for exercising your CCPA/CPRA rights. We will not deny you services, charge you different prices, provide you a different level of service, or suggest that you will receive a different price or level of service because you exercised your rights.

Categories of Personal Information Collected (Preceding 12 Months)

The following table describes the categories of personal information we have collected about California consumers in the preceding twelve months, the sources of that information, the business purposes for which it was collected, and the categories of recipients to whom it was disclosed:

Category	Examples	Sources	Business Purposes	Disclosed To
Identifiers	Username, email address, account identifier, IP address, device identifiers and push tokens	Directly from you; automatically from your device	Account creation, authentication, communications, security, analytics	Hosting/infrastructure; email services; analytics; customer support tools
Commercial Information	Subscription records, transaction history, purchase details	You; Stripe; Apple; Google; RevenueCat	Payment processing, subscription management, tax and accounting records	Payment and subscription providers; hosting providers
Internet or Electronic Network Activity	Pages viewed, features used, time spent, links clicked, error logs	Automatically from your device and browser	Platform operation, analytics, security monitoring, feature improvement	Analytics providers; error monitoring (Sentry)
Geolocation Data	IP-derived approximate location; precise GPS location (if permitted)	Automatically from your device; from you (if permission granted)	Nearby-product ranking, store suggestions and website currency selection	Hosting providers; Google Maps Platform; analytics providers for approximate IP-derived location where analytics is enabled
Inferences	Preferences, interests, and engagement patterns derived from Platform activity	Derived internally from usage and interaction data	Personalization, content recommendations, product improvement	Hosting providers supporting internal recommendations
User-Generated Content	Product posts, photos, avatars, collections, source links, reports and communications	Directly from you	Platform functionality, AI-powered features (with your interaction), category suggestions, content storage	Hosting providers; users according to visibility settings; OpenAI for product names and descriptions only
Eligibility and legal records	Selected jurisdiction, age confirmation and legal acceptance	You	Account eligibility and compliance	Hosting providers

Retention periods for these categories are described in Section 6.

Service Provider Classification and Other Recipients

The recipients identified above have different roles depending on the service and processing involved. Providers processing personal information on KeepWorthy’s behalf are subject to applicable contractual restrictions, as described in Section 5.1. Some recipients, including payment providers, app-store operators and Google Maps Platform, may also process information for their own purposes under their applicable privacy policies. Other users may receive information you make available through the Platform’s social features, as described in Section 5.7. We do not sell personal information or share it for cross-context behavioral advertising.

To exercise your California rights, please contact our Privacy Officer at privacy@getkeepworthy.com. For procedures and verification requirements applicable to all rights requests, see Section 8.7.

California Civil Code Section 1798.83 (the "Shine the Light" law) permits California residents to request a list of third parties to whom we disclosed certain categories of personal information for those third parties' direct marketing purposes during the preceding calendar year. We do not disclose personal information to third parties for their own direct marketing purposes. If you have questions about our compliance with this law, please contact us at privacy@getkeepworthy.com.

8.3 Virginia Residents — CDPA Rights

If you are a Virginia resident, you have the following rights under the Consumer Data Protection Act ("CDPA"): to confirm whether we process your personal data; to access and obtain a copy of your personal data in a portable and readily usable format; to correct inaccuracies in your personal data; to delete your personal data; to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. If we decline to act on your request, you have the right to appeal our decision by submitting your appeal to privacy@getkeepworthy.com, and we will respond within sixty days. If your appeal is denied, you may contact the Virginia Attorney General at www.oag.state.va.us.

8.4 Colorado Residents — CPA Rights

If you are a Colorado resident, you have the following rights under the Colorado Privacy Act ("CPA"): to confirm whether we process your personal data; to access and obtain a copy of your personal data in a portable and readily usable format; to correct inaccuracies in your personal data; to delete your personal data; and to opt out of the processing of your personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. If we decline to act on your request, you have the right to appeal by contacting privacy@getkeepworthy.com, and we will respond within forty-five days. If your appeal is denied, you may contact the Colorado Attorney General at coag.gov/privacy.

8.5 Additional State Privacy Rights

Numerous US states have enacted consumer data privacy laws that provide residents with rights similar to those described above. If you are a resident of any of the following states, you may have rights to access, correct, delete, and port your personal data, and to opt out of the sale of personal data and targeted advertising, subject to the thresholds and conditions of the applicable law:

Connecticut residents have rights under the Connecticut Data Privacy Act ("CTDPA"), including the right to opt out of targeted advertising and data sales, and to appeal our response to any request. To submit a request or appeal, contact privacy@getkeepworthy.com.
Texas residents have rights under the Texas Data Privacy and Security Act ("TDPSA"). The TDPSA is subject to statutory exemptions, including a general exemption for small businesses, although consent requirements may still apply to their sale of sensitive personal data. Texas residents may request access, correction, deletion, and portability of their personal data, and may opt out of targeted advertising and data sales. To submit a request, contact privacy@getkeepworthy.com.
Utah residents have rights under the Utah Consumer Privacy Act ("UCPA"), including the right to access, delete, and obtain a copy of their personal data, and to opt out of targeted advertising and the sale of personal data. To exercise these rights, contact privacy@getkeepworthy.com.
Nebraska residents have rights under the Nebraska Data Privacy Act ("NDPA"), including the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising and data sales. To exercise these rights, contact privacy@getkeepworthy.com.
New Jersey residents have rights under the New Jersey Data Privacy Act ("NJDPA"), including the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, data sales, and certain forms of profiling. To exercise these rights, contact privacy@getkeepworthy.com.
Minnesota residents have rights under the Minnesota Consumer Data Privacy Act ("MCDPA"), including the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, data sales, and profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise these rights, contact privacy@getkeepworthy.com.
Maryland residents have rights under the Maryland Online Data Privacy Act ("MODPA"), including the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, data sales, and certain forms of profiling. To exercise these rights, contact privacy@getkeepworthy.com.
Kentucky residents have rights under the Kentucky Consumer Data Protection Act ("KCDPA"), including the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising and data sales. To exercise these rights, contact privacy@getkeepworthy.com.
Rhode Island residents have rights under the Rhode Island Data Transparency and Privacy Protection Act ("RIDTPPA"), including the right to access and delete their personal data and to opt out of targeted advertising and data sales. To exercise these rights, contact privacy@getkeepworthy.com.
Oregon residents have rights under the Oregon Consumer Privacy Act ("OCPA"), including the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising and data sales. Oregon residents may also appeal a denied request by contacting privacy@getkeepworthy.com.
Montana residents have rights under the Montana Consumer Data Privacy Act, including access, correction, deletion, portability, and opt-out of targeted advertising and data sales. To exercise these rights, contact privacy@getkeepworthy.com.
Indiana, Iowa, Tennessee, and Delaware have enacted state consumer data privacy laws providing rights to access, correct, delete, and opt out of certain data processing, subject to the effective dates and thresholds of the respective laws. If you are a resident of one of these states, you may contact privacy@getkeepworthy.com to exercise any rights you have under your state's law.
New Hampshire residents have rights under the New Hampshire Privacy Act ("NHPA"), including the right to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising and data sales. To exercise these rights, contact privacy@getkeepworthy.com.

We are monitoring the ongoing development of state privacy laws across the United States and will update this Privacy Policy as additional laws take effect.

8.6 Washington State — My Health My Data Act

Washington State residents have additional rights under the Washington My Health My Data Act ("MHMD Act") with respect to "consumer health data," which the MHMD Act defines broadly to include any personal information that identifies or could reasonably be linked to an individual's past, present, or future physical or mental health condition; attempts to obtain health services; use of health-related products or services; or health status as inferred from other personal information.

KeepWorthy is not a health service. KeepWorthy is a product-discovery and sharing service, not a healthcare provider. However, information you include in product names, descriptions, photos, reports or other communications may reveal information about your health. Our recommendation system also derives product-category interests from your interactions, which may involve health-related categories. Depending on its content and use, this information may constitute consumer health data under the Washington My Health My Data Act.

Please avoid including personal health details about yourself or others in content submitted to the Platform. Information you submit is processed as described in this Policy, including storage, display according to your visibility settings, product categorization and recommendations. Product names and descriptions may be sent to OpenAI for category suggestions, as described in Section 5.2. We do not sell consumer health data.

Where the Washington My Health My Data Act applies, you may request confirmation of whether we collect, share or sell your consumer health data; access that data and obtain a list of third parties and affiliates with whom it has been shared; withdraw consent to its collection or sharing; and request deletion, subject to applicable law. Submit requests to privacy@getkeepworthy.com. If we deny your request, you may appeal by emailing the same address with the subject line “Privacy Rights Appeal.”

8.7 How to Submit a Rights Request or Appeal

Subject to applicable law, we may retain limited personal information needed to investigate safety reports, prevent abuse or harm, maintain necessary safety measures, comply with legal obligations, or establish, exercise or defend legal claims. Where a lawful exception permits retention following a deletion request, safety-report records ordinarily follow the retention periods in Section 6: twelve months after closure where no finding is substantiated, or twenty-four months after closure where a finding is substantiated. A documented legal hold may require longer retention. We delete records when the applicable retention period and any lawful hold end, or earlier where required by law. These retention periods do not override your statutory deletion rights.

Identity Verification.

For requests submitted through the Platform, we verify your identity through your authenticated account. We may require additional verification for certain requests. For requests received by email, we may ask you to sign in or provide information reasonably necessary to verify your identity.

Former account holders who wish to exercise rights with respect to personal information we may retain following account closure may submit a request to privacy@getkeepworthy.com. Because we can no longer authenticate you through an active account, former users will be asked to provide information sufficient for us to match against our retained records (such as a former account email address and account creation date), and we may follow up for additional identifying information where necessary.

Response Timing.

We aim to respond to rights requests within 30 days. Where applicable law provides a longer response period, we will comply with that period. If we need additional time to fulfill your request, we will notify you within the initial response window of the reason and the expected completion date.

Notwithstanding a deletion request, we may retain personal information — including content you submitted through the Platform — to the extent necessary to investigate a report of safety-related conduct, prevent imminent harm, or cooperate with a law enforcement investigation that was initiated before we received your deletion request. We will delete this information once the safety matter or investigation is resolved, unless retention is otherwise required by law.

Authorized Agent Requests.

Residents of California and certain other states may designate an authorized agent to submit a rights request on their behalf. To submit a request through an authorized agent, the agent must provide written permission signed by you authorizing the agent to act on your behalf. We reserve the right to verify your identity directly — independent of the agent's submission — to confirm that the request was authorized and to protect against unauthorized requests. Requests submitted by an authorized agent without documented written permission may be declined.

If we decline to act on your request in whole or in part, we will inform you of the reasons and explain any right you have to appeal that decision. Appeals may be submitted to privacy@getkeepworthy.com with the subject line "Privacy Rights Appeal." We will respond to your appeal within the time period required by applicable law in your state.

9. CHILDREN'S PRIVACY

The Platform is intended for adults who meet our minimum age requirements: 18 in most US states, 19 in Alabama and Nebraska, and 21 in Mississippi. We ask users to confirm that they meet the requirement for their selected state; we do not collect dates of birth or independently verify age. The Platform is not directed to children under 13, and we do not knowingly collect their personal information. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe that a child under 13 has provided us with personal information, please contact us at privacy@getkeepworthy.com.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

10. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites, services, or applications that are not operated by KeepWorthy. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of any third party, and we encourage you to review the privacy policies of any third-party services you access.

11. ELECTRONIC COMMUNICATIONS

By providing us with your email address, you consent to receiving transactional communications from us electronically. We do not currently send marketing communications. If we introduce them, we will first request your consent and provide an unsubscribe mechanism. You cannot opt out of transactional communications, such as communications related to your account, payments, or our legal relationship with you.

12. TRANSFERS OF PERSONAL INFORMATION

Your information is stored primarily in the United States and may also be processed in other countries where our service providers operate. When we transfer personal information across international borders, we ensure that appropriate safeguards are in place as required by applicable law, including by entering into data processing agreements with our service providers.

This Privacy Policy governs the collection, use, and disclosure of personal information in connection with the United States version of the Platform. KeepWorthy maintains a separate Canadian Privacy Policy for users located in Canada.

13. REGULATORY OVERSIGHT AND COMPLAINTS

Processing of personal information in connection with the Platform in the United States is subject to oversight by the Federal Trade Commission ("FTC") under Section 5 of the FTC Act (15 U.S.C. § 45), which prohibits unfair or deceptive acts or practices in commerce. State attorneys general and state consumer protection agencies may also have authority to enforce applicable state privacy laws, including the California Attorney General and the California Privacy Protection Agency under the CCPA/CPRA, the Virginia Attorney General under the CDPA, the Colorado Attorney General under the CPA, the Connecticut Attorney General under the CTDPA, and the Texas Attorney General under the TDPSA. Washington State's MHMD Act includes a private right of action and is also enforced by the Washington Attorney General.

If you believe that we have not adequately addressed your privacy concerns, you have the right to file a complaint with:

The Federal Trade Commission: ftc.gov/complaint
Your state attorney general's office
Your state privacy enforcement authority, if applicable

We encourage you to contact us first so that we have an opportunity to address your concerns directly.

14. GOVERNING LAW

Except as provided in Section 19 of our Terms of Service (United States), this Privacy Policy and any dispute arising out of or related to it are governed by the laws of the U.S. state in which you reside, without regard to conflict of law principles. The Federal Arbitration Act governs Section 19 of those Terms. KeepWorthy Inc. is a corporation organized under the federal laws of Canada and maintains no place of business in any United States jurisdiction.

Notwithstanding the foregoing, nothing in this Privacy Policy limits any rights or remedies available to you under the consumer protection or privacy laws of the state or jurisdiction in which you reside, to the extent that those laws apply and cannot be waived by contract. The choice of governing law does not affect your ability to file a complaint with your state attorney general, the Federal Trade Commission, or any other applicable regulatory authority.

15. UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

For material changes — those that materially affect how we collect, use, or disclose your personal information, or that affect your rights or our data practices — we will provide you with advance notice of at least thirty (30) days through in-app notification and/or email before the change takes effect. Before you may continue to use the Platform following such a material change, we will ask you to affirmatively acknowledge the updated Privacy Policy. Examples of material changes include new categories of personal information collected, new sharing with third parties for purposes not previously disclosed, and material changes to your rights or to our data retention practices.

For non-material changes — such as formatting updates, corrections of typographical errors, or clarifications that do not affect the substance of our data practices or your rights — we will update the Effective Date at the top of this Policy and post the revised Policy on the Platform. We encourage you to review this Privacy Policy periodically.

16. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer: