California Privacy Policy

Effective Date: October 18, 2022

Updated On: September 14, 2026

This section supplements the Company's general Privacy Policy and applies to California residents ("consumers" or you"), in compliance with the California Consumer Privacy Act (CCPA). Terms not defined here have the meaning given to them in the CCPA.

1. Information We Collect

We have collected the following categories of personal information from consumers within the last twelve (12) months:

Category	Examples	Collected
Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.	YES
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	YES
Protected classification characteristics under California or federal law	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	NO*
Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES
Biometric information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	YES
Internet or other similar network activity	Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.	YES
Geolocation data	Physical location or movements.	YES
Sensory data	Audio, electronic, visual, thermal, olfactory, or similar information.	YES
Professional or employment-related information	Current or past job history or performance evaluations.	YES**
Non-public education information (FERPA)	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
Inferences	Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	YES

The Company does not collect or process protected classification characteristics as protected-class data. Government identification documents collected for KYC may incidentally reflect such characteristics; the Company does not extract, infer, or use such characteristics for any purpose. ** With respect to job applicants, employees, owners, directors, officers, and contractors of the Company.

1. Sale, Sharing, and Disclosure of Personal Information

A. Disclosures for a Business Purpose

In the preceding twelve (12) months, the Company has disclosed the following categories of personal information to the following categories of service providers and contractors for a business purpose:

Category of Personal Information	Category of Service Provider/Contractor Recipients
Identifiers	Payment processors; identity verification and KYC providers; anti-fraud and anti-cheat providers; analytics and product measurement providers; attribution and marketing measurement providers; customer support and communications providers; shipping and fulfillment providers; cloud hosting and infrastructure providers.
Customer Records	Payment processors; identity verification and KYC providers; shipping and fulfillment providers; cloud hosting and infrastructure providers.
Commercial information	Payment processors; analytics and product measurement providers; attribution and marketing measurement providers; cloud hosting and infrastructure providers.
Biometric information	Identity verification and KYC providers; cloud hosting and infrastructure providers.
Internet or other similar network activity	Analytics and product measurement providers; attribution and marketing measurement providers; anti-fraud providers; cloud hosting and infrastructure providers.
Geolocation data	Anti-fraud providers; analytics and product measurement providers; cloud hosting and infrastructure providers.
Sensory data	Identity verification and KYC providers; cloud hosting and infrastructure providers.
Professional or employment-related information	HR information system providers; payroll providers; benefits administration providers; cloud hosting and infrastructure providers.
Inferences	Analytics and product measurement providers; cloud hosting and infrastructure providers.
Sensitive personal information	Identity verification and KYC providers; payment processors; anti-fraud providers; cloud hosting and infrastructure providers.

The Company makes these business purpose disclosures under written contracts that describe the purposes for which the personal information is disclosed, require the recipient to keep the personal information confidential, and prohibit the recipient from using the disclosed information for any purpose other than performing the contracted services.

B. Sharing/"Selling" Personal Information

In the preceding twelve (12) months, the Company has shared the following categories of personal information with the following categories of third parties for purposes of cross-context behavioral advertising:

Category of Personal Information	Categories of Third-Party Recipients
Identifiers (including device identifiers and online identifiers)	Advertising networks and advertising technology providers.
Internet or other similar network activity	Advertising networks and advertising technology providers.
Inferences	Advertising networks and advertising technology providers.

Although the Company does not receive monetary payment for this sharing, it is defined as a “sale” under the CCPA as it is made in exchange for valuable consideration (i.e., improved advertising). Thus, the Company's disclosure of information to marketing firms for cross-context behavioral advertising constitutes a “sale” and/or “sharing” of your personal information, and you have the right to opt out; see Opt Out of Sale or Sharing of Information.

The Company does not have actual knowledge that it sells personal information of consumers under 18 years of age. The Company also honors opt-out preference signals (such as the Global Privacy Control) sent through your browser. When the Company receives an opt-out preference signal from a browser or device, the Company will treat that signal as a request to opt out of sale and sharing for that browser or device, and (if you are logged in to your Company account at the time the signal is received) for your account.

1. Your Rights and Choices

The following rights are available to California residents:

• Right to Know and Data Portability. You have the right to request that we disclose the categories and sources of personal information we have collected about you, and our purpose for collecting, selling, or sharing it. For specific pieces of your data or a portable copy, see the “Right to Access” and “Right to Request a Transfer” sections of our general Privacy Policy.

• Right to Non-Discrimination. You have the right not to be discriminated or retaliated against for exercising any of your CCPA rights.

• Shine the Light Requests. You have the right to request information under the Shine the Light Act. To make such a request, please contact our privacy team at [e-mail].

A. Exercising Your Rights

To exercise any of your rights, please submit a request by emailing us at [e-mail] or through the in-App settings menu of the Company Apps, where available. You do not need to create an account with us to submit a request. For instructions on exercising your sale opt-out or opt-in rights, see Opt Out of Sale or Sharing of Information.

Only you, or your Designated Agent (as detailed in the Company's general Privacy Policy), may make a request related to your personal information. Please provide enough information for us to reasonably verify your identity and describe your request clearly enough for us to understand and respond to it. Before completing your request, we may ask you to verify your identity, which may include confirming information associated with your account.

B. Sensitive Personal Information

The Company uses sensitive personal information only for CCPA-permitted purposes (e.g., identity verification, fraud prevention, and security). As a result, the right to limit does not apply.

Contact Information

If you have any questions or comments about this notice, the ways in which the Company collects and uses your information described here and in the general Privacy Policy, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us at:

Email: [e-mail]

Postal mail: Triumph Labs, Inc., Attn: Legal, 90 Sheridan St., San Francisco, CA 94103

If you need to access this Policy in an alternative format due to having a disability, please contact [e-mail].