Privacy Policy

1. GENERAL PROVISIONS

1.1. Introduction

We are committed to safeguarding your privacy and ensuring the security of your personal data. This Privacy Policy explains how IDDAS Technologies LLC, as the current Steward of the IDDAS Protocol, collects, uses, discloses, and protects personal information. This Policy applies when you visit or access our website at https://iddas.tech or applications we operate, when you create an Account as a Brand or Participant, when you create or distribute Candles, when you participate in Activations or receive Allocations, when you visit our social media accounts, or when you contact us by email, phone, or other electronic means. Throughout this Policy, references to 'Steward,' 'we,' 'us,' or 'our' refer to IDDAS Technologies LLC, and 'you' refers to users of the Platform including Brands, Participants, and visitors.

1.2. Scope and Our Role

The IDDAS Protocol is a published specification consisting of rules governing Candle creation and distribution, Activation mechanics, attribution lineage tracking, and allocation calculations. The Steward operates infrastructure that implements these Protocol rules and processes personal data necessary for providing these services. Stewardship is a role, not a permanent entitlement. While IDDAS Technologies LLC currently serves as Steward, the Protocol is designed to be structurally independent of any single entity, meaning Stewardship could potentially transition without fundamentally changing the Protocol rules. This Policy governs data processing by the current Steward.

1.3. Age Restrictions and Compliance

The Platform and Services are not directed to persons under age 18 or the age of majority required by local laws. We do not knowingly collect information from minors. If you are under the applicable age threshold, you must not provide personal information through the Platform. Parents or guardians who believe their child has provided information to us should contact privacy@iddas.tech immediately. We comply with the General Data Protection Regulation 2016/679 (EU) as our baseline standard, along with the UK GDPR, California Consumer Privacy Act, and other applicable federal, state, and international privacy laws. When conflicts exist between regulatory frameworks, we apply the standard providing the strongest protection for your data.

1.4. Third-Party Links and Policy Updates

The Platform may contain links to third-party websites or services, including payment processors and identity verification providers. This Policy does not apply to external sites, and we are not responsible for their privacy practices. We encourage you to review their policies before providing information. This Policy may change periodically, and material changes will be communicated through prominent Platform notice, email, or in-app notifications with at least 30 days advance notice. Continued use after changes constitutes acceptance of the updated Policy.

2. WHO WE ARE

The data controller responsible for your personal information is IDDAS Technologies LLC, organized under Delaware law. As the current Steward of the IDDAS Protocol, we operate Platform infrastructure and implement the Protocol's published rules. For privacy-related inquiries or to exercise your data protection rights, contact us at privacy@iddas.tech. If you are located in the European Economic Area, United Kingdom, or Switzerland, you may contact our Data Protection Officer at privacy@iddas.tech.

3. HOW WE COLLECT YOUR PERSONAL DATA

3.1. Sources of Personal Data

We receive your Personal Data through three primary channels. First, we collect data directly from you when you create an Account, complete profile information, create or distribute Candles, participate in Activations, make or receive payments, communicate with support, provide feedback, or otherwise interact with the Platform. This includes information you voluntarily provide during registration, profile updates, Candle creation, or customer support interactions.

Second, we automatically collect certain information when you use the Platform through cookies, web beacons, and similar tracking technologies. This includes your IP address, device type and identifiers, browser type and settings, operating system, Platform usage patterns including pages visited and features accessed, Activation and attribution data generated through Protocol use, and analytical data about your interactions with our services.

Third, we receive data from third-party sources. Payment processors such as Stripe provide transaction information and payment verification data. Identity verification providers supply information for Know Your Customer and Anti-Money Laundering compliance. Analytics providers may share aggregated or de-identified information about user behavior. We may receive information from public databases for verification and from other Platform users as part of attribution and lineage tracking inherent in the Protocol's design. When another user distributes a Candle that leads to an Activation, certain information about the attribution chain becomes part of the Protocol's persistent attribution record retained as required for allocation integrity and legal compliance.

3.2. Your Responsibilities

When you provide Personal Data about yourself or others, you assume important responsibilities. You must ensure accuracy and completeness of all information provided and update it promptly when changes occur. If you provide Personal Data about other individuals such as team members or authorized representatives, you represent and warrant that you have obtained necessary consents and informed them about how their data will be used. We may request confirmation of your legal right to provide certain categories of Personal Data, particularly sensitive information or information about third parties. Providing false, misleading, or unauthorized data may result in Account suspension and could violate applicable laws.

4. WHAT PERSONAL DATA WE PROCESS

4.1. Account and Service Data

When you create an Account and use our Services, we collect personal identification information including your full name, date of birth, government-issued identification documents such as passport numbers or driver's license information, and in some cases photographs or video recordings captured during identity verification. We collect contact information including email address, phone number, and physical mailing address. For business accounts, we collect company name, job title, your role on the Platform as Brand or Participant, and business operations information relevant to Platform use. Authentication data includes username, encrypted passwords (never stored in plain text), security questions and answers, and two-factor authentication credentials. Your Account profile includes biographical information, profile picture, and platform preferences for notifications and display options.

The Protocol tracks Candles, Activations, and attribution relationships. We process information about Candles you create as a Brand or distribute as a Participant, details about activated Candles, your position in attribution lineages whether as Originator, Intermediate, or Closer, and Activation history showing when Candles you were involved with resulted in successful conversions. This attribution data is fundamental to the Protocol's value proposition and enables allocation calculations according to published rules. The legal basis for this processing includes, necessity for contract performance under Article 6(1)(b) as we cannot provide Services without processing this information, and compliance with legal obligations under Article 6(1)(c) particularly regarding Know Your Customer and Anti-Money Laundering requirements.

4.2. Payment and Financial Data

Payment and financial data requires special attention given its sensitivity. We process identification information for payers and payees, government identification numbers where required, and business identification numbers for corporate accounts. Payment details include specific amounts, dates and times of transactions, payment methods used, and bank account or credit card information, though this sensitive financial information is primarily handled by our third-party payment processors rather than stored directly in our systems. For tax reporting, we collect Social Security Numbers for U.S. individuals, Employer Identification Numbers for U.S. businesses, or foreign tax identification numbers for international users. We maintain records for preparing tax forms including Forms 1099-K, W-9, and W-8, total payments made or received during each tax year, withholding amounts, and documentation supporting exemptions or reduced rates. We also process allocation calculation data showing how amounts were determined according to Protocol formulas.

The legal basis for payment processing is multifaceted. Contract performance under GDPR Article 6(1)(b) requires processing payment information to execute requested transactions. Compliance with legal obligations under Article 6(1)(c) mandates processing financial data to meet tax laws, financial reporting regulations, and anti-money laundering statutes, typically requiring record retention for five to seven years. Legitimate interests under Article 6(1)(f) include managing financial operations effectively, preventing fraud and financial crimes, and maintaining accurate business records, balanced against your privacy rights and subject to appropriate safeguards.

4.3. Platform Security and Support Data

To provide secure, functional Platform services, we process technical information including your IP address for fraud detection, understanding geographic usage patterns, and complying with geographic restrictions. We collect device type, operating system and version, browser type and language settings, and unique browser identifiers. Usage analytics include electronic navigation paths, features and pages accessed with duration, links and objects viewed or clicked, usage patterns, and behavioral data such as search queries. Security logs capture authentication attempts both successful and failed, suspicious activity patterns, error reports, and diagnostic information for troubleshooting. We also collect data through cookies as described in our separate Cookie Policy. When you contact support or provide feedback, we process your name, email, phone number, communication content through email, chat, or phone calls which may be recorded, support interaction records, and your contact and communication preferences.

The legal basis includes your consent for cookies and tracking technologies under GDPR Article 6(1)(a) for non-essential cookies, though much processing is based on legitimate interests under Article 6(1)(f) which include ensuring Platform security and protecting against unauthorized access and fraud, ensuring functionality and performance, identifying and fixing bugs, developing new features and improving existing functionality, understanding user behavior to enhance experience, and optimizing performance. For support and communications, processing is necessary for contract performance under Article 6(1)(b) as providing customer support is essential to service delivery, and we have legitimate interests in providing efficient customer service, maintaining quality standards, improving services based on feedback, and maintaining customer satisfaction.

4.4. Marketing Data

With your consent, we process Personal Data for marketing communications including contact information such as email and phone number where consented, marketing preferences including communication types and channels preferred, engagement data such as email open rates and link clicks, Platform activity for personalization, Services used most frequently, and expressed preferences and interests. To make marketing more relevant, we may use personalization based on your Platform activity, historical patterns of Activation and allocation, and aggregated benchmark data about similar users. The primary legal basis for marketing is your consent under GDPR Article 6(1)(a), obtained during Account creation or subsequently when you opt in, and withdrawable at any time through unsubscribe links or Account settings. We also have legitimate interests under Article 6(1)(f) in managing mailing lists, analyzing aggregated marketing results, resolving technical delivery problems, and improving marketing relevance, balanced against your privacy rights with your always-available right to object.

4.5. Automated Decision-Making and Data Retention

We use automated decision-making in certain contexts including Know Your Customer and Anti-Money Laundering compliance verification where automated systems screen users against sanctions lists and assess risk factors, fraud prevention where algorithms analyze transaction patterns and user behavior, attribution calculation verification where Protocol algorithms verify lineage and attribution recording, and allocation determinations where Protocol rules automatically calculate allocation amounts based on each Participant's role. These systems follow deterministic rules based on published Protocol specifications rather than discretionary decision-making. You have the right to challenge any automated decision, request human review, and object to automated processing producing legal effects or significantly affecting you.

We retain Personal Data for as long as necessary to fulfill collection purposes, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data type, purpose, jurisdiction, and legal requirements. Account data is retained while your Account is active and for a reasonable period thereafter, typically six months to one year for most data though financial and attribution records have longer requirements. Financial records including transaction histories, payment information, and tax documentation are retained according to financial, tax, and anti-money laundering requirements, typically five to seven years after transactions. For consent-based processing such as marketing, we retain data for the consent duration or until the originally agreed period expires after consent withdrawal, though we retain opt-out preferences to ensure we don't contact you inappropriately. Attribution and lineage data must be retained even after Account closure because these records are necessary for calculating Allocations for other Participants and complying with financial record-keeping requirements, forming part of an immutable record supporting other users' legitimate interests and our legal compliance obligations.

To ensure fairness and transparency, the Platform's automated systems apply published Protocol rules deterministically without discretionary overrides by the Steward in calculating Allocations. Allocation amounts are determined by mathematical formulas applied to Brand Consideration amounts, attribution lineage, and Participant roles (Originator, Intermediate, Closer). The Steward does not have discretion to alter allocation amounts beyond what the Protocol rules dictate. However, certain discretionary safeguards exist to protect Platform integrity and prevent abuse. These discretionary actions are limited to clearly defined circumstances including suspending or reversing Allocations where fraud or abuse is suspected pending investigation, withholding payments where compliance verification is required by law, restricting or terminating Accounts for Terms violations, and resolving technical errors or system malfunctions. These discretionary safeguards are applied based on documented policies and procedures, not on arbitrary or discriminatory bases, and are subject to user dispute rights as described in Section 10. Automated fraud detection systems may flag suspicious activity for human review. When automated systems flag transactions for review, a human reviewer will evaluate the matter before taking adverse action. You have the right to challenge any adverse determination as described in these Terms. The Platform maintains policies governing when and how discretionary safeguards are applied, and such policies are available upon request to authorized parties.

5. HOW WE USE YOUR PERSONAL DATA

We use your Personal Data for several core purposes essential to providing Platform and Services. The primary purpose is providing and administering the Platform and Services including Account creation and management, enabling Candle creation, distribution, and activation according to your role, tracking Activations when they occur, recording attribution lineage establishing relationships between Originators, Intermediates, and Closers, calculating Allocations according to Protocol published rules, and providing reporting and analytics tools. We process payments and allocations through third-party payment processors according to Protocol rules, though we do not custody or control user funds. We calculate allocation amounts based on deterministic Protocol formulas and provide payment instructions to payment processor partners who handle actual fund transfers.

We verify identity and prevent fraud through conducting Know Your Customer and Anti-Money Laundering verification as legally required, screening users against sanctions lists and politically exposed persons databases, monitoring for suspicious activity patterns indicating fraud or abuse, and investigating reported Terms violations or potential illegal activity. Communication is essential, including Account status communications such as security alerts and verification requirements, Activation notifications when Candles you're involved with are activated, allocation notifications informing you of earned Allocations and processed payments, important Service updates including feature changes and scheduled maintenance, and customer support by responding to inquiries, troubleshooting technical issues, resolving disputes, and assisting with Account management.

Platform improvement and development benefits all users through analyzing usage data to understand valuable features, identify improvement areas, discover bugs needing fixing, and plan new functionality.

This analytical work typically uses aggregated or anonymized data where possible, though we may review individual usage patterns to diagnose specific technical problems. Security is paramount, processing Personal Data to ensure Platform and Account security through implementing and monitoring access controls, detecting and responding to security incidents and breaches, identifying and blocking malicious activity, maintaining audit logs for investigating security issues, and conducting regular security assessments and testing. We conduct research and analytics to understand Platform usage trends, measure feature effectiveness, benchmark performance metrics, conduct A/B testing, and improve understanding of user needs, preferring aggregated or anonymized data where possible.

With your consent, we send marketing communications about Platform features and updates, new Services or functionality, educational content related to the Protocol and effective Platform use, industry news and insights, and special offers or promotional opportunities. You always have the right to opt out of marketing while continuing to receive essential service-related communications. Legal compliance and enforcement includes tax reporting and withholding, responding to subpoenas, court orders, and legal process, cooperating with law enforcement and regulatory investigations, maintaining records as required by various laws and regulations, meeting industry-specific requirements such as anti-money laundering and sanctions screening, resolving disputes between users or between users and the Platform, enforcing our Terms and Conditions including investigating and responding to violations, and exercising, establishing, or defending legal claims when necessary to protect our rights or those of our users.

5.1. Essential Versus Optional Communications

Certain communications are necessary for Service provision and cannot be opted out of without closing your Account. Essential communications include Account security alerts such as notifications of login attempts from new devices, password change confirmations, notifications of Account settings changes, and alerts about suspicious activity. Activation notifications inform you in real time when Candles you created, distributed, or are involved with have been activated. Allocation notifications tell you when you've earned Allocations with details about attribution lineage and calculation methodology. Payment confirmations document when payments have been processed including amounts, dates, and payment methods. Important Service updates keep you informed about Platform functionality changes, scheduled maintenance affecting availability, material changes to Terms and Conditions or this Privacy Policy, security updates or patches, and other operational matters impacting your ability to use Services effectively. Responses to your support requests address questions, concerns, or problems you've raised. These essential communications cannot be opted out of because they're integral to Services we provide and in many cases required by law or regulation, though you can control how you receive them such as by email versus in-app notification.

6. HOW WE SHARE YOUR PERSONAL DATA

6.1. Third-Party Service Providers

We share Personal Data with third-party service providers who process data on our behalf to help provide and improve Platform and Services. These providers act as data processors and are contractually obligated to process Personal Data only according to our instructions, implement appropriate security measures, use data only for specified purposes, and not retain data longer than necessary. The main categories include payment processors, primarily Stripe and potentially others, who process payments and allocations, verify payment methods, manage financial transactions, and handle chargebacks and refunds. We share only Personal Data necessary for these processors to perform services, typically including name, payment method information, transaction amounts, and dates.

Identity verification providers assist in verifying user identities for Know Your Customer and Anti-Money Laundering compliance. We share identification documents, photographs, and biographical information with providers using specialized software and databases to verify identity and screen for sanctions, politically exposed persons, and risk factors. Cloud infrastructure providers host Platform data and services on secure servers. We use reputable enterprise-grade cloud hosting and share only data necessary for hosting, storage, data backup, and infrastructure services. Analytics providers help analyze Platform usage and performance. Where possible, we use analytics tools processing anonymized or pseudonymized data, though in some cases providers may process Personal Data such as IP addresses or device identifiers. Customer support tools manage support tickets and communications efficiently. Security providers help monitor for fraud and security threats, which may involve sharing limited Personal Data such as IP addresses, device information, and transaction patterns. We may engage other specialized providers for accounting services, legal advisors, insurance providers, and consultants who receive only Personal Data necessary for specific services and are bound by professional confidentiality obligations and contractual restrictions.

6.2. Other Platform Users and Attribution Transparency

The IDDAS Protocol nature inherently involves sharing certain data with other Platform users, fundamental to how the Protocol works and necessary to provide transparency in attribution and allocation. When you activate a Candle, your relationship to the Originator and any Intermediates becomes part of the attribution record. The Originator and Intermediates associated with that Candle activation can see that you, identified by your Account name or user ID, were the Closer for that Activation. Similarly, if you're an Originator or Intermediate, you can see information about downstream Activations and who served as Closer because this information is necessary for understanding your own Allocations.

Brands who create Candles can see attribution lineage for Activations related to their Candles, including identities of Participants involved at each attribution chain stage. This visibility is essential for Brands to evaluate customer acquisition channel effectiveness, understand customer acquisition channels, assess different Participant performance, verify Activations meet defined criteria, and make decisions about which Candles to create or continue funding. However, Brand visibility is limited to information relevant for these business purposes. Brands cannot see your contact information such as email, phone number, or physical address, your payment method or financial account details, your other Activations unrelated to their Candles, your communications with us or other users, or other Personal Data not directly relevant to evaluating attribution and performance.

Public profile information you choose to make publicly visible such as profile name, biographical information, and profile picture may be seen by other Platform users and potentially visitors to public-facing Platform pages. You control what information appears in your public profile and should not include sensitive or private information in publicly visible fields. Privacy-conscious users may choose to use pseudonyms or limited biographical information, though some information may be required for verification purposes. This transparency is inherent to the Protocol's value proposition, enabling fair allocation, providing visibility into how conversions occur, allowing verification that attribution has been correctly recorded, and supporting trust and accountability within the Platform community. By participating in the Platform, you consent to this level of transparency regarding your role in Activations and attribution lineages.

6.3. Legal Obligations and Business Transactions

We disclose Personal Data when required by law or to protect rights and safety. We disclose data to law enforcement agencies when we receive valid legal requests such as subpoenas, court orders, search warrants, or other lawful demands. Before disclosing data in response to law enforcement requests, we review requests to ensure legal validity and proper scoping, disclosing only information specifically requested and legally required. Where permitted by law, we notify affected users of law enforcement requests, though in some cases we're legally prohibited from providing notice such as when subject to a gag order or when notice could obstruct criminal investigation.

We disclose data to regulatory authorities as required by law including tax authorities requiring information for tax compliance and reporting, financial regulators overseeing payment processing and anti-money laundering compliance, consumer protection agencies investigating potential violations, and other governmental bodies with legitimate regulatory authority. In legal proceedings, we may disclose Personal Data to courts and tribunals as required by court orders or as necessary to establish, exercise, or defend legal claims. We disclose data to legal advisors such as attorneys, legal consultants, and expert witnesses when necessary to obtain legal advice, prepare legal defenses, or pursue legal claims, protected by attorney-client privilege where applicable and subject to confidentiality obligations.

We may disclose Personal Data when we believe in good faith that disclosure is necessary to protect safety or prevent harm, including situations where someone's physical safety is at risk, where we need to investigate, prevent, or take action regarding suspected illegal activities, where we must respond to emergencies, or where disclosure is necessary to protect rights, property, or safety of the Platform, our users, or the public. If we undergo corporate transactions such as merger, acquisition, sale of assets, or joint ventures, Personal Data may be transferred as part of the transaction. We take steps to protect your Personal Data by requiring acquiring entities honor this Privacy Policy or provide notice of changes, conducting due diligence to ensure appropriate data protection practices, including data protection provisions in transaction agreements, and notifying you of transactions and any material changes to data handling with opportunity to close your Account if you don't wish data transferred to a new entity.

6.4. Important Limitation

We want to be absolutely clear: we do not sell your Personal Data to third parties for their marketing purposes. Any sharing of Personal Data is done for the specific purposes described in this Policy, not to allow third parties to market their own products and services to you. The only exception would be if you provide explicit, informed consent for such sharing after we clearly explain what would be shared and why, and even then you would always have the right to withdraw consent and opt out of such sharing.

7. INTERNATIONAL DATA TRANSFERS

The Steward operates primarily in the United States, and our servers and infrastructure are primarily located in the United States. When you use the Platform, your Personal Data may be transferred to, stored in, processed in, or accessed from the United States. Additionally, Personal Data may be transferred to or accessed from other jurisdictions where our service providers operate their businesses or maintain their infrastructure, potentially including countries in Europe, Asia, and other regions depending on which service providers we engage and where their operations are located.

If you're accessing the Platform from outside the United States, your Personal Data will cross international borders. Different countries have different data protection laws, and some may not provide the same level of protection as your home country. For example, the United States does not have a single comprehensive federal data protection law comparable to the GDPR, although various federal and state laws provide protections for specific types of data or in specific contexts. When we transfer Personal Data internationally, we implement appropriate safeguards to ensure your data remains protected to the standards described in this Policy regardless of where it's physically located or processed.

We use several legal mechanisms and safeguards to protect Personal Data during international transfers. For transfers to countries recognized by the European Commission, UK Government, or Swiss Government as providing adequate protection for Personal Data, we rely on these adequacy decisions. An adequacy decision means the destination country's data protection laws have been officially recognized as providing adequate protection comparable to European standards. For transfers to countries without adequacy decisions, we use Standard Contractual Clauses, which are pre-approved contract templates issued by the European Commission. These clauses are legally binding contracts between data exporters and importers requiring the data importer to protect Personal Data according to European standards even though located in a country without an adequacy decision. We have implemented the current version of EU Standard Contractual Clauses with service providers located outside the European Economic Area.

Some service providers participate in the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and/or the Swiss-U.S. Data Privacy Framework. These frameworks provide mechanisms for U.S. companies to demonstrate commitment to European, UK, and Swiss data protection standards. Companies participating in these frameworks self-certify compliance with framework principles and are subject to enforcement by the U.S. Federal Trade Commission. Before transferring Personal Data to a new jurisdiction or engaging a new service provider in a different country, we conduct transfer impact assessments to evaluate the legal environment in the destination country, assess risks to Personal Data, determine what supplementary measures might be needed beyond standard safeguards, and document our decision-making process.

For users in the European Economic Area, United Kingdom, or Switzerland, we take particular care with international transfers given strong data protection frameworks in these jurisdictions. We only transfer your Personal Data from the EEA, UK, or Switzerland to third countries where the European Commission, UK Government, or Swiss Government has issued an adequacy decision recognizing adequate data protection, where we've implemented appropriate safeguards such as Standard Contractual Clauses with the data recipient, where the data recipient participates in an approved certification mechanism such as the EU-U.S. Data Privacy Framework, where we've obtained your explicit consent after fully informing you of risks, or where one of the limited derogations provided by law applies to the specific transfer. We maintain records of international transfers including documentation of legal basis for each transfer, copies of relevant legal instruments, records of transfer impact assessments, and evidence of recipient compliance with data protection requirements.

8. YOUR PRIVACY RIGHTS

8.1. General Rights

Subject to applicable law in your jurisdiction, you have various rights regarding your Personal Data. The specific rights available depend on where you live, as different countries and regions have enacted different privacy laws with different scopes of protection. However, as general practice and because we use GDPR as our baseline standard, we strive to honor the following rights for all users regardless of location, though in some cases rights may be limited by local law or may not apply to all types of data or processing.

You have the right to be informed about processing of your Personal Data and to have access to it. This means you can request confirmation of whether we're processing your Personal Data, and if we are, you can request a copy of that data along with information about how we're using it, who we're sharing it with, how long we'll retain it, and what rights you have regarding it. This Policy itself serves as primary disclosure of how we process Personal Data, but you also have the right to request specific information about your individual data through an access request.

You have the right to request correction of inaccurate or incomplete Personal Data. If any Personal Data we hold about you is wrong, outdated, or incomplete, you can ask us to correct it. In many cases, you can correct information yourself by updating your Account profile and settings. For information you cannot update yourself, you can submit a correction request to privacy@iddas.tech. We'll review your request and make appropriate corrections within a reasonable timeframe, typically within 30 days. If we disagree that correction is warranted, we'll explain our reasoning, though you may note your disagreement in our records.

You have the right to request erasure or deletion of your Personal Data in certain circumstances. These circumstances typically include situations where data is no longer necessary for the purpose for which it was collected, where you withdraw consent if consent was the legal basis for processing and there's no other legal basis for continued processing, where you object to processing based on legitimate interests and we have no overriding legitimate grounds to continue processing, where data has been unlawfully processed, or where erasure is required by legal obligation. However, there are important exceptions to the right of erasure, particularly for data we're legally required to retain such as financial records and attribution data necessary for other users' allocations or data necessary for establishment, exercise, or defense of legal claims.

You have the right to request restriction of processing in certain situations. Restriction means we continue to store your Personal Data but limit how we use it. You can request restriction where you contest data accuracy during the period we verify accuracy, where processing is unlawful but you prefer restriction to erasure, where we no longer need data for our purposes but you need data for establishment, exercise, or defense of legal claims, or where you've objected to processing based on legitimate interests during the period we determine whether our legitimate grounds override yours. When processing is restricted, we won't use data except for storage, with your consent, for legal claims, or to protect another person's rights.

You have the right to data portability in certain circumstances. This means you can request to receive your Personal Data in a structured, commonly used, and machine-readable format, and you can request that we transmit this data directly to another controller where technically feasible. Data portability applies where processing is based on your consent or on contract performance and processing is carried out by automated means. This right doesn't apply to all data, only to data you've provided to us. For example, data we've derived or generated through analytics wouldn't be subject to data portability.

You have the right to object to certain types of processing. Your objection rights vary depending on the legal basis for processing. For processing based on legitimate interests including profiling related to legitimate interests, you have the right to object on grounds relating to your particular situation, and we must stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is necessary for legal claims. For direct marketing purposes, you have an absolute right to object at any time, and we must immediately cease processing your data for direct marketing, including profiling related to direct marketing.

You have the right not to be subject to automated decision-making that produces legal effects concerning you or similarly significantly affects you, unless the decision is necessary for entering into or performing a contract with you, is authorized by law, or is based on your explicit consent. We use automated decision-making primarily for allocation calculations, compliance screening, and fraud detection. These systems are designed to be fair, transparent, and accurate, but you always have the right to request human review of automated decisions, to express your point of view, and to contest decisions you believe are incorrect.

You have the right to withdraw consent at any time where processing is based on consent. Withdrawal of consent doesn't affect the lawfulness of processing based on consent before withdrawal. Once you withdraw consent, we'll stop processing your data for the purposes you consented to, unless we have another legal basis for continued processing. Withdrawing consent to certain processing may mean we cannot continue providing certain Services, but it won't affect Services that don't rely on consent-based processing. You have the right to lodge complaints with supervisory authorities if you believe we've violated your data protection rights. Supervisory authorities are independent governmental bodies responsible for enforcing data protection laws.

8.2. Exercising Your Rights

To exercise any of the rights described above, contact us at privacy@iddas.tech with a clear description of which right you wish to exercise and, if relevant, which Personal Data is concerned. To protect your Personal Data from unauthorized access, we need to verify your identity before processing rights requests. The verification methods we use depend on the sensitivity of the request and information we already have about you. For basic requests like accessing your data or correcting simple errors, we may verify identity by confirming your email address or asking security questions. For more sensitive requests like requesting full deletion of your Account, we may require stronger verification such as government-issued identification documents, answers to multiple security questions, or other verification methods appropriate to the situation.

In many cases, you can exercise certain rights directly through your Account settings without needing to contact us. You can typically update your profile information, change communication preferences, download certain data about your Account activity, manage cookie preferences, and enable or disable certain features. These self-service tools are designed to give you control over your data and privacy settings in real time without delays. However, for rights that cannot be exercised through Account settings, or if you need assistance, our privacy team is available at privacy@iddas.tech.

When you submit a privacy rights request, we'll respond within the timeframes required by applicable law. Under GDPR and most state privacy laws in the United States, we must respond within one month of receiving a valid request. This period may be extended by two additional months where necessary due to complexity or number of requests, but if we need extra time, we'll notify you within the first month and explain why the extension is needed. Our response will either fulfill your request, explain why we're declining your request in whole or in part, or provide additional information you need to complete your request. If we decline your request, we'll explain our reasoning and inform you of your right to lodge a complaint with a supervisory authority and, where applicable, your right to appeal our decision.

8.3. State-Specific Rights (United States)

Residents of certain U.S. states have additional privacy rights under state privacy laws. As of this Policy's date, comprehensive state privacy laws have been enacted in California, Colorado, Connecticut, Florida, Montana, Oregon, Texas, Utah, and Virginia, with more states expected to pass similar laws. While specific details vary by state, these laws generally provide similar core rights.

If you're a resident of one of these states, you have the right to know what Personal Information we collect, use, disclose, or sell about you. This includes the right to request information about categories of Personal Information collected, categories of sources from which it was collected, business or commercial purposes for collection, categories of third parties to whom it's disclosed, and specific pieces of Personal Information we've collected about you. You also have the right to know about data sharing practices, including whether your Personal Information has been sold or shared for cross-context behavioral advertising purposes, and if so, the categories of Personal Information sold or shared and categories of third parties to whom it was sold or shared.

You have the right to opt out of sale or sharing of your Personal Information and to opt out of targeted advertising based on your Personal Information. We don't sell Personal Information in the traditional sense of exchanging it for money, but some data sharing practices particularly advertising cookies enabling behavioral advertising may be considered 'sales' or 'sharing' under these state laws. You can exercise your opt-out right by adjusting your cookie preferences through our Cookie Policy banner or by contacting us at privacy@iddas.tech with 'State Privacy Rights Opt-Out' in the subject line.

Where state law provides this right, you have the right to limit use and disclosure of your Sensitive Personal Information, a term defined by state law to include certain categories of particularly sensitive data such as precise geolocation data, health information, sexual orientation, and other specified categories. We'll use and disclose Sensitive Personal Information only as permitted by law and for purposes necessary to provide Services you request, unless you provide additional consent for other uses. You have the right to correct inaccuracies in Personal Information we maintain about you. If you identify information that's inaccurate, incomplete, or misleading, you may request correction, and we'll make reasonable efforts to correct it based on information you provide.

You have the right to delete Personal Information we've collected from you, subject to various exceptions provided by law such as data we're legally required to retain, data necessary to complete transactions you requested, or data necessary to detect and prevent security incidents or fraud. You have the right to non-discrimination for exercising your privacy rights. We won't discriminate against you for exercising any privacy rights by denying goods or services, charging different prices or rates for goods or services, providing a different level or quality of goods or services, or suggesting that you'll receive different prices, rates, or quality. However, we may offer financial incentives permitted by law, and we may charge different prices or provide different quality levels if the difference is reasonably related to value provided by your Personal Information.

You have the right to authorize an agent to submit privacy rights requests on your behalf. If you use an authorized agent, we'll require verification of the agent's authority to act on your behalf, which typically means providing signed written authorization from you, though if the agent has power of attorney, we'll accept that as sufficient authorization. We'll still verify your identity to protect your Personal Information from unauthorized access. For residents of states that provide an appeal right such as Colorado, Connecticut, and Virginia, if we decline your privacy rights request, you have the right to appeal our decision. You can submit an appeal by responding to our denial communication or by emailing privacy@iddas.tech with 'Privacy Rights Appeal' in the subject line. We'll respond to appeals within the timeframe required by applicable state law, typically 45 to 60 days.

8.4. European Economic Area, United Kingdom, and Swiss Rights

If you're located in the European Economic Area, United Kingdom, or Switzerland, you have the robust privacy rights described throughout this Section 8, grounded in the GDPR or equivalent legislation. These rights are generally broader than those available under U.S. state laws and are enforced by independent supervisory authorities. In addition to general rights described above, you have the right to lodge complaints with your local supervisory authority. Each EEA member state has its own data protection authority, a list available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. In the United Kingdom, the supervisory authority is the Information Commissioner's Office, reachable at https://ico.org.uk or by phone at 0303 123 1113. In Switzerland, the supervisory authority is the Swiss Federal Data Protection and Information Commissioner, website available at https://www.edoeb.admin.ch. You can file complaints with the supervisory authority in your country of residence, your place of work, or the place where you believe a data protection violation occurred.

You also have the right to an effective judicial remedy against us if you believe we've violated your rights under GDPR or applicable law. This means you can bring a court case against us in the courts of the member state where we're established or where you reside. You have the right to an effective judicial remedy against a supervisory authority's decision, meaning you can appeal to courts if you disagree with a supervisory authority's handling of your complaint. For EEA, UK, and Swiss residents, we serve as the data controller for your Personal Data, which means we determine the purposes and means of processing. As controller, we're directly responsible to you for our processing activities and for complying with applicable data protection law.

8.5. Important Limitations and Exceptions

While we're committed to honoring your privacy rights, there are important limitations and exceptions recognized by law. We may decline to fulfill certain requests where legal exceptions apply, though we'll always explain our reasoning and inform you of your right to challenge our decision through complaint to a supervisory authority or, where applicable, through an appeals process.

We may refuse or limit your request to delete Personal Data where retention is necessary for compliance with legal obligations requiring us to maintain records, such as tax laws requiring retention of financial records for specified periods, anti-money laundering laws requiring retention of transaction records and customer identification information, laws requiring maintenance of employment records, or other record-keeping requirements imposed by law. We may also retain data where necessary for establishment, exercise, or defense of legal claims. If you're involved in a dispute with us or with another user, or if litigation is pending or threatened, we may retain data relevant to those legal matters until they're fully resolved.

We may retain data where necessary for compliance with our terms and conditions and protection of our rights and property, including detection and prevention of fraud, enforcement of our Terms and Conditions, protection of our intellectual property, investigation of violations, and maintenance of security. We may retain data where we have compelling legitimate interests that override your interests and rights, and we can demonstrate those legitimate interests. However, you always have the right to challenge our determination and present your views on why deletion should occur.

Attribution and lineage data presents a special case. As explained in Section 11.3 of this Policy, attribution data forms a permanent record necessary for calculating Allocations for other Participants and for complying with financial record-keeping requirements. Once an Activation has occurred and attribution has been recorded, we cannot delete that attribution data without undermining Protocol integrity and harming other users who have legitimate interests in attribution records' accuracy. You cannot request deletion of attribution data where it's necessary for other users' legitimate interests or legal compliance, though you can request deletion of other Personal Data not subject to these same constraints.

9. SECURITY MEASURES

We take the security of your Personal Data seriously and implement comprehensive technical and organizational measures designed to protect it from unauthorized access, accidental or unlawful destruction, damage, alteration, loss, unauthorized disclosure, and other forms of unlawful or unauthorized processing. Our security program is designed based on industry best practices and is regularly reviewed and updated to address evolving threats and vulnerabilities. Our security measures are risk-based, meaning we implement stronger and more sophisticated protections for more sensitive data and higher-risk processing activities. We regularly assess risks associated with our processing activities and adjust security measures accordingly. We also conduct regular security audits, vulnerability assessments, and penetration testing to identify and remediate potential security weaknesses before they can be exploited. While we implement robust security measures, it's important to understand that no security system is completely infallible. We cannot guarantee absolute security or that security breaches will never occur. What we can promise is that we take security seriously, implement industry-standard measures, continuously monitor for threats, respond promptly to incidents, and maintain transparency with users about our security practices and any incidents that may affect them. Your use of the Platform acknowledges this inherent limitation, though this acknowledgment doesn't waive your legal rights in the event of a security incident caused by our failure to implement reasonable security measures.

Our security practices encompass multiple layers of protection spanning physical security, network security, application security, and operational security. At the foundation is encryption, both in transit and at rest. We use Transport Layer Security protocols to encrypt data transmitted between your device and our servers, protecting against interception and eavesdropping. We implement industry-standard encryption for data stored in our databases and file systems, protecting against unauthorized access if physical media is compromised. Encryption keys are managed securely using key management systems with appropriate access controls and rotation policies.

Access controls are fundamental to our security posture. We implement role-based access control principles, meaning users and systems are granted only minimum permissions necessary to perform their job functions or operations. This principle of least privilege limits potential damage from compromised accounts or insider threats. We use strong authentication mechanisms including multi-factor authentication for sensitive systems and administrative access, requiring something you know such as a password, something you have such as an authentication token or device, and in some cases something you are such as biometric authentication. We maintain detailed audit logs of who accessed what data and when, enabling detection of suspicious patterns and investigation of incidents. Security monitoring is continuous and comprehensive. We use automated systems to monitor for suspicious activity patterns such as unusual login attempts, unexpected data access patterns, changes to critical system configurations, and potential security attacks such as SQL injection or cross-site scripting attempts. These systems generate alerts investigated by our security team in real time. We also monitor for known security vulnerabilities in our software dependencies and infrastructure components, applying security patches promptly when they become available. Incident response procedures are documented and regularly tested. We have a clear incident response plan defining how we detect security incidents, contain them to prevent further damage, investigate to understand what happened and what data was affected, remediate to fix vulnerabilities and prevent recurrence, and notify affected users and authorities as required by law.

Employee training is an essential component of our security program. All personnel with access to

Personal Data undergo security awareness training covering their responsibilities for protecting data, how to recognize and report security threats such as phishing attempts, proper handling of sensitive information, secure authentication practices, and what to do if they suspect a security incident. This training is provided during onboarding for new employees and is refreshed regularly. Vendor management ensures that our service providers also maintain appropriate security practices. When we engage service providers who will process Personal Data on our behalf, we evaluate their security practices through due diligence processes, require appropriate security commitments in our contracts with them, conduct periodic audits or reviews to verify compliance, and monitor for security incidents affecting our service providers.

You play a critical role in protecting your Account and Personal Data by following security best practices in your own use of the Platform. You're responsible for maintaining confidentiality of your Account credentials, which means not sharing your password with anyone, not using the same password across multiple services, not writing down your password in insecure locations, and not allowing others to access your Account under your credentials. You should use strong, unique passwords that are difficult to guess, typically including a mix of uppercase and lowercase letters, numbers, and special characters, with sufficient length. We recommend at least 12 characters. We strongly recommend that you enable multi-factor authentication on your Account if this feature is available. Multi-factor authentication adds an additional layer of security by requiring a second form of authentication beyond just your password, making it much more difficult for attackers to access your Account even if they somehow obtain your password. You should promptly report any suspected unauthorized access or security concerns. If you notice unusual activity on your Account, receive unexpected authentication requests, believe your password may have been compromised, or notice any other security concerns, contact us immediately at security@iddas.tech. The faster we're aware of potential security issues, the faster we can investigate and take protective measures.

In the unfortunate event that we experience a security incident affecting your Personal Data, we're committed to transparency and will notify you in accordance with applicable laws. Data breach notification laws vary by jurisdiction, but generally we're required to notify affected individuals and regulatory authorities when a breach is likely to result in a risk to your rights and freedoms. Our notification will typically include information about what happened and when it was discovered, what Personal Data was involved in the breach, what we're doing to contain and remediate the breach, what steps we're taking to prevent similar incidents in the future, what you can do to protect yourself from potential consequences, and how you can contact us with questions or concerns. For serious breaches involving highly sensitive data or presenting significant risks, we may offer additional protections such as credit monitoring services. We'll provide breach notifications within timeframes required by applicable law, which in many jurisdictions is 72 hours of becoming aware of the breach for notification to regulatory authorities and without undue delay for notification to affected individuals.

10. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies to operate, secure, and improve the Platform and Services. Cookies are small text files stored on your device when you visit our website or use our applications. These cookies allow us to recognize your browser or device, remember your preferences, understand how you use the Platform, and provide you with a better user experience. The cookies we use serve various purposes. Essential cookies are strictly necessary for the Platform to function properly and cannot be disabled in our systems without preventing core functionality. These cookies enable basic features such as maintaining your logged-in state as you navigate between pages, remembering items in your shopping cart or similar features, providing security features such as protection against cross-site request forgery attacks, and enabling core Platform functionality you've specifically requested.

Analytics cookies help us understand how users interact with the Platform by collecting information about which pages are visited most frequently, how users navigate through the site, how long users spend on different pages, what errors users encounter, and what actions users take. This information is typically aggregated and used to improve Platform functionality and user experience. We use both our own analytics cookies and analytics services provided by third parties. Preference cookies allow us to remember your choices and settings so we can provide a customized experience. These cookies remember preferences such as your language selection, display settings and layout preferences, time zone, and other customization options you've selected. Without these cookies, we'd need to ask you to re-enter your preferences every time you visit.

Marketing cookies are used to deliver relevant advertising and to measure effectiveness of our marketing campaigns. These cookies track your browsing across websites to build a profile of your interests, enabling us to show you relevant advertisements on our Platform and on third-party websites. They also help us measure how effective our advertising campaigns are and avoid showing you the same advertisements repeatedly. Marketing cookies are subject to your consent in most jurisdictions, and you can control them through our Cookie Policy preferences.

For detailed information about the specific cookies we use, how long they persist, which third parties may receive information through cookies, and how to manage your cookie preferences, please see our separate

Cookie Policy. The Cookie Policy is accessible through a link at the bottom of our website and forms an integral part of this Privacy Policy. Our Cookie Policy provides information about each specific cookie or category of cookies we use, including the name of the cookie, who places it whether us or a third party, what it does, how long it lasts, and the legal basis for using it. The Cookie Policy also explains how you can control cookies through your browser settings, how you can opt out of specific third-party cookies or categories of cookies, and how to use the cookie preference management tool we provide on our Platform.

You can generally control cookie usage through your browser settings. Most browsers allow you to refuse all cookies, accept only certain types of cookies, or prompt you each time a cookie is offered. However, please note that if you block or delete essential cookies, many features of the Platform may not function properly and you may not be able to use certain Services. Blocking or deleting non-essential cookies such as analytics or marketing cookies typically will not prevent you from using the Platform's core functionality, though it may affect the quality of your experience or the relevance of content and advertisements you see.

Some web browsers transmit 'Do Not Track' signals to websites they visit. Do Not Track is a proposed web browser feature intended to give users more control over tracking. However, there's currently no universal standard for how websites should respond to Do Not Track signals, and no industry consensus on what actions should be taken when a Do Not Track signal is received. Given the lack of consensus and standardization, we don't currently respond to Do Not Track signals by altering our data collection or use practices when we receive such signals from your browser. However, you can still control tracking through the cookie management tools we provide and through your browser settings as described in our Cookie Policy.

In addition to cookies, we may use other tracking technologies such as web beacons also called pixel tags or clear GIFs, which are tiny graphics with unique identifiers embedded in web pages or emails that allow us to track whether a particular page was visited or whether an email was opened. We use web beacons in combination with cookies to understand user behavior and to measure effectiveness of our communications. We may also use local storage objects sometimes called 'Flash cookies' or HTML5 local storage to store data on your device for specific purposes such as remembering user preferences or enabling certain functionality. Mobile applications may use mobile device identifiers and software development kit components from third parties for similar purposes as cookies on websites, including analytics, advertising, and functionality.

11. SPECIFIC DISCLOSURES AND LIMITATIONS

11.1. Non-Custodial Payment Structure

It is critical that you understand an important structural feature of the IDDAS Platform: the Steward does not hold, custody, or control user funds. This is a fundamental architectural decision that affects how payments and allocations are processed and who is responsible for various aspects of the payment process. Specifically, when Brands fund Brand Consideration for their Candles or when Participants receive Allocations, these funds are not held by the Steward at any point. Instead, funds flow directly between parties through third-party payment processors, primarily Stripe. Brand Consideration is transferred from Brand accounts directly to payment processor accounts, and Allocations are transferred from payment processor accounts directly to Participant accounts. The Steward's role is limited to calculating allocation amounts according to the Protocol's published formulas and providing payment instructions to the payment processors, but we never take possession of the funds themselves.

This non-custodial structure has important implications for how we process Personal Data. We process information about transactions, allocation calculations, and payment instructions, but the payment processors handle the actual movement of funds and maintain detailed financial account information for those transactions. This means that some financial data, particularly sensitive payment method details like full credit card numbers or bank account numbers, are held primarily by the payment processors rather than by us. We typically have access only to partial or tokenized payment information sufficient for record-keeping and customer service purposes.

The non-custodial structure also affects your relationships and potential recourse. Your relationship with payment processors is direct, governed by their terms of service and privacy policies. The payment processors may impose their own requirements, restrictions, holds, verification procedures, and limitations. We cannot override payment processor decisions or compel them to process payments they've declined, held, or reversed. If you have disputes or problems related to actual payment processing, you may need to work directly with the payment processor to resolve them, though we'll assist where we can. Personal Data shared with payment processors is subject to their privacy policies and practices, not solely to this Privacy Policy. We require our payment processors to implement appropriate privacy and security protections, and we select reputable, established payment processors with strong privacy practices. However, we cannot control their processing activities.

11.2. Protocol Independence and Stewardship

Understanding the relationship between the IDDAS Protocol and the current Steward is important for understanding how your Personal Data may be handled over time, particularly if Stewardship changes. The IDDAS Protocol is a published specification defining rules for Candle creation and distribution, Activation mechanics and criteria, attribution lineage tracking methodology, and allocation calculation formulas. These rules exist independently of any particular entity operating them. The Steward, currently IDDAS Technologies LLC, is the entity responsible for operating Platform infrastructure that implements these Protocol rules and enforcing the Protocol's published rules as written. However, Stewardship is conceived as a role rather than a permanent entitlement. The Protocol is intentionally designed to be structurally independent, meaning that theoretically, Stewardship could transition to a different entity without changing Protocol rules or how allocations are calculated. This Privacy Policy governs data processing by the current Steward. If Stewardship transitions to a different entity, several important implications follow for your Personal Data. The successor Steward would adopt its own privacy policy governing its data processing activities, though we'd expect such policy to be consistent with reasonable privacy practices and applicable law. Users would be notified of the Stewardship transition and any material changes to privacy practices, with reasonable advance notice where possible. Users would have opportunity to review new privacy practices and decide whether to continue using the Platform under the new Steward. Some data may be transferred to a successor Steward as part of the transition to ensure Service continuity, particularly attribution and lineage records necessary for ongoing allocation calculations, Account data necessary for users to maintain access under new management, and historical transaction records that may be required for legal compliance. Such transfers would be subject to appropriate contractual protections requiring the successor Steward to honor commitments made under this Privacy Policy or to provide adequate substitute protections.

11.3. Attribution and Lineage Transparency

The IDDAS Protocol is fundamentally built on transparent attribution of credit for successful Activations. This transparency is not optional or incidental; it's central to how the Protocol functions and provides value. Understanding how attribution data works and what it means for your privacy is essential before you participate in the Platform. By design, the Protocol creates persistent attribution records retained in accordance with Protocol requirements and applicable law when Activations occur. Once an Activation happens and is recorded in the Protocol's systems, the attribution lineage showing who was the Originator, who were the Intermediates if any, and who was the Closer becomes part of a permanent or semi-permanent record. This record is essential for calculating Allocations for all Participants involved in that Activation. Without these attribution records, we couldn't determine who is entitled to what percentage of Brand Consideration, and the core functionality of the Protocol would collapse. What does this mean for you practically? It means that if you participate in an Activation whether as Originator, Intermediate, or Closer, information about your role in that Activation becomes part of the Platform's permanent records. Specifically, your Account name or user identifier will be associated with that Activation in our attribution records, showing what role you played. The date and time of relevant distribution and Activation events will be recorded. The Candle that was activated and which Brand created it will be documented. The allocation amounts calculated for you and other Participants will be recorded. The relationships between Participants in the attribution chain will be preserved. This data must be retained even if you subsequently close your Account, because other Participants who were involved in the same Activations have legitimate interests in the accuracy and completeness of attribution records that determine their Allocations. For example, if you were an Intermediate in an attribution chain and then close your Account and request deletion of your data, we cannot delete the record showing you were an Intermediate in that Activation because doing so would make it impossible to calculate the correct Allocation for the Originator and Closer. Their Allocations depend on knowing that there was an Intermediate and how the 15% Intermediate allocation was divided. Similarly, we cannot delete attribution data that we're legally required to retain. Financial regulations typically require that records of commission payments and their calculation methodology be retained for five to seven years. Anti-money laundering laws require retention of transaction records. Tax laws require retention of information necessary to substantiate reported income.

You cannot request deletion of attribution data where it's necessary for other users' legitimate interests or for legal compliance.

For clarity: Personal Data that directly identifies you (such as your name, email address, phone number, and contact details) is separable from protocol attribution and lineage records. Attribution and lineage records rely on non-identifying or pseudonymous identifiers (such as hashes and internal IDs) rather than direct personal identifiers. Where legally permitted, we may delete or anonymize your direct personal identifiers while retaining anonymized attribution and lineage records as necessary to preserve protocol integrity, allocation integrity, and legal record-keeping obligations.

However, you can request deletion of other Personal Data not subject to these constraints, such as marketing preferences, non-essential profile information, communications and support ticket histories subject to some limitations, and other data not directly tied to attribution and allocation calculations. We'll honor such deletion requests to the fullest extent possible while preserving attribution records' integrity and complying with our legal obligations. This means that complete erasure of all Personal Data associated with your Account is generally not possible if you've participated in Activations. Your right to erasure is limited by the necessity of retaining attribution records for other users' rights and for legal compliance. This is an inherent limitation of participating in the Protocol, and you should understand and accept this limitation before creating an Account and participating in Activations.

The tension between data deletion rights under GDPR, CCPA, and similar laws and the Protocol's need to retain attribution records for other users' legitimate interests has been carefully considered. Attribution and lineage data forms an immutable or semi-permanent record essential for calculating Allocations for all Participants in an attribution chain. This data serves the legitimate interests of other users under GDPR Article 6(1)(f), creates legal obligations under financial record-keeping laws requiring retention of commission payment records, and is necessary for contract performance with other users who rely on accurate attribution for their Allocations. When you request deletion of your Account and Personal Data, we will delete all Personal Data that can be deleted consistent with our legal obligations and other users' rights. However, we cannot and will not delete attribution and lineage data showing your role in specific Activations where such deletion would undermine the accuracy of allocation calculations for other Participants, violate financial record-keeping requirements mandating retention of commission payment records for five to seven years, or breach our contractual obligations to other users whose Allocations depend on complete attribution records. This limitation on deletion rights is disclosed to you before you participate in Activations. By distributing Candles and participating in Activations, you acknowledge and accept that attribution data showing your role in specific Activations will be retained permanently or for legally mandated periods even after Account closure, and that this retention is necessary for other users' legitimate interests and legal compliance. If you are unwilling to accept this limitation, you should not participate in Candle distribution or Activations.

11.4. No Guaranteed Outcomes

The Steward does not control or guarantee outcomes related to your use of the Platform, and this lack of control affects what we can promise about your experience. It's important that you understand these limitations before relying on the Platform for income or business development. We don't control or guarantee Activation success rates. Whether a particular Candle results in successful Activations depends on numerous factors outside our control, including market demand for the Brand's offering, the quality of the Brand's product or service, the effectiveness of your distribution efforts and targeting, competition from other Participants distributing similar Candles, economic conditions and consumer sentiment, and pure chance and timing. We cannot predict or guarantee how many Candles you distribute will result in Activations, and historical performance isn't necessarily indicative of future results.

We don't control or guarantee allocation amounts. Your Allocations depend entirely on the Brand Consideration amount set by the Brand which we don't control, the occurrence of successful Activations which depends on customer behavior we don't control, your role in the attribution chain which depends on how Candles are distributed, and the number of Intermediates involved if any which affects how the 15% Intermediate allocation is divided. We calculate Allocations according to deterministic Protocol formulas, but we don't control the inputs to those formulas, and therefore we cannot guarantee that you'll earn any specific amount or that you'll earn anything at all. We don't control payment timing, which is subject to third-party payment processor policies and capabilities, banking system timelines and holidays, verification requirements that may delay payments, and technical issues that may occasionally occur.

We don't control market demand for Candles. Whether Brands choose to create Candles on our Platform, what types of offerings they provide, what Brand Consideration amounts they set, and how many Candles they create are all decisions made by Brands independently. We don't guarantee that there will always be Candles available for distribution or that available Candles will be attractive to your target audience. We don't guarantee business success using the Protocol. Your success as a Participant depends primarily on your own efforts, skills, and strategies, including your ability to effectively market and distribute Candles, your understanding of your target audience and their needs, your compliance with applicable laws and regulations, and your business acumen in general. The Platform provides tools and infrastructure, but success depends on how you use those tools.

11.5 Accessibility Considerations

The Platform strives to be accessible to users with disabilities consistent with applicable accessibility laws including the Americans with Disabilities Act and Section 508 of the Rehabilitation Act in the United States, and similar laws in other jurisdictions. We implement web accessibility features following Web Content Accessibility Guidelines where feasible, provide alternative text for images and visual content where applicable, ensure keyboard navigation compatibility for essential Platform functions, and work to maintain compatibility with common screen readers and assistive technologies. However, certain Platform features may present accessibility challenges particularly for users with visual impairments or cognitive disabilities. If you experience accessibility barriers in using the Platform, please contact support@iddas.tech with details of the barrier you encountered, the assistive technologies you use if applicable, and the Platform features or functions affected. We will work with you to identify reasonable accommodations or alternative means of accessing Platform functionality where feasible.For features involving Candle sealing, contract formation, and similar actions that require user affirmation or agreement, we provide clear disclosures of material terms, reasonable time to review terms before commitment, and confirmation steps to prevent accidental actions where practical. We recognize that some users may require additional time or alternative formats to review complex terms. If you require accessibility accommodations for reviewing or accepting Candle terms or other contractual commitments, please contact us to discuss available options.

11.6 Enterprise-Scale

When the Platform is deployed at enterprise scale meaning within large organizations or for high-volume use cases, additional data processing and compliance considerations may apply. Enterprise deployments may involve processing larger volumes of Personal Data, requiring more robust infrastructure and security measures, creating enhanced data protection obligations under GDPR, CCPA, or similar laws, and potentially triggering additional reporting or registration requirements in certain jurisdictions. For enterprise deployments, we will work with enterprise customers to address enhanced security requirements appropriate to data volume and sensitivity, data processing agreements or business associate agreements where required by law, compliance with industry-specific regulations applicable to the enterprise customer's business, and jurisdictional data localization requirements if applicable. Enterprise customers are responsible for ensuring that their use of the Platform complies with their own data protection obligations including obtaining necessary consents from their personnel or customers, providing required privacy notices, implementing appropriate security measures, and complying with data subject rights requests. The threshold at which deployments are considered "enterprise-scale" may vary by jurisdiction and depends on factors such as number of users or Accounts involved, volume of Personal Data processed, sensitivity of Personal Data involved, and applicable legal definitions such as GDPR thresholds for data protection impact assessments. We will evaluate deployment scale on a case-by-case basis and will notify enterprise customers of additional compliance requirements that apply to their specific deployment.

12. CONTACT INFORMATION

For privacy-related inquiries, concerns, or requests to exercise your data protection rights, contact us at privacy@iddas.tech. If you're located in the European Economic Area, United Kingdom, or Switzerland, you may contact our Data Protection Officer at privacy@iddas.tech. Our mailing address for privacy matters is: IDDAS Technologies LLC, ATTN: Privacy Department, 30 N Gould St, Suite R, Sheridan, WY 82801, United States. We aim to respond to privacy inquiries within five business days for initial acknowledgment and within 30 days for substantive response to data rights requests. Complex requests may require additional time; we'll notify you of any delays. If you're located in the EEA, UK, or Switzerland, you have the right to lodge complaints with your local supervisory authority. Contact information for supervisory authorities is available at https://edpb.europa.eu for EEA, https://ico.org.uk for the UK, and https://www.edoeb.admin.ch for Switzerland. California residents may contact the California Attorney General regarding privacy matters at https://oag.ca.gov/privacy. Other U.S. residents should contact their state Attorney General's office.

13. STATE-SPECIFIC SUPPLEMENTAL DISCLOSURES

13.1. California Residents (CCPA/CPRA)

In the preceding 12 months, we've collected categories of personal information including identifiers such as name, email, phone, address, IP address, and Account ID; personal information as defined by California Civil Code Section 1798.80(e) such as name, address, telephone number, and bank account number; protected classifications such as date of birth and citizenship for compliance purposes though collected on a limited basis; commercial information such as transaction history, Activation records, and payment information; internet or network activity such as browsing history, Platform interactions, and device information; geolocation data such as general location from IP address; professional or employment information such as job title and company name for Brands and business accounts; and inferences such as profile reflecting preferences, behavior, and attitudes, along with sensitive personal information including account credentials and payment details.

We collect personal information for the purposes described in Section 5 of this Policy, including providing Platform Services, processing payments and allocations, compliance and fraud prevention, customer support, Platform improvement and analytics, and marketing with consent. We collect personal information directly from you through Account registration and Platform use, automatically through cookies and analytics, and from third parties including payment processors, verification services, and other users.

Regarding sales and sharing of personal information, we don't sell personal information in the traditional sense. However, certain data sharing may be considered 'sales' or 'sharing' under CCPA, particularly advertising cookies that may constitute 'sharing' for cross-context behavioral advertising purposes to target ads and provide analytics and reporting related to advertising effectiveness. You can opt out of this sharing through our Cookie Policy preferences or by visiting the 'Do Not Sell or Share My Personal Information' link on our website. We disclose personal information to third parties for business purposes as described in Section 6, including to service providers and vendors, payment processors, identity verification providers, cloud infrastructure providers, and analytics providers. These disclosures are governed by contracts limiting use to specified business purposes.

We retain personal information as described in Section 4.10, typically Account data for the duration of your Account plus legally required retention period, financial records for five to seven years per financial regulations, and marketing data until consent withdrawal plus legal retention period. California residents have the right to know information about personal information collected, used, disclosed, or sold; access copies of personal information collected; delete personal information subject to legal exceptions; correct inaccuracies in personal information; opt out of sale or sharing of personal information; limit use and disclosure of sensitive personal information; non-discrimination for exercising these rights; and authorize an agent to submit requests on your behalf. To exercise these rights, contact privacy@iddas.tech with 'California Privacy Rights' in the subject line. We'll verify identity before processing requests, respond within 45 days extendable by an additional 45 days for complex requests with notice, and provide explanations if we decline requests with information about your right to lodge complaints.

13.2. Other State Residents

Residents of Colorado, Connecticut, Florida, Montana, Oregon, Texas, Utah, and Virginia have similar rights to California residents under their respective state privacy laws. Your rights include accessing your personal data, correcting inaccuracies, deleting personal data, obtaining copies in portable format for data portability, opting out of sale, targeted advertising, and profiling, and where applicable, opting out of processing sensitive data. To exercise rights, email privacy@iddas.tech with your state privacy law name in subject line such as 'Virginia Privacy Rights.' If we deny your request, you may appeal where state law provides this right by responding to our denial communication within a reasonable time. We'll respond to appeals within 60 days or as required by state law.

14. EFFECTIVE DATE AND ACCEPTANCE

This Privacy Policy is effective as of January 19, 2026. By using the Platform, creating an Account, or continuing to use Services after this date, you acknowledge that you've read, understood, and agree to be bound by this Privacy Policy. If you don't agree with this Policy, you must immediately cease using the Platform and close your Account.

© 2026 IDDAS Technologies LLC. All rights reserved.