Personal information includes all information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual. Personal information includes “personal data” and “personally identifiable information” as that term is defined in privacy laws.

Personal information does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been de-identified or anonymized; or aggregate information. “Publicly available information” includes information that is made available from federal, state, or local government records; information that a business has a reasonable basis to believe is lawfully available to the general public, either through widely distributed media, or by the individual; and information that is made available by a person to whom the individual has disclosed the information if the individual has not restricted the information to a specific audience.

We may create aggregated, de-identified, or anonymous information from data by removing certain data components that make the data identifiable, or through aggregation, obfuscation, or other means. Subject to applicable law, our use and disclosure of aggregated, de-identified, or anonymized information is not personal information and is not subject to this Privacy Policy.

We may collect the following types of personal information from you depending upon the device you are using and how you interact with us or use or interact with our Services.

Because of the overlapping nature of certain of the categories of personal information identified above, some of the personal information we collect may be reasonably classified under multiple categories.

Additionally, we utilize products, features, or tools that utilize artificial intelligence, machine learning, or similar technologies for any of the above purposes.

A note about gifts

In order to send an individual a gift using our Services, we collect information about the intended recipient, including their name and phone number. When a user sends someone a gift using our Services, they may include a message to the intended recipient. In addition, when someone receives a gift, they may send a message to the individual who sent them the gift using our Services. Please note, the content of these messages may be viewed by others and we strongly encourage users to not include any sensitive information within any gift-related message.

We collect personal information from you for the purposes listed above, including to provide you with our Services, as well as to improve your experience, from the following sources.

A. Directly from you

You may provide us with personal information in several ways, including, for example when you:

• Visit our website or use our Services;
• Register for an account or membership;
• Correspond with us in any way, including through surveys and promotions;
• Sign up to receive our newsletter or promotional information;
• Ask for customer service, support, or other assistance; or
• Interact with us in any other way, online or offline, including through our Services.

B. Automatically through cookies and similar tracking technologies

We also collect personal information about you through the use of cookies and similar tracking technologies on our websites. For more information, please review Cookies and Similar Tracking Technologies below.

C. Through AI Features we offer

We may also collect personal information through your use of artificial intelligence features we offer, which may include our gifting Model Context Protocol (“MCP”) server, our AI chatbot, and other AI-powered features (“AI Features”). For example, we may collect personal information that you include in your prompts and other inputs when using our AI Features. We may also collect personal information that is automatically generated from your use of AI Features. We may use third-party providers in connection with the AI Features that we offer, as discussed in more detail in How We Disclose Personal Information.

Note that personal information sent to or collected through our AI Features may be processed ephemerally within the AI model/services provider model(s) we utilize, but will not be retained by the AI model/services provider model(s).

D. Information we collect from others

We may also collect personal information from the following parties:

• From other users of our Services, including if they send you a gift receipt or message. For example, we may collect personal information about you including your name, email address, mailing address, and phone number from your employer, potential employer, or business contact in order to integrate Customer Relationship Management (CRM) features and facilitate order fulfillment.
• From our corporate affiliates, including our current and future parent companies, affiliates, subsidiaries, and other companies under common control and ownership.
• From our service providers, including those providing hosting, analytics, customer and technical support, payment, order fulfillment, shipping, email, fraud prevention, artificial intelligence, and other services.
• From third-party advertising platforms and analytics providers.
• From other third-party business partners, which may include data enrichment providers, business and marketing partners, and joint marketing campaign partners (“Third-Party Business Partners”).
• From social media and other content platforms, such as Meta and Google, if you interact with us on these platforms or visit our Sites while logged into these platforms.

We may supplement or combine the personal information we receive from these third parties with personal information we otherwise collect about you through your use of our Services.

Social Media Integration

Our Services may, from time to time, contain links to and from social media platforms. You may choose to connect to us through a social media platform, such as Facebook, LinkedIn, or Twitter, and when you do, we may collect additional information from you. Please be advised that social media platforms may also collect information from you. When you click on a social plug-in, such as Facebook’s “Like” button or Twitter’s “Tweet” button, that particular social network’s plugin will be activated and your browser will directly connect to that provider’s servers. We encourage you to review the social media platforms’ usage and disclosure policies and practices, including the data security practices, before using them.

Surveys

From time to time, and subject to your consent where required by applicable local law, we may provide you with the opportunity to participate in surveys, some of which might be sponsored or conducted by a third party. Participation in these surveys is completely voluntary. If you choose to participate, we will request certain personal information from you. If there is a third-party sponsor involved in the survey, we may provide certain personal information to the third-party sponsor. Please make sure to review the sponsor’s privacy policy and be aware that any surveys offered by us may be governed by specific rules and terms and conditions that are separate from and in addition to this Privacy Policy. By participating in any such surveys you will become subject to those rules, including but not limited to receiving emails containing survey communications.

We may disclose personal information that we collect to the following parties:

A. Corporate affiliates

We may disclose personal information to our corporate affiliates, including our current and future parent companies, affiliates, subsidiaries, and other companies under common control and for the purposes provided in Types of Information We Collect, Use, and Disclose.

B. Our service providers

We may disclose personal information to our service providers who provide services on our behalf, such as; payment processors; shipping and delivery providers; analytics providers; advertising and marketing providers; web hosting and cloud storage providers; customer and technical support providers; software development and IT providers; email providers; fraud prevention providers; artificial intelligence providers, including those that facilitate our provision of AI Features; and providers of other services.

For example, if you use the chatbot or live chat on our Sites, the information provided may be processed by our third-party provider, Kustomer, on our behalf. If you use our MPC server, the information provided may be processed by our third-party providers, including Google, OpenAI, or Anthropic, on our behalf.

C. Authorities for compliance and harm prevention

We may disclose personal information with law enforcement and regulatory authorities or other third parties as required or permitted by law for the purpose of:

• Responding to a subpoena, court order, or other legal processes;
• Defending, protecting, or enforcing our rights;
• Defending a legal claim;
• Responding to a threat of harm involving an individual’s health and/or safety;
• Assisting in the event of an emergency; and
• Complying with applicable law.

D. Business transferees

We may also transfer or assign personal information to third parties as a result of, or in connection with, a sale, merger, consolidation, change in control, transfer of assets, bankruptcy, reorganization, or liquidation.

E. Professional advisors

We may disclose personal information to our professional advisors, including lawyers, auditors, bankers, investors, shareholders, and insurers, where necessary in the course of the professional services they render to us.

F. Advertising partners and platforms

We may disclose your personal information to third-party advertising platforms and analytics providers, including advertising, social media, and analytics companies who assist us in serving advertising regarding the Services to others who may be interested and who use cookies to serve interest-based advertising and content on their respective third-party platforms that may be based on your preferences, location and/or interests.

G. Storefront Operators

Our Services may allow certain users (including businesses or other organizations) (“Storefront Operators”) to create and manage customized online storefronts (each, a “Storefront”) through which products are displayed and made available for purchase by other users (“Storefront Customers”). Storefronts may be publicly accessible and may be shared by Storefront Operators with their employees, customers, fans, or other third parties. In connection with purchases made through a Storefront, certain personal information provided by Storefront Customers, such as name, email address, phone number, shipping address, and order details, will be shared with the applicable Storefront Operator and relevant service providers in order to process and facilitate the order, operate the Storefront, and for other internal business purposes.

H. Third-Party Business Partners

We may disclose personal information to Third-Party Business Partners for marketing and business development campaigns.

I. Other parties with your consent

We may disclose personal information to other parties with your consent in accordance with applicable law.

We are dedicated to ensuring the security of your personal information. We aim to provide secure transmission of your personal information from your devices to our servers. We have processes to store personal information that we have collected in secure operating environments. Our security procedures mean that we may occasionally request proof of identity before we disclose your personal information to you. We try our best to safeguard personal information once we receive it, but please understand that no transmission of data over the Internet or any other public network can be guaranteed to be 100% secure. If you suspect an unauthorized use or security breach of your personal information, please contact us immediately.

We may retain personal information for as long as necessary for the purposes listed in this Privacy Policy. including, to provide our Services, comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. Our determination of precise retention periods will be based on (i) the length of time we have an ongoing relationship with you; (ii) whether there is a legal obligation to which we are subject; and (iii) whether retention is advisable given our legal position, including with regard to applicable statutes of limitations, litigation, or regulatory investigations.

Note that personal information sent to or collected through AI Features may be processed ephemerally within the AI model/services provider model(s), but will not be retained by the AI model/services provider.

We may transfer, store, and use information we collect and maintain about you, including personal information outside of your state, province, country or other governmental jurisdiction. For example, if you are located outside the United States and choose to provide information to us, please note that we transfer personal information to United States and process it there. The data protection laws in the jurisdiction in which we process personal information may differ from those of your jurisdiction, and in certain circumstances, your personal information may be subject to access requests from governments, courts, law enforcement agencies or regulatory agencies in those other jurisdictions.

Our Services are not for children or those under the age of 18. We do not knowingly collect personal information from children or other persons who are under 18 years of age. Individuals who are children or those under the age of 18 should not attempt to provide us with any personal information. If you think we have received personal information from children or those under the age of 18, please contact us immediately.

Like many websites and apps, we use cookies, pixels, and similar tracking technologies (collectively, “Cookies”) that collect information to improve and analyze our Services and provide targeted advertising. Some cookies are offered by third parties who collect your personal information so they can provide services to us and information about your online activity to others. You can modify the use of certain Cookies in your browser settings. Note that if you decline certain Cookies, some of our Services’ features may not function as designed.

Cookies on the Services generally fall into the following categories:

• Strictly Necessary. We may use cookies that we consider to be strictly necessary to allow you to use and access our Services, including cookies required to prevent fraudulent activity and improve security.
• Functionality. We may use cookies that are required to offer you enhanced functionality when accessing our Services, including identifying you when you sign in to our Services or keeping track of your specified preferences, including in terms of the presentation of content on our Services.
• Performance/Analytics. We may use cookies to assess the performance of our Services, including as part of our analytics practices. For example, we may use Google Analytics or other service providers for analytics services. These analytics services may use cookies to help us analyze how users use the Services. Information generated by these services (e.g., your browser, device, and usage data) may be transmitted to and stored by Google Analytics and other service providers on servers in the U.S. (or elsewhere) and these service providers may use this information for purposes such as evaluating your use of our Services, compiling statistic reports on our Services’ activity, and providing other services relating to Services activity and other Internet usage. You may exercise choices regarding the use of cookies from Google Analytics by going to https://tools.google.com/dlpage/gaoptout or by downloading the Google Analytics Opt-out Browser Add-on.
• Targeting/Advertising. These third-party cookies are placed by third-party advertising platforms or networks to deliver ads and track ad performance, enabling advertising networks to deliver ads that may be relevant to you based upon your activities (sometimes called “targeted advertising”) on the Services.

Analytics

We also use various types of tools and online analytics including Google Maps and Google Analytics. Google Analytics is a web analytics service provided by Google, Inc. (“Google”) that uses cookies or other tracking technologies to help us analyze how users interact with and use the website, compile reports on the related activities, and provide other services related to website and app activity and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a return visitor, and any referring website or app. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google’s privacy policies. To learn more about Google’s partner services and to learn how to opt-out of tracking of analytics by Google click here.

Do Not Track

Various third parties are developing or have developed signals or other mechanisms for the expression of consumer choice regarding the collection of information about an individual consumer's online activities over time and across third-party websites or online services (e.g., browser “Do Not Track” signals). Currently, we do not monitor or take any action with respect to these signals or other mechanisms, unless otherwise required by applicable law.

You may have certain choices and rights regarding our collection, use, and disclosure of your personal information, based on your location or place of residency.

A. Privacy Rights

Certain states provide residents rights with certain rights with respect to their personal information. Please review California Privacy Notice; Nevada Privacy Notice; Privacy Notice for Residents of Other States; and International Privacy Notices for more information.

You can exercise the rights described in this Privacy Policy by:

• Completing our webform
• Emailing support@ongoody.com

All requests are subject to certain exceptions under applicable law. Consistent with applicable law, you may designate an authorized agent to submit a request on your behalf, and if so, we may require proof of the agent’s authorization by you and/or verification of the agent’s own identity. Please note that any request you submit to us is subject to an identification and residency verification process, to the extent permitted under applicable law. We will only use personal information provided in a verifiable or authenticated consumer request to verify your (or your authorized agent’s as applicable) identity or authority to make the request.

We will respond and process consumer requests consistent with applicable law. Except where otherwise noted, we will respond to your request within forty-five (45) calendar days after receipt and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days.

We do not charge a fee to process or respond to a consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that a request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. You may be limited in how many verifiable or authenticated consumer requests you make within a twelve (12) month period.

B. Privacy Choices

We offer you certain choices in connection with our Services.

Email Communications / Direct Marketing

You may have the opportunity to receive certain email communications from us related to our Services. If you provide us with your email address in order to receive communications, you can opt-out of marketing emails at any time by following the instructions at the bottom of our emails and adjusting your email preferences. Please note that certain emails may be necessary for the operation of our Services. You will continue to receive these necessary emails, if lawful and appropriate, even if you unsubscribe from our optional marketing communications.

Text Messages

You may have the opportunity to receive certain text message communications from us related to our Services. You can opt-out of receiving text messages at any time by following the instructions in the message or by replying “STOP” or by emailing support@ongoody.com.

User Profiles

When you create an account with Goody, you will be given the opportunity to create a “User Profile” and when you do so we may ask you to provide information about yourself such as a username, name, email address, and phone number. Creating a User Profile is optional. Email address and phone numbers are not public and you may decide whether you want your user name to be public (as described below).

Once your User Profile is created, you may elect to turn “on” or “off” the option to “allow receiving gifts via username”, which will make your username publicly searchable. If you turn this option “on” then other Goody users will be able to view your User Profile by searching for your username and will be able to send you gifts using your username. If you turn this option “off” then your username will not be searchable by other Goody users and other Goody users will not be able to send you gifts using your username. In either case, you will still be able to send and receive gifts using your phone number.

This Privacy Policy does not apply to third-party websites, applications, products, services, or other properties, even if they may link to our Services or vice versa. We recommend you review the privacy practices of those third parties before connecting with and/or accessing third-party offerings, and before sharing any personal information with those third parties.

This California Privacy Notice supplements the information contained in the rest of our Privacy Policy and is intended to comply with the California Consumer Privacy Act of 2018 (“CCPA”). Any capitalized term used and not otherwise defined below has the meaning assigned to it in our Privacy Policy. For the purposes of this California Privacy Notice, except where a different definition is noted, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information does not include publicly available information, information that has been de-identified or aggregated, or other information subject to certain federal and state regulations.

A. Personal information We Collect

We have collected the following categories of personal information from consumers within the last twelve (12) months:

• Identifiers
• Commercial information
• Internet or other electronic network activity information
• Geolocation data
• Audio, electronic, visual, or similar information
• Categories listed in the California Consumer Records statute (Cal. Civ. Code § 1798.80(e)) (i.e., financial data)
• Characteristics of protected classifications under California or federal law
• Professional or employment-related information
• Inferences

B. How We Use Personal information

We may use or disclose the personal information we collect for one or more of the following purposes:

C. To Whom We Disclose Personal information

We limit our disclosure of the categories of personal information above to our service providers for one or more business purposes. “Business purposes” means the reasonably necessary and proportionate use of personal information for our operational purposes, other purposes described in this Privacy Policy, for the operational purposes of our service providers and contractors, as well as other purposes compatible with the context in which the personal information was collected.

We may “sell” and/or “share” personal information with third-party advertising networks and platforms for purposes of providing targeted behavioral advertising on those platforms. We may also “sell” and/or “share” personal information to Third-Party Business Partners for marketing and promotional purposes.

In the last twelve (12) months from the last updated date listed at the top of this Privacy Policy, we have “sold” or “shared” the following categories of personal information:

• Identifiers
• Commercial information
• Internet or other electronic network activity information
• Geolocation data
• Audio, electronic, visual, or similar information
• Characteristics of protected classifications under California or federal law
• Professional or employment information
• Inferences

D. Retention of Personal information

Your personal information will be retained by us for as long as necessary for the purposes outlined in this Privacy Policy. This information will be used and retained to the extent necessary to comply with any legal obligations or policies, to resolve disputes, and/or enforce legal agreements. Personal information may also be retained for internal analytic purposes. This information is retained for a shorter period, unless it used to enhance security features or improve the functionality of our Services. Our determination of precise retention periods will be based on (i) the length of time we have an ongoing relationship with you; (ii) whether there is a legal obligation to which we are subject; and (ii) whether retention is advisable considering our legal position, including with regard to applicable statutes of limitations, litigation or regulatory investigations.

Note that personal information sent to or collected through AI Features may be processed ephemerally within the AI model/services provider model(s), but will not be retained by the AI model/services provider.

E. Privacy Rights

The CCPA provides California residents with specific rights regarding their personal information. If you are a California resident, you may have the following rights under applicable California law:

• Right to know and access. You have the right to know what personal information we collect, use, disclose, and sell and/or share, as those terms are defined under applicable law. You may ask us to provide you a portable copy of this information up to two times in a rolling twelve-month period.
• Right to delete. Under certain circumstances, you have the right to request that we, as well as our service providers and contractors, delete the personal information that we collect about you.
• Right to correct. You have the right to request the correction of inaccurate personal information.
• Right to limit. You have the right to limit the use or disclosure of your sensitive personal information to only the uses necessary for us to provide goods or services to you. We will not use or disclose your sensitive personal information after you have exercised your right, unless you subsequently provide consent for the use of your sensitive personal information for additional purposes. We do not intentionally collect sensitive personal information.
• Right to opt out. You have the right to opt out of our sale and/or sharing of your personal information.
• Sharing with third parties for their own direct marketing purposes. You have the right to request information regarding third parties to whom we have disclosed certain categories of personal information during the preceding year for the third parties’ direct marketing purposes under California’s “Shine the Light” law (Cal. Civ. Code §1798.83). If you wish to request information regarding such practices, please Contact Us. You must include your full name, email address, and postal address in your email or mail request so that we can verify your California residence and respond. California’s “Shine the Light” law also provides you the right to opt-out of such disclosures on a going forward basis. You may exercise this right as referenced above under “right to opt out.”
• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

F. How to Exercise Your Rights

Please send your request(s) to exercise your California privacy rights by following the instructions in Your Privacy Rights and Choices. For requests to know/access, delete, and correct, we will confirm receipt of your request within ten (10) business days. We will respond to your request within forty-five (45) calendar days after receipt and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days. For requests to opt out of sale/sharing and requests to limit, we will fulfill your request within fifteen (15) business days from the date we receive your request.

G. Notice of Right to Opt-out of Sale/Sharing

California residents may opt out of the “sale” or “sharing” of their personal information. As noted above, we may “sell” and/or “share” personal information with third party advertising networks and platforms for purposes of providing targeted behavioral advertising on those platforms, Third-Party Business Partners for marketing and promotional purposes. You may opt out by following the instructions in Your Privacy Rights and Choices.

We do not knowingly sell or share the personal information of individuals under 16 years of age.

H. Notice of Financial Incentives

We may provide offers, such as promotional campaigns, email newsletters, and referral programs. Because this involves collection of personal information and offering of certain benefits, they might be interpreted as a “financial incentive” program under California law. Such programs may include:

• Email Newsletter. When you subscribe to our newsletter, we may offer you special savings in the form of digital coupons for free or discounted products and announcements of sweepstakes, contests, and giveaways. You may opt in to the email newsletter on our Sites. To receive the newsletter, you must provide a valid email address. To opt out of our newsletter, please click “unsubscribe” located at the bottom of any email newsletter. If you withdraw from this incentive, we will not contact you for at least twelve (12) months before requesting your participation again.
• Referral program. We may offer digital coupons for free or discounted products, store credit, or gift cards through our referral program, which is available to users with a Goody account. You may participate in the referral program by logging into your account, visiting the referrals tab, and entering a friends’ work email. The referral program terms are available here. When you sign up, you will be asked to provide your email address.

The value we place on personal information collected for these promotions varies, but we estimate it equals the additional spending per promotion participant, compared to individuals for whom we do not have email addresses, shopping history and preferences, or other collected information.

We may “sell” personal information as that term is defined under Nevada law. Nevada residents have the right to opt out of any future sale of their personal information under Nevada SB 220. If you are a Nevada resident and would like to make such a request, please email us at support@ongoody.com. You must include your full name, email address, and postal address in your email or mail request so that we can verify your Nevada residence and respond.

This section contains additional information for residents of Alabama (beginning May 1, 2027), Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma (beginning January 1, 2027), Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia about personal information that we collect, how we use it, what sources it is derived from, and who we disclose it to, and provides information regarding your rights, and our responsibilities, under applicable laws and regulations.

The provisions contained within this section, in addition to the disclosures throughout the rest of this Privacy Policy, are intended to provide notices in compliance with Alabama Personal Data Protection Act (beginning May 1, 2027), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Delaware Personal information Privacy Act, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Kentucky Data Protection Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, the Nebraska Data Privacy Act, the New Hampshire Data Privacy Act, the New Jersey Privacy Act, the Oklahoma Consumer Data Privacy Act (beginning January 1, 2027), the Oregon Consumer Data Privacy Act, the Rhode Island Data Transparency and Privacy Protection Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act, as may be amended from time to time (collectively, the “State Privacy Laws”).

This section does not apply to certain personal information that is collected from an individual in a business-to-business or employment context.

A. Personal information Practices

The State Privacy Laws provide rights to residents of those states to receive certain disclosures and access regarding collection, use, sale, and sharing of personal information. More detail about what kinds of personal information we collect or have collected, how we collect it, why we collect it, and who we may disclose it to is found in the Personal information We Collect, Use, and Disclose; Sources of Personal information; and Disclosure of Personal information sections of this Privacy Policy.

We may “sell” personal information to (i) third party advertising networks and platforms for purposes of providing targeted behavioral advertising on those platforms; and (ii) Third-Party Business Partners for marketing and promotional purposes.

B. Privacy Rights

If you are an Alabama, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia resident, you have or will have the following rights under applicable law in relation to your personal information, subject to certain exceptions:

• Right to know and access. You have the right to know what personal information we collect, use, disclose, and/or sell or share as those terms are defined under applicable law. You may ask us to provide you a portable copy of this information up to two times in a rolling twelve-month period. Residents of Delaware, Maryland, Minnesota, and Oregon have the right to obtain a list of specific third parties to which we have disclosed personal information.
• Right to delete and erase. You have the right to request under certain circumstances that we, as well as our service providers and contractors, delete the personal information that we collect about you.
• Right to correct inaccurate personal information. If you are a resident of Connecticut, Colorado, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Jersey, New Hampshire, Oregon, Rhode Island, Tennessee, Texas, or Virginia, you have the right to request the correction of inaccurate personal information.
• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.
• Right to opt out. You have the right to opt out of targeted advertising, our sale of your personal information, and profiling decisions that could produce legal or similarly significant effects concerning you.
• Rights concerning sensitive personal information. If you are an Alabama, Connecticut, Colorado, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Jersey, New Hampshire, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, or Virginia resident, we cannot process your sensitive data or your sensitive data inferences, or use your personal information for certain purposes without your affirmative consent. If you are an Iowa or Utah resident, you have the right to opt out of having your sensitive personal information processed. As mentioned above, we do not intentionally collect sensitive personal information.

C. Exercising Your Rights

You may exercise any of the rights described in this section by following the instructions in Your Privacy Rights and Choices.

D. Appealing Decisions About Your Rights

Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma (beginning January 1, 2027), Oregon, Rhode Island, Tennessee, Texas, and Virginia residents can appeal our decisions concerning privacy rights requests, as follows:

• Colorado residents. If you are a Colorado resident and want to appeal our decision about a request that you have made, please Contact Us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Colorado’s Office of the Attorney General by phone at (720) 508-6000 or by submitting a form here.
• Connecticut residents. If you are a Connecticut resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Connecticut’s Office of the Attorney General by phone at (860) 808-5420 or by submitting a form here.
• Delaware residents. If you are a Delaware resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Delaware’s Department of Justice by phone at (302) 683-8800 or by submitting a form here.
• Indiana residents. If you are an Indiana resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Indiana’s Office of the Attorney General by phone at (800) 457-8283 or by submitting a form here.
• Iowa residents. If you are an Iowa resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Iowa’s Office of the Attorney General by phone at (888) 777-4590 or by submitting a form here.
• Kentucky residents. If you are a Kentucky resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Kentucky’s Office of the Attorney General by phone at (888) 432-9257or by submitting a form here.
• Maryland residents. If you are a Maryland resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Maryland’s Office of the Attorney General by phone at (888) 743-0023 or by submitting a form here.
• Minnesota residents. If you are a Minnesota resident and want to appeal our decision about a request that you have made, please Contact Us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Minnesota’s Office of the Attorney General by phone at (800) 657-3787 or by submitting a form here.
• Montana residents. If you are a Montana resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Montana’s Office of the Attorney General by phone at (406) 444-4500 or by submitting a form here.
• Nebraska residents. If you are a Nebraska resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Nebraska’s Office of the Attorney General by phone at (402) 471-2683 or by submitting a form here.
• New Hampshire residents. If you are a New Hampshire resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact New Hampshire’s Office of the Attorney General by phone at (603) 271-3658 or by submitting a form here.
• New Jersey residents. If you are a New Jersey resident and want to appeal our decision about a request that you have made, please Contact Us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact New Jersey’s Office of the Attorney General by phone at (800) 242-5846 or by submitting a form here.
• Oklahoma residents. If you are an Oklahoma resident and want to appeal our decision with regard to a request that you have made, please Contact Us. Within sixty (60) days of receipt of the appeal, we will inform you in writing of any action taken or not taken, including an explanation of reasons in reaching the decision. If the appeal is denied, you may contact Oklahoma’s Office of the Attorney General by phone at (405) 521-3921 or by submitting a form here.
• Oregon residents. If you are an Oregon resident and want to appeal our decision about a request that you have made, please Contact Us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Oregon’s Office of the Attorney General by phone at (877) 877-9392 or by submitting a form here.
• Rhode Island residents. If you are a Rhode Island resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an Rhode Island’s Office of the Attorney General by phone at (401) 274-4400 or by submitting a form here.
• Tennessee residents. If you are a Tennessee resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Tennessee’s Office of the Attorney General by phone at (615) 741-3491 or by submitting a form here.
• Texas residents. If you are a Texas resident and want to appeal our decision about a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Texas’ Office of the Attorney General by phone at (800) 621-0508 or by submitting a form here.
• Virginia residents. If you are a Virginia resident and want to appeal our decision about a request that you have previously made, please Contact Us or notify the Office of the Attorney General of Virginia online here. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons for reaching the decision. If the appeal is denied, you may contact Virginia’s Office of the Attorney General by phone at (804) 786-2071, written correspondence to 202 North 9th Street, Richmond, Virginia 23219, or online here.

Certain jurisdictions provide individuals rights with respect to their personal information. Note that we are providing the following disclosures and rights regarding personal information in the interest of transparency and our commitment to privacy; such disclosures and rights are not intended to waive any exemptions under applicable laws.

For the purposes of international privacy laws, Goody Technologies, Inc. is the controller of the personal information that is subject to this Privacy Policy. Our contact information is available below.

A. Legal Bases for Processing

We rely on one or more legal bases to process your personal information under applicable law. We may process personal information: (i) as necessary to perform our contractual obligations to you, including, but not limited to, those obligations in our Terms of Service; (ii) as necessary to pursue our legitimate business interests as further detailed below; (iii) as necessary for our compliance with our legal obligations such as a request or order from courts, law enforcement, or other government authorities; and/or (iv) with your consent.

We may collect, process, and maintain personal information to pursue the legitimate business interests outlined below. To determine these legitimate interests, we balance our legitimate interests against the legitimate interests and rights of you and others and only process personal information in accordance with those interests where they are not overridden by your data-protection interests or fundamental rights and freedoms. Our legitimate interests generally include:

• Providing, improving, and developing our Services, including to deliver your requested services, send you messages and provide user support, customize the Services to better fit your needs as a user, develop new products and services, and perform internal analytics and research and development. This also includes sharing personal information with our trusted service providers that provide services on our behalf.
• Protecting you and others and to create and maintain a trusted environment, such as to comply with our legal obligations, to ensure compliance with our agreements with you and other third parties, to ensure safe, secure, and reliable Services, and to detect and prevent wrongdoing and crime, assure compliance with our policies, and protect and defend our rights, interests, and property. In connection with the activities above, we may conduct internal research based on your interactions on various Services, content you submit to the Services, and information obtained from third parties.
• Providing, personalizing, measuring, and improving our marketing, including to send you promotional messages and other information that may be of interest to you with your consent. We may also use personal information to understand our user base and the effectiveness of our marketing. This processing is done pursuant to our legitimate interest in undertaking marketing activities to offer products or services that may be of interest to you.

B. Notice to Individuals in the EEA, UK, and Switzerland

This notice applies to any individuals located within the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland about whom we may have collected personal information from any source, including through your use of our Services. We provide this notice in addition to the disclosures throughout the rest of this Privacy Policy to comply with the General Data Protection Regulation (“GDPR”), the UK GDPR, Switzerland’s Federal Act on Data Protection, and related laws, regulations, and guidance from the European Union and/or its member states.

In certain circumstances, individuals located within the EEA, UK, and Switzerland have following privacy rights, subject to certain exceptions:

• Right to access. You have the right to request confirmation of whether we process personal information relating to you, and if so, to request a copy of that personal information.
• Right to erasure. You have the right to request that we erase your personal information in certain circumstances provided by law.
• Right to rectification. You have the right to request to have your personal information corrected or updated if that information is inaccurate, outdated, or incomplete.
• Right to object. You have the right to object to our processing of your personal information.
• Right to restrict. You have the right to request that we restrict the processing of your personal information.
• Right to data portability. You have the right to request that we provide you with a copy of your personal information in a structured, machine-readable, and commonly used format.
• Right to withdraw consent. You have the right to withdraw your consent at any time where we rely on your consent to process your personal information.
• Right to lodge complaint. You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority.
  • A list of EU supervisory authorities is available here.
  • The relevant UK supervisory authority is the UK Information Commissioner’s Officer.
  • The relevant Swiss supervisory authority is the Federal Data Protection and Information Commissioner.

To exercise your privacy rights described above, please email support@ongoody.com. Any request you submit to us is subject to an identification and residency verification process as permitted under applicable law. Additionally, all requests are subject to certain exceptions under applicable law, which may vary.

B. Notice to Individuals in Canada

This notice applies to individuals in Canada about whom we may have collected personal information. We provide this notice in addition to the disclosures throughout the rest of this Privacy Policy to comply with applicable laws, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and/or provincial privacy laws. For the purposes of this notice, "personal information" means information about an identifiable individual. Personal information does not include any business contact information that is solely used to communicate with you in relation to your employment, business or profession, such as your name, position name or title, work address, work telephone number, or work email address. Personal information also does not include information that has been de-identified, anonymized, or aggregated in such a way that there is no serious possibility it can be used to identify an individual, whether on its own or in combination with other available information.

In certain circumstances, individuals in Canada are entitled to the following privacy rights:

• Right to Access. You have the right to request confirmation of whether we process personal information relating to you, and if so, to request a copy of that personal information.
• Right to Correct. You have the right to request to have your personal information corrected or updated if that information is inaccurate, outdated, or incomplete.
• Right to Withdraw Consent. If you have already consented to the collection, use, and/or disclosure of your personal information, you may subsequently withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.

To exercise your privacy rights described above, please email support@ongoody.com. Any request you submit to us is subject to an identification and residency verification process as permitted under applicable law. Additionally, all requests are subject to certain exceptions under applicable law, which may vary.

If you have any questions or concerns about our privacy practices, please email us at support@ongoody.com. You may also contact the Office of the Privacy Commissioner at (800) 282-1376 if you are unsatisfied with our response to your privacy concern.

C. Notice to Individuals in Australia or New Zealand

This notice applies to any individuals located within Australia and New Zealand about whom we may have collected personal information. We provide this notice in addition to the disclosures throughout the rest of this Privacy Policy to comply with applicable laws, including the Australia Privacy Act 1988 and the New Zealand Privacy Act 2020.

In certain circumstances, individuals located in Australia and New Zealand have the following privacy rights, subject to certain exceptions:

• Right to access. You have the right to request confirmation of whether we process personal information relating to you, and if so, to request a copy of that personal information.
• Right to correct. You have the right to request to have your personal information corrected or updated if that information is inaccurate, outdated, or incomplete.

To exercise your privacy rights described above, please email support@ongoody.com. Any request you submit to us is subject to an identification and residency verification process as permitted under applicable law. Additionally, all requests are subject to certain exceptions under applicable law, which may vary.

We welcome questions, comments, and feedback on this Privacy Policy and our management of personal information. If you have questions, concerns, or feedback, you can always contact us by emailing us support@ongoody.com. For your protection, we may need to verify your identity before assisting with your request, such as verifying that the information used to contact us matches the information that we have on file.