US State Privacy Rights Notice

1. CALIFORNIA RESIDENTS (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), provides you with specific rights regarding your personal information. This section describes those rights and explains how to exercise them.

Right to Know

You have the right to request that ByMyHonor disclose the following information about our collection and use of your personal information over the past twelve (12) months:

• The categories of personal information we have collected about you.
• The specific pieces of personal information we have collected about you.
• The categories of sources from which we collected your personal information.
• The business or commercial purpose for which we collected or sold your personal information.
• The categories of third parties with whom we share your personal information.
• The categories of personal information that we disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

Right to Delete

You have the right to request that ByMyHonor delete your personal information, subject to certain exceptions. Upon receiving a verified request, we will delete your personal information from our records and direct any service providers to do the same, unless an exception applies.

Exceptions to deletion: We may retain your personal information if it is necessary to:

• Complete the transaction for which the personal information was collected, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise his or her right to free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (CalECPA).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws.
• Enable internal uses that are reasonably aligned with your expectations based on your relationship with us.
• Comply with a legal obligation.
• Use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Note: ByMyHonor's Section 9 (Account Closure and Data Retention) describes our seven (7) year deletion countdown for Honor Notes and account data, which applies to California residents in addition to the CCPA/CPRA deletion rights described here.

Right to Correct

You have the right to request that ByMyHonor correct inaccurate personal information that we maintain about you. Upon receiving a verified request, we will use commercially reasonable efforts to correct the inaccurate personal information as you direct.

Right to Opt-Out of Sale or Sharing

You have the right to direct ByMyHonor not to sell or share your personal information to third parties. ByMyHonor does not sell your personal information as defined by the CCPA/CPRA. We do not share your personal information for cross-context behavioral advertising purposes as defined by the CPRA.

If we were to sell or share your personal information in the future, we would provide you with an opt-out mechanism. We honor Global Privacy Control (GPC) signals as a valid opt-out request.

Right to Limit Use of Sensitive Personal Information

You have the right to direct ByMyHonor to limit its use of your sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average requestor. ByMyHonor does not use sensitive personal information for purposes other than those necessary to provide the Service.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Categories of Personal Information Collected

In the preceding twelve (12) months, ByMyHonor has collected the following categories of personal information as defined by the CCPA/CPRA:

• Identifiers: Name, email address, physical address, phone number, account ID, IP address, device identifiers.
• Personal Information (Cal. Civ. Code § 1798.80(e)): Name, address, telephone number.
• Protected Classifications: Gender, age (if you provide your birth date).
• Commercial Information: Transaction history, credit purchases, voucher placements.
• Internet/Electronic Network Activity: Browsing history, search history, interaction with our Service, device information.
• Geolocation Data: Approximate location derived from IP address; precise location if enabled through device settings.
• Audio/Electronic/Visual Information: Profile photos, validation video recordings, honor note content.
• Professional or Employment Information: Business information if you represent a business on ByMyHonor.
• Inferences: Honor Score, Validation Level, account tier, activity patterns.

Categories Sold or Shared

ByMyHonor has not sold or shared (for cross-context behavioral advertising) consumers' personal information in the preceding twelve (12) months.

Retention Periods

We retain personal information as described in Section 9 of our Privacy Policy. Specific retention periods applicable to California residents include:

• Account data: Life of account plus seven (7) years after deletion.
• Transaction records: Seven (7) years from transaction date.
• Validation documents: Life of account plus seven (7) years after deletion.
• Cookies and tracking data: Thirty (30) days after account closure.

2. COLORADO RESIDENTS (CPA)

If you are a Colorado resident, the Colorado Privacy Act (CPA) provides you with specific rights regarding your personal data. This section describes those rights and explains how to exercise them.

Right to Access

You have the right to confirm whether ByMyHonor is processing your personal data and to access such personal data. Upon a verified request, we will provide you with:

• The categories of personal data we have processed about you.
• The specific pieces of personal data we have processed about you.
• The purposes for processing your personal data.
• The categories of third parties to whom we have disclosed your personal data.

Right to Correction

You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes for which we process it.

Right to Deletion

You have the right to delete personal data provided by or obtained by ByMyHonor about you, subject to certain exceptions including completing a transaction, detecting security incidents, exercising free speech, and complying with legal obligations.

Right to Data Portability

You have the right to obtain your personal data in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance.

Right to Opt-Out of Targeted Advertising

You have the right to opt out of the processing of your personal data for targeted advertising. ByMyHonor does not process personal data for targeted advertising as defined by the CPA. We honor Global Privacy Control (GPC) signals.

Right to Opt-Out of Sale

You have the right to opt out of the sale of your personal data. ByMyHonor does not sell your personal data as defined by the CPA.

Right to Opt-Out of Profiling

You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. ByMyHonor does not engage in profiling that produces legal or similarly significant effects.

Universal Opt-Out Mechanism

ByMyHonor recognizes and honors Global Privacy Control (GPC) signals as a valid opt-out request under the CPA.

3. CONNECTICUT RESIDENTS (CTDPA)

If you are a Connecticut resident, the Connecticut Data Privacy Act (CTDPA) provides you with specific rights regarding your personal data. This section describes those rights and explains how to exercise them.

Right to Access

You have the right to confirm whether ByMyHonor is processing your personal data and to access such personal data. Upon a verified request, we will provide you with the categories and specific pieces of personal data processed.

Right to Correct

You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes for which we process it.

Right to Delete

You have the right to delete personal data provided by or obtained by ByMyHonor about you, subject to certain exceptions including completing a transaction, detecting security incidents, exercising free speech, and complying with legal obligations.

Right to Data Portability

You have the right to obtain your personal data in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance.

Right to Opt-Out of Targeted Advertising

You have the right to opt out of the processing of your personal data for targeted advertising. ByMyHonor does not process personal data for targeted advertising as defined by the CTDPA. We honor Global Privacy Control (GPC) signals.

Right to Opt-Out of Sale

You have the right to opt out of the sale of your personal data. ByMyHonor does not sell your personal data as defined by the CTDPA.

Right to Opt-Out of Profiling

You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. ByMyHonor does not engage in profiling that produces legal or similarly significant effects.

Universal Opt-Out Mechanism

ByMyHonor recognizes and honors Global Privacy Control (GPC) signals as a valid opt-out request under the CTDPA.

4. VIRGINIA RESIDENTS (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act (VCDPA) provides you with specific rights regarding your personal data. This section describes those rights and explains how to exercise them.

Right to Access

You have the right to confirm whether ByMyHonor is processing your personal data and to access such personal data. Upon a verified request, we will provide you with the categories and specific pieces of personal data processed.

Right to Correct

You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes for which we process it.

Right to Delete

You have the right to delete personal data provided by or obtained by ByMyHonor about you, subject to certain exceptions including completing a transaction, detecting security incidents, exercising free speech, and complying with legal obligations.

Right to Data Portability

You have the right to obtain your personal data in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance.

Right to Opt-Out of Targeted Advertising

You have the right to opt out of the processing of your personal data for targeted advertising. ByMyHonor does not process personal data for targeted advertising as defined by the VCDPA. We honor Global Privacy Control (GPC) signals.

Right to Opt-Out of Sale

You have the right to opt out of the sale of your personal data. ByMyHonor does not sell your personal data as defined by the VCDPA.

Right to Opt-Out of Profiling

You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. ByMyHonor does not engage in profiling that produces legal or similarly significant effects.

Universal Opt-Out Mechanism

ByMyHonor recognizes and honors Global Privacy Control (GPC) signals as a valid opt-out request under the VCDPA.

5. UTAH RESIDENTS (UCPA)

If you are a Utah resident, the Utah Consumer Privacy Act (UCPA) provides you with specific rights regarding your personal data. This section describes those rights and explains how to exercise them.

Right to Access

You have the right to confirm whether ByMyHonor is processing your personal data and to access such personal data. Upon a verified request, we will provide you with the categories and specific pieces of personal data processed.

Right to Delete

You have the right to delete personal data provided by or obtained by ByMyHonor about you, subject to certain exceptions including completing a transaction, detecting security incidents, exercising free speech, and complying with legal obligations.

Right to Data Portability

You have the right to obtain your personal data in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance.

Right to Opt-Out of Targeted Advertising

You have the right to opt out of the processing of your personal data for targeted advertising. ByMyHonor does not process personal data for targeted advertising as defined by the UCPA. We honor Global Privacy Control (GPC) signals.

Right to Opt-Out of Sale

You have the right to opt out of the sale of your personal data. ByMyHonor does not sell your personal data as defined by the UCPA.

Universal Opt-Out Mechanism

ByMyHonor recognizes and honors Global Privacy Control (GPC) signals as a valid opt-out request under the UCPA.

6. HOW TO EXERCISE YOUR RIGHTS

You may exercise any of the rights described in this notice by contacting us using the following methods:

When submitting a request, please provide:

• Your full name and email address associated with your ByMyHonor account.
• The specific right you are exercising (access, deletion, correction, opt-out, etc.).
• Any additional information that may help us locate your account (e.g., account ID).

We will acknowledge receipt of your request within ten (10) business days and will substantively respond within forty-five (45) days. If we need additional time to respond, we may extend the response period by an additional forty-five (45) days, for a total of ninety (90) days, and we will notify you of the extension.

7. VERIFICATION OF IDENTITY

To protect your privacy and security, we will verify your identity before processing your request. The verification process may include:

• Matching information you provide with information we have on file.
• Requesting additional information to confirm your identity.
• Asking you to log into your ByMyHonor account as part of the verification process.

If we cannot verify your identity, we may not be able to fulfill your request. We will inform you if we are unable to verify your identity and explain why.

Authorized Agents: If you are an authorized agent submitting a request on behalf of a California resident, we may require proof of your written authorization and may contact the consumer to verify the authorization.

8. AUTHORIZED AGENTS

Under the CCPA/CPRA, California residents may designate an authorized agent to make requests on their behalf. To designate an authorized agent:

• The authorized agent must provide written authorization signed by the consumer.
• We may require the consumer to verify their identity directly with us.
• We may deny the request if the authorized agent does not provide proof of authorization.

For Colorado, Connecticut, Virginia, and Utah residents, authorized agents may submit requests on your behalf. We may require verification of both the consumer's identity and the agent's authorization.

9. APPEALS PROCESS

If you are a resident of Colorado, Connecticut, or Virginia and we decline to take action on your privacy request, you have the right to appeal our decision. To submit an appeal:

• Send your appeal to privacy@bymyhonor.com with the subject line "Privacy Request Appeal."
• Include the original request details and the reason you believe we should reconsider our decision.
• We will respond to your appeal within sixty (60) days.

If your appeal is denied, you may contact the relevant state attorney general's office:

• Colorado: Colorado Attorney General — www.coloradoattorneygeneral.gov
• Connecticut: Connecticut Attorney General — portal.ct.gov/ag
• Virginia: Virginia Attorney General — www.oag.state.va.us

10. NON-DISCRIMINATION

ByMyHonor will not discriminate against you for exercising any of your privacy rights. We will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services.
• Provide you a different level or quality of goods or services.
• Suggest that you will receive a different price or rate for goods or services.
• Retaliate against you for exercising your privacy rights.

11. FINANCIAL INCENTIVES

ByMyHonor does not offer financial incentives associated with our collection, use, or disclosure of your personal information. We do not offer different prices, rates, levels, or quality of goods or services based on your participation in a financial incentive program.

12. SHINE THE LIGHT (CALIFORNIA CIVIL CODE § 1798.83)

Under California Civil Code Section 1798.83 (the "Shine the Light" law), California residents may request and receive information about our disclosures of personal information to third parties for their direct marketing purposes during the preceding calendar year. ByMyHonor does not share personal information with third parties for their direct marketing purposes.

To request this information, please contact us at privacy@bymyhonor.com with the subject line "Shine the Light Request."

13. DO NOT TRACK DISCLOSURES

Some web browsers have a "Do Not Track" (DNT) feature that signals to websites you visit that you do not want to have your online activity tracked. At this time, there is no universally accepted standard for how companies should respond to DNT signals. However, ByMyHonor honors Global Privacy Control (GPC) signals as a valid opt-out of targeted advertising and sale requests under applicable state privacy laws.

To opt out of targeted advertising through GPC, ensure that the GPC signal is enabled in your browser settings. ByMyHonor will automatically process GPC signals as a valid opt-out request.