Privacy Policy

Last updated: October 13th, 2026

This privacy notice for On Me Gifting Inc. and Secure Gift Holdings LLC (collectively, "we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

• Visit our website at onme.com, business.onme.com, or any website of ours that links to this privacy notice;
• Download or use our mobile application ("On Me App"), or any application of ours that links to this privacy notice;
• Engage with us in other related ways, including any sales, marketing, or events;
• Send, receive, view, or interact with gifts through our Services, including gifts displayed on public gift feeds (consumer Services only);
• Access or use the On Me Business Portal as an Organization or as an Authorized User (Org Admin or Gift Sender) of an Organization;
• Receive a gift sent through the Business Portal as a designated Recipient.

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. For general questions, contact us at info@onme.com. For Business Portal privacy matters, including DPA requests and controller/processor questions, contact us at privacy@onme.com.

SUMMARY OF KEY POINTS

This summary provides key points from our privacy notice; details follow each topic below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information? We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law, including your date of birth, which we collect at signup to verify your age, satisfy card-network and KYC requirements, secure your account, and (if you opt in) display your birthday — month and day only — on your public profile.

Is my profile public? Consumer accounts belonging to users 18 or older have a public profile by default, showing your name, username, profile photo, and public gift activity to anyone who knows your handle, including people who are not signed in. You can make your profile private at any time in your account settings. Accounts belonging to users aged 13 to 17 are private by default. See sections 1, 3, and 10.

Do you upload my phone's contacts? Only if you turn on Sync Contacts in the On Me app, which uploads each contact's name, one phone number, one email address, and birthday. We never sell or share them, or market to your contacts. See sections 1, 7, and 10.

What happens when I redeem a gift? We tell the sender that the gift was claimed and disclose the name, username, and profile photo on the account used to redeem it. This happens for every gift, including private gifts, and regardless of your Profile Visibility setting. See section 3.

Do we receive any information from third parties? We may receive information from public databases, marketing partners, social media platforms, Organizations using our Business Portal, and other outside sources. On our public marketing pages we also use a business identity-resolution vendor that can tell us the name, work email, and employer of a visitor who never filled out a form. See sections 1 and 5.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties.

Do we sell or share your personal information? We never sell personal information for money. We do "share" online identifiers and browsing activity with advertising, attribution, affiliate, and business identity-resolution vendors for cross-context behavioral advertising, which counts as "sharing" (and in some states a "sale") under U.S. state privacy laws. You can opt out, including by turning on Global Privacy Control in your browser. We never sell or share Recipient Data, your date of birth, your mobile number, your precise location, gift content, session recordings, or the information of anyone we know to be under 18. See sections 3, 5, 11, and 12.

Do we record your session? On our web pages we use session-replay technology that records a reconstruction of your clicks, scrolling, and navigation to help us diagnose errors and improve usability, with sensitive fields masked. See section 5.

How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information, but cannot guarantee 100% security.

What are your rights? Depending on where you are located, applicable privacy law may give you certain rights regarding your personal information.

How do you exercise your rights? Submit a data subject access request, or contact us. We will consider and act on any request in accordance with applicable data protection laws.

• Are you an Organization or Authorized User using the Business Portal? A specific set of practices applies — including a controller/processor framework, a no-public-gifts carve-out, and an available Data Processing Addendum. See §13.
• Are you a Recipient of a Business Portal gift? Your contact information was provided to us by the Organization that sent you the gift. We process it on the Organization's behalf to deliver the gift to you. See §13.

Want to learn more about what we do with any information we collect? Review the privacy notice in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
4. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?
7. HOW LONG DO WE KEEP YOUR INFORMATION?
8. HOW DO WE KEEP YOUR INFORMATION SAFE?
9. DO WE COLLECT INFORMATION FROM MINORS?
10. WHAT ARE YOUR PRIVACY RIGHTS?
11. CONTROLS FOR DO-NOT-TRACK FEATURES AND UNIVERSAL OPT-OUT SIGNALS
12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
13. BUSINESS PORTAL: ORGANIZATIONS, AUTHORIZED USERS, AND RECIPIENT DATA
14. INTERNATIONAL DATA TRANSFERS
15. DO WE MAKE UPDATES TO THIS NOTICE?
16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us. We collect personal information that you voluntarily provide when you register on the Services, express interest in our products, participate in activities on the Services, or contact us.

The personal information we collect may include:

• names
• phone numbers
• email addresses
• mailing addresses
• usernames
• passwords
• contact preferences
• contact or authentication data
• billing addresses
• debit/credit card numbers
• Sensitive Information
• Profile Photos
• Usernames / Handles
• Gift visibility preferences (public, private)
• Gift content and associated media (text messages, photos, GIFs, voice notes, videos) included in gifts you send or receive
• Social feed interactions (likes, content flags, feed browsing activity)
• Account-level default privacy settings for gift visibility
• Community and category following preferences
• Organization name, business address, and tax identification information (including EIN and Form W-9 or equivalent) provided by Org Admins on behalf of an Organization
• Authorized User work email, role (Org Admin or Gift Sender), department or team designation (where provided), and account-acceptance metadata (timestamp, ToS / Privacy version hash)
• Business billing and invoice metadata, including invoice line items, payment-method last-4, and Stripe customer/charge identifiers
• Recipient Data submitted by an Organization in connection with a Business Order — including Recipient name, email address, phone number (if provided), mailing address (if provided), employment or affiliation information, custom message content, and any custom fields the Organization chooses to upload (e.g., department, employee ID)
• Date of Birth (full calendar date — year, month, and day)
• Birthday Visibility preference (the user-controlled setting governing whether your birth month and day are displayed on your public profile)
• Contacts from your device's address book, if you turn on Sync Contacts (see "Contacts You Sync" below)

Profile Data Provided by You. When you create an account, we may collect information relating to you such as your name, a profile photo you choose to upload, your date of birth, your Birthday Visibility preference, and an automatically generated username (handle) that you can later customize. Note: Authorized User accounts on the Business Portal do not have public profiles, public usernames, or public discoverability — Authorized User profile data is visible only to other members of the same Organization, and Birthday Visibility is not available for Authorized User accounts.

Profile Visibility and Public Profiles (consumer Services). Each consumer account has an On Me profile. Where your Profile Visibility setting is public, your profile displays your name, your username (handle), your profile photo (avatar), your Birthday if you have enabled Birthday Visibility, your public gift activity, and counts of gifts you have sent and received. A public profile is retrievable by anyone who knows or guesses your handle, including people who are not signed in to the Services and search engines that index it. We do not display your email address, phone number, mailing address, full date of birth, or private gift content on your profile.

• Defaults: accounts belonging to users 18 or older default to public. Accounts belonging to users aged 13 to 17 default to private and must be affirmatively made public by the user, with parent or guardian consent where required by applicable law. See section 9.
• Your control: you can switch your Profile Visibility between public and private at any time in your account settings. Setting your profile to private also disables Birthday Visibility. See section 10.
• Effect of switching to private: your profile stops being retrievable by other users and by people who are not signed in, and you stop appearing in profile search and recipient lookup on a going-forward basis. Copies that were viewed, screenshotted, cached, or indexed by third parties while your profile was public may persist outside On Me's control.
• What Profile Visibility does not cover: it does not withhold your name, handle, and profile photo from the sender of a gift you redeem (see section 3), or from other users who have your verified phone number or email address in their synced contacts (see "Contacts You Sync" below).

Date of Birth and Birthday Data (consumer Services). We collect your full date of birth (year, month, and day) at account creation. Your full date of birth is treated as sensitive personal information and is never displayed publicly on the Services. The month and day only (your "Birthday") may be displayed on your public profile and other surfaces where Profile Information appears only if you have enabled Birthday Visibility in your account settings.

• What we collect: the full date of birth you provide, which may be used for identity verification, your Birthday Visibility preference (on/off), and the timestamp of any changes to that preference.
• Defaults: Users 18 or older who create a new On Me account on or after the launch of Birthday Visibility default to on. Users under 18 (ages 13–17) default to off regardless of signup date and must affirmatively opt in, with parent or guardian consent where required by applicable law. Users whose accounts existed before the launch default to off and must affirmatively opt in.
• Where it appears publicly when enabled: profile cards, Public Gift Feeds, search results, community feeds, and gift-recipient surfaces. The year of your date of birth, your age, and any other component of your full date of birth are never displayed.
• Where it never appears publicly: the full date of birth (including year) is never exposed on any client surface other than the authenticated user's own session, is never used in external Marketing Materials, and is not visible to Authorized Users or Recipients of Business Portal gifts.

Social Gifting Data (consumer Services only — does not apply to Business Portal gifts). When you send or receive gifts through our consumer Services, we collect information related to your gifting activity, including:

• Gift content you create or receive, including text messages, media attachments, gift card amounts, merchant selections, and any personalization or customization;
• Your gift visibility selections ("Public" or "Private") at the time of sending;
• As a gift receiver, your decision to remain tagged or to untag yourself from a public gift;
• Your account-level default visibility preference;
• Your interactions with public gift feeds (gifts viewed, liked, flagged);
• Community or category feeds you choose to follow (e.g., #Art, #Baking);
• Purchase-sharing content you voluntarily post;
• Thank-you notes, media responses, and other user-generated content shared within gift threads.

This data is collected to operate and display social gifting features, personalize your feed experience, and enable the visibility controls described in this notice. We do not use social gifting data for third-party advertising purposes. Gifts sent through the Business Portal are never eligible for public feeds, social discovery, or curated/community surfaces, regardless of any default or user setting. See §13.

AI and Automated Processing of Gift Content (consumer Services only). When you send a gift through our consumer Services, we may process the gift content using artificial intelligence and large language model technologies to: (a) anonymize gift notes before public display; (b) score quality/social value for public-feed eligibility; and (c) classify content by occasion, category, or sentiment. The original, unmodified gift content remains visible only to the sender and receiver. These AI systems do not make decisions that produce legal or similarly significant effects on you. Gifts sent through the Business Portal are not subject to anonymization, social-quality scoring, or public-feed eligibility processing, because Business Portal gifts are never publicly displayed. We may still apply automated content-safety scanning to Business Portal gift content to detect prohibited material; we do not use Business Portal gift content to train general-purpose AI models.

Contacts You Sync (consumer mobile app only). The On Me app offers an optional Sync Contacts feature. It is off until you turn it on: we first explain what it does, and only then ask your device for permission to read your contacts. You can turn it off at any time in the app's account settings, and you can revoke Contacts access in your device's settings.

• What we upload: for each contact in your device's address book (or, where your device lets you share only some contacts, each contact you have shared with On Me), the contact's first and last name, one phone number, one email address, and birthday (with or without the year), together with an identifier your device assigns to that contact entry and an identifier for your device. We discard contacts that have neither a U.S. phone number nor a valid email address.
• When we upload it: when you turn on Sync Contacts, and afterwards whenever your address book changes or the app refreshes in the background, so that additions, changes, and deletions on your device are reflected on On Me. Each upload updates the copy from the same device.
• How we use it: to show you which of your contacts are On Me users, to let you choose and search your contacts when sending a gift, and to give more weight in your feed to gift activity involving people in your contacts. We compare the phone numbers and email addresses you upload with the verified phone numbers and email addresses of On Me users, so that a contact who is already on On Me, or who joins later, appears in your contacts as an On Me user with their name, username, and profile photo. We also use upload counts to enforce rate limits and prevent abuse.
• What we do not do with it: we do not sell or share your contacts; we do not send messages, invitations, or marketing to anyone in your contacts (we only contact a person when you choose to send them a gift); we do not add your contacts to our marketing lists or advertising audiences; and we do not combine information about your contacts across different users' address books to build a profile of any person.
• Who can see it: only you.
• Users under 18: contact sync never reveals that a user under 18 has an On Me account. A minor's phone number or email address in your contacts is shown to you only as the plain contact you uploaded.

If you are in someone else's synced contacts. If another user syncs an address book that includes you, we hold the name, phone number, email address, and birthday stored for you in that address book, as part of that user's contacts. This applies whether or not you have an On Me account. We use it only to provide the features described above to the user who synced it. We do not contact you because of it and do not use it to market to you. If you have an On Me account (or create one later) and are 18 or older, a user who has your verified phone number or email address in their synced contacts will see that you are on On Me, along with your name, username, and profile photo, even if your profile is private. Your birthday is shown to them only if your Profile Visibility is public and Birthday Visibility is on. To ask us to delete information about you that came from other users' address books, see section 10.

When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information.

• financial data
• Payment Data. We may collect data necessary to process your payment if you make purchases, such as your payment instrument number and the security code associated with your payment instrument. All payment data is stored by Stripe. See https://stripe.com/privacy.
• Tax identification data submitted by Organizations on the Business Portal (e.g., EIN on a Form W-9 substitute), used solely for invoice generation, tax reporting, and our own legal compliance.

Social Media Login Data. We may provide you with the option to register using your existing social media account details. If you choose to register this way, we collect the information described in §6. Social login is not available for Business Portal accounts; Authorized Users must register with email + password or Google Workspace OAuth.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services and for our internal analytics and reporting.

Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files.

Device Data. Information about your computer, phone, tablet, or other device used to access the Services.

Location Data. Limited location data derived from your device's IP address or voluntarily shared GPS information, used to enable region-specific content or detect potential fraudulent activity. We do not continuously track your precise location, and we do not sell or share location information with third parties.

Information collected from other sources

We may obtain information about you from other sources, such as public databases, affiliate programs, data providers, social media platforms, and other third parties — for example, mailing addresses, job titles, email addresses, phone numbers, intent data, IP addresses, and social media URLs.

Business identity-resolution data (marketing pages only). When you visit our public marketing and corporate landing pages, our identity-resolution vendor described in section 5 may provide us with business-contact information associated with your visit, which can include your name, work email address, employer, job title, and professional-network profile, even if you did not fill out a form. We use this only to evaluate and follow up on prospective business gifting relationships. You may opt out at https://app.retention.com/optout.

Information collected from Organizations using the Business Portal. When an Organization uses the Business Portal to send a gift to a Recipient, we receive Recipient Data from the Organization (or from an Authorized User of the Organization). The legal basis for our processing of Recipient Data is set out in §13. We rely on the Organization's representation and warranty that it has all necessary consents and lawful bases to provide that Recipient Data to us under applicable anti-spam, telemarketing, and privacy laws (including CAN-SPAM, TCPA, CASL, GDPR/UK GDPR, and applicable U.S. state privacy laws).

2. HOW DO WE PROCESS YOUR INFORMATION?

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts.
• To deliver and facilitate delivery of services to the user.
• To respond to user inquiries / offer support to users.
• To send administrative information to you.
• To fulfill and manage your orders, payments, returns, and exchanges.
• To enable user-to-user communications.
• To request feedback.
• To send you marketing and promotional communications, in accordance with your marketing preferences. You can opt out at any time.
• To deliver relevant content within our Services based on your activity, without sharing or selling your personal information to any third parties.
• To post testimonials.
• To protect our Services (fraud monitoring and prevention).
• To administer prize draws and competitions.
• To evaluate and improve our Services, products, marketing, and your experience.
• To identify usage trends.
• To determine the effectiveness of our marketing and promotional campaigns.
• To comply with our legal obligations.
• To operate and display Social Gifting features (consumer Services only).
• To personalize your gift feed experience (consumer Services only).
• To moderate content on public gift feeds (consumer Services only).
• To anonymize gift content using AI (consumer Services only).
• To score and rank gift content using AI (consumer Services only).
• To send gift-related notifications and nudges.
• To operate Sync Contacts as described in section 1, if you turn it on. We use synced contacts for no other purpose.
• To backfill and populate public gift feeds (consumer Services only).
• To facilitate community engagement features (consumer Services only).
• To operate the Business Portal on behalf of Organizations. We process Organization Data and Authorized User information to provision Business Accounts, authenticate Authorized Users, manage roles and permissions, store invitation and acceptance records, generate invoices and tax documents, and provide reporting to Org Admins.
• To deliver Business Orders to Recipients. We process Recipient Data on behalf of, and only as instructed by, the Organization that submitted it — including to send gift-delivery and gift-related transactional communications to the Recipient by email and (where the Organization has provided a phone number and represented that consent exists) by SMS.
• To enforce Business Portal rules. We process Organization, Authorized User, and Recipient Data to detect and prevent fraud, sanctions/export-control violations, anti-bribery violations, and other Acceptable Use violations described in the Business Portal Terms of Service.
• To generate aggregated, de-identified analytics about Business Portal use (volume, regions, redemption rates) for benchmarking, product improvement, and reporting that cannot reasonably be associated with any specific Organization or Recipient.
• To verify your age and eligibility for our Services and our card-issuing program (including Mastercard's minimum cardholder age requirement) and to comply with the Children's Online Privacy Protection Act ("COPPA") and analogous laws.
• To potentially perform Know Your Customer (KYC), Customer Identification Program (CIP), Anti-Money Laundering (AML), Bank Secrecy Act, and sanctions-screening checks required of us and our partners (e.g., Sutton Bank, Highnote).
• To verify your identity for account recovery, passcode resets, support inquiries, and step-up authentication for high-value or sensitive actions, including by reference to a hashed copy of your date of birth.
• To detect, investigate, and prevent fraud, synthetic identity creation, account takeover, and other risk events, including by using your date of birth as a risk signal.
• To operate Birthday-related product features that you opt into, including Birthday Visibility on your public profile and any related notifications, reminders, or social-gifting prompts (consumer Services only).
• To produce internal analytics and age-cohort reporting on an aggregated, de-identified basis.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

Vendors, Consultants, and Other Third-Party Service Providers. We may share personal information only with trusted service providers who perform operational functions on our behalf and require access to such information. These include:

• Payment processors (Stripe)
• Cloud hosting and data storage providers (Google Cloud / Firebase)
• Customer support tools
• Security and fraud prevention providers
• Communication and authentication services (email, SMS, push)
• Analytics, product-measurement, and session-replay providers used to maintain, measure, and improve our Services (see section 5)
• Advertising, attribution, and conversion-measurement providers, and business identity-resolution providers used on our public marketing pages (see section 5)
• Card-issuing partners (Sutton Bank) and program managers (Highnote) for the issuance, management, and processing of our gift card program
• Tax and accounting service providers used to generate Business Portal invoices, tax forms, and 1099 reporting on the Organization's behalf

We do not sell your personal information for money. We have never received, and do not receive, monetary consideration in exchange for personal information.

We do "share" personal information for cross-context behavioral advertising. As described in section 5, our public websites and our consumer app run advertising, attribution, and conversion-measurement technologies, and our public marketing pages run a business identity-resolution vendor. When those technologies operate, identifiers and online-activity information about you are disclosed to those vendors, and some of them may use that information for cross-context behavioral advertising. Under CCPA/CPRA and analogous state laws this constitutes "sharing" (and, under some state definitions of "sale," a sale for non-monetary consideration), whether or not money changes hands. You have the right to opt out. See sections 11 and 12.

What we never sell or share. We do not sell or "share" (as defined under CCPA/CPRA) any of the following under any circumstances: Recipient Data submitted through the Business Portal; your date of birth or Birthday; your mobile number or text-messaging opt-in data; contacts you sync from your device; your precise location; gift content and gift messages; session recordings; or any personal information of a user we know to be under 18. We also do not disclose personal information to any third party for that third party's own independent marketing, other than as described for the business identity-resolution vendor in section 5.

We also may need to share your personal information in the following situations:

• We may share personal information with Sutton Bank and other third-party service providers involved in the issuance, management, and processing of our gift card program.

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

• Affiliate and Referral Programs. We participate in affiliate and referral programs to track referral and commission performance. These programs receive online identifiers, click identifiers, and cookie-based tracking data, which may constitute "sharing" as described above; they do not receive your name, phone number, or email address from us. Affiliate-program tracking is not applied to Recipient Data or to the authenticated Business Portal.

• Business Partners. We may work with certain business partners solely to facilitate features or fulfill Services you request. We do not share personal information with business partners for their independent marketing or promotional use.

• Regulatory Compliance. We adhere to all applicable banking regulations and requirements as mandated by Banking partners for the issuance and management of our gift card program.

• Other Users and Public Features. When you share personal information in publicly viewable areas of our consumer Services (including your name, profile photo, username, birthday (month and day only, where Birthday Visibility is enabled), comments, contributions, or media), you expressly acknowledge and agree that such information may be viewed by all users and may be publicly made available outside the Services, in perpetuity. This subsection does not apply to anything you do inside the Business Portal. No campaign content, gift messages, recipient lists, or Authorized User profiles are ever made publicly viewable on our consumer Services. The Organization's name, logo, marks, and the existence of the customer relationship may, however, be used by On Me in external Marketing Materials in accordance with the Business Portal Terms of Service §11.4 (Publicity and Logo License).

• Additionally, when you choose to create a public gift through the consumer Services (or make an existing gift public), all gift details and any associated media will be publicly displayed to all users and may be accessible outside our Services indefinitely. The visibility of the receiver's identity on a public gift is subject to the two-sided consent model below.

• Two-Sided Visibility Consent Model (consumer Services only). Public gift visibility on our consumer Services operates under a two-sided consent framework:

  • (a) Sender Control — sender selects "Public" or "Private" at the time of sending.
  • (b) Receiver Control — receivers may untag themselves at any time.
  • (c) Account-Level Defaults — users may set a default visibility preference; new accounts default to public for received gifts.
  • (d) Precedence — the most privacy-protective choice between sender and receiver always prevails.

• Contact sync. A user who syncs your verified phone number or email address sees that you are on On Me, as described in "Contacts You Sync" in section 1.

• Disclosure of your identity to the sender when you redeem a gift. When you redeem a gift into an On Me account, we disclose to the sender of that gift the name, username (handle), and profile photo on the account used to redeem it, along with the fact and timing of the redemption. We do this so the sender knows their gift reached someone and was claimed, and we notify the sender by email, SMS, or push that the gift was claimed. Three things to be aware of:

  • This disclosure applies to every gift, including gifts the sender designated as Private. It is not governed by the Two-Sided Visibility Consent Model above, and the untag right described in (b) does not remove your identity from the sender's own record of the gift.
  • This disclosure applies regardless of your Profile Visibility setting. A private profile does not withhold your identity from the sender of a gift you redeem.
  • The account used to redeem a gift may belong to someone other than the person the sender addressed, because anyone in possession of a gift link can redeem it. The identity we disclose to the sender is that of the account that actually redeemed the gift.

  If you do not want your identity disclosed to a sender, do not redeem the gift.

• Disclosure of your identity to an Organization when you redeem a Business Portal gift. Where the gift was sent through the Business Portal, the disclosure described above is made to the sending Organization and its Authorized Users (subject to the role-based access controls described below) rather than to an individual consumer sender. This includes a dashboard notification to the Organization identifying you by the name on the account used to redeem the gift.

• Public Gift Feed Display, Interactions, Purchase Sharing, Content Standards, Automated Content Moderation, and Backfilled Gift Data — all as described in our existing consumer Privacy Policy, applicable to consumer Services only.

• Birthday display on profiles and feeds. Where you have enabled Birthday Visibility, the month and day of your date of birth will be displayed as part of your Profile Information on your public profile and on any surfaces that show Profile Information (including Public Gift Feeds and search results). The year of your date of birth is never displayed. Disabling Birthday Visibility removes your Birthday from public display on a going-forward basis; copies that were viewed, screenshotted, cached, or indexed by third parties while it was public may persist outside On Me's control.

• Date of birth is not sold or shared for advertising. We do not sell or "share" (as those terms are defined under CCPA/CPRA and analogous state laws) your date of birth, your birthday, or your Birthday Visibility preference with any third party for cross-context behavioral advertising or for any other party's independent marketing.

• Sharing of Recipient Data with Organizations. When an Organization submits Recipient Data to us through the Business Portal, that Recipient Data remains accessible to the Organization and to its Authorized Users (subject to role-based access controls — Org Admins see organization-wide reporting; Gift Senders see only what they themselves send). We share gift-delivery, gift-redemption, and engagement metadata with the submitting Organization, including status (e.g., "Delivered," "Opened," "Redeemed"), the timing of each status change, and, once a gift is redeemed, the name, username (handle), and profile photo on the On Me account used to redeem it. We do not share Recipient Data with any other Organization.

• Marketing use of Organization name, logo, and customer relationship. Subject to the Business Portal Terms of Service §11.4 (Publicity and Logo License), On Me may use the Organization's name, logo, trademarks, and the fact of the customer relationship in marketing, sales, investor, public-relations, and product communications — including customer lists, "trusted by" walls, case studies, social-media posts, public forums, conference talks, podcasts, and advertising. The Organization may opt out of named case studies, named testimonials, and named press releases under that section, but inclusion in customer lists and aggregate "trusted by" surfaces is not opt-out. We will not, however, publicly disclose individual gift-message contents, individual Recipient Data, or any Recipient's identity in external Marketing Materials without the Organization's prior written consent or a separate lawful basis. Aggregated, de-identified, and Organization-level data may be used for any lawful business purpose.

All above exclusions apply to text messaging originator opt-in data and consent; this information will not be shared with any third parties. We do not sell, share, or disclose mobile numbers or opt-in data to any third party for marketing or other purposes.

4. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

The Services may link to third-party websites, online services, or mobile applications and/or contain advertisements from third parties that are not affiliated with us. We do not make any guarantee regarding any such third parties and will not be liable for any loss or damage caused by their use. The inclusion of a link does not imply our endorsement. We are not responsible for the content or privacy and security practices of any third parties.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

We use cookies and similar tracking technologies (web beacons, pixels, SDKs, and session-replay scripts) to operate the Services, measure how they are used, and market them. The categories below describe what we run and who receives the data.

Strictly necessary. Authentication, session management, security, fraud prevention, load balancing, and preservation of your cart. This category also includes the cookie that remembers your own privacy choices — whether you have opted out of sharing, and whether you have already seen and dismissed our cookie notice — so that we can honor those choices across onme.com and business.onme.com without asking you again. These cannot be disabled through a preference control, because the Services do not function without them and because we would otherwise have no way to remember that you opted out.

Analytics and product measurement. Used to understand how the Services are used and to improve them. Our product-analytics provider captures page views, clicks and other interactions, performance metrics, and error reports. Where you interact with a form field, what we record depends on the kind of field. For free-text fields (including names, email addresses, phone numbers, search boxes, and gift notes) we record only that the field changed and the length of what you entered, never the contents. For structured controls (checkboxes, radio buttons, dropdowns, quantity and amount steppers, and date and time pickers) we record the selected value itself, because those values are drawn from a fixed set of options rather than typed. We do not apply value tracking to payment fields, passwords, passcodes, or date-of-birth fields.

Session replay. Our session-replay provider records a reconstruction of your interactions with our web pages — including mouse movement, clicks, scrolling, and page navigation — and replays them to us as a video-like session recording. Session replay runs for all visitors on our production website. Input fields are masked. Our session-replay provider is configured to hide the contents of form inputs, so what you type — including your name, contact details, payment details, passwords and passcodes, date of birth, and gift messages — is not captured in the recording. We use session recordings only to diagnose errors and improve usability. We do not use them for advertising, we do not disclose them to advertising vendors, and we do not sell or share them.

Advertising, attribution, and conversion measurement. Used for cross-context behavioral advertising, audience building, and measuring the performance of our campaigns. This category includes tag managers, search and social advertising networks, advertising exchanges, a cross-domain attribution cookie that carries campaign attribution data between onme.com and business.onme.com, and affiliate and referral networks. Disclosures to the vendors in this category constitute "sharing" for cross-context behavioral advertising under CCPA/CPRA and "targeted advertising" under analogous state laws. See section 3.

Business lead identification (marketing pages only). On our public, logged-out marketing and corporate landing pages on both onme.com and business.onme.com, we use a business identity-resolution vendor to identify visitors who may be prospective business gifting customers so that our sales team can follow up. This technology is not used on the authenticated Business Portal, is not applied to Recipient Data, and is not used on consumer account, gift-builder, checkout, or redemption pages. In connection with this vendor:

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

Inside the authenticated Business Portal. Once an Authorized User signs in, cookies are limited to those strictly necessary for authentication, session management, security, and operation of the Business Portal, plus product analytics. We do not run advertising pixels, identity-resolution tags, or cross-context behavioral advertising technologies on authenticated Business Portal pages, and we do not apply any of them to Recipient Data.

Our cookie banner. When you first visit our websites we display a banner telling you that we use cookies and similar technologies, linking you to this notice and to our Your privacy choices page. We record that the banner was shown to you and that you dismissed it, so that we do not show it again on either of our sites. The banner is a notice, not a consent gate: the technologies described above load when you visit, and dismissing the banner does not switch any of them on or off. We do not ask you to opt in before setting cookies, because our Services are offered only in the United States and U.S. state privacy laws do not require prior consent for this.

Your choices. You are not, however, without control. You can opt out of the advertising, attribution, affiliate, and business identity-resolution technologies described above — the ones that involve "sharing" your personal information — by any of these routes:

• Use the toggle on our Your privacy choices page. It takes one step, works whether or not you are signed in, and does not ask you to create an account or verify your identity. The same page shows you the choice currently in effect for that browser, and lets you reverse it as easily as you made it.
• Turn on Global Privacy Control in your browser or extension. We treat a GPC signal as a valid opt-out request, and we do not require you to have an account or verify your identity for it to take effect. See section 11.
• Email us at info@onme.com asking to opt out of the sale or sharing of your personal information.
• Use the vendor opt-out link in the business lead identification paragraph above.
• Remove or block cookies in your browser settings, which most browsers allow.

Your choice applies to the browser you make it in, and covers both onme.com and business.onme.com. It lasts until you clear your browser storage or change it, so you will need to make it again on any other browser or device you use.

What opting out actually does. Two different things, depending on the technology:

• Advertising, attribution, and affiliate technologies. These tags still load, but we send them a signal instructing them that your information may not be used for advertising. In practice that means they may not store advertising identifiers on your device, may not use your information to personalize advertising to you, and may not use it to build or enrich advertising audiences. They may still receive limited information about your visit, without advertising identifiers, so that we can count conversions in aggregate and understand which campaigns work. That remaining information may not be used for cross-context behavioral advertising, by us or by them.
• Business lead identification. This technology is not loaded at all when you have opted out, so no information about your visit reaches that vendor and no attempt is made to identify you.

We rely on our vendors' contractual and technical commitments to honor the signal we send them. Where a vendor offers its own separate opt-out, we link to it above so you can use both.

Strictly necessary cookies cannot be turned off, because the Services do not function without them. Blocking cookies through your browser may affect the availability or functionality of the Services. Opting out does not cause us to charge you a different price or provide a different level of service.

6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

Our consumer Services offer you the ability to register and log in using third-party social media account details. Where you choose to do this, we will receive certain profile information about you from your social media provider — typically your name, email address, friends list, and profile picture. We will use such information only for the purposes described in this privacy notice. We do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. Social logins are not available on the Business Portal; Authorized Users register with email + password or Google Workspace OAuth.

7. HOW LONG DO WE KEEP YOUR INFORMATION?

We will only keep your personal information for as long as necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

Retention of consumer account and activity data. We retain each category for the period below, or longer where a law, regulation, card-network rule, or legal hold requires it:

• Account and profile data (name, handle, avatar, contact points, privacy preferences) — for as long as your account is active, and for up to seven (7) years after closure where needed for tax, banking, card-network, fraud-prevention, and audit obligations.
• Transaction, order, gift, and card data — seven (7) years from the transaction, consistent with U.S. tax and banking recordkeeping requirements, and longer where stored value remains outstanding.
• Identity-verification and KYC/AML records — five (5) years after account closure or the last transaction, as required by applicable anti-money-laundering rules.
• Advertising and analytics identifiers — for the life of the relevant cookie or identifier, generally no more than thirteen (13) months from the last interaction, after which they expire or are aggregated.
• Our first-party attribution and privacy-preference cookie — up to twenty-four (24) months from your last visit. This is the cookie that carries your campaign attribution between our sites and stores your opt-out and cookie-notice choices; the longer life is deliberate, so that an opt-out is not forgotten.
• Session recordings — retained by our session-replay provider under our configured retention setting, and in no case longer than twelve (12) months from capture.
• Business identity-resolution data collected on our marketing pages — no more than twenty-four (24) months from collection, or until you opt out, whichever is earlier.
• Server, security, and audit logs — no more than twenty-four (24) months, except where retained for an active security or fraud investigation.
• Support and communications records — three (3) years from the last contact.
• Synced contacts — for as long as Sync Contacts is on and the contact remains in the address book of at least one of your devices. A synced contact is deleted when you delete it from your device's address book (at the next sync), when you turn off Sync Contacts on that device, or when you delete your On Me account. A contact you have sent a gift to, edited, or added yourself in On Me stays in your On Me contacts until you remove it or delete your account. Contacts you remove in the app are hidden and no longer synced, but are retained with your account so a removed contact does not reappear.

Retention of Social Gifting Data (consumer Services only). Public gift content may be retained for as long as the gift remains publicly visible. If a sender changes a public gift to private, or if both parties remove their association, we will remove the gift from public feeds within a commercially reasonable timeframe but may retain anonymized or aggregated data for analytics. When a receiver untags themselves, identifying information is removed from the public display promptly. Backfilled gifts follow the same retention rules as new gifts.

Retention of Business Portal Data.

• Organization Data and Authorized User Data — retained for as long as the Business Account is active, plus a commercially reasonable period after termination for tax, accounting, audit, fraud-prevention, and legal-compliance purposes (typically 7 years for invoice and tax-reporting data, consistent with U.S. tax recordkeeping requirements).
• Recipient Data — retained for as long as required to deliver the Business Order and to provide reporting to the submitting Organization, plus the period required for tax/accounting reconciliation. Upon Organization request (or at the end of an applicable DPA term), Recipient Data will be deleted or de-identified within ninety (90) days, except for data required to be retained by law.
• Gift content delivered to a Recipient — once a Recipient redeems Gift Card Value, redemption data is retained under the Cardholder Agreement and applicable banking-regulatory retention rules, even after Organization termination.

Retention of Date of Birth and Birthday Data. We retain your full date of birth for as long as your account is active and for a commercially reasonable period thereafter to satisfy regulatory, tax, fraud-prevention, and audit obligations (including Mastercard, Sutton Bank, and KYC/AML recordkeeping requirements). Hashed copies of your date of birth used for identity verification are retained on the same schedule. We retain your Birthday Visibility preference, and the audit log of changes to it, for as long as your account is active and as needed to comply with our legal and security obligations. If you disable Birthday Visibility, the Birthday is removed from public display promptly, but the underlying date of birth and the visibility audit log are retained as described above.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure.

Security of Social Gifting Data (consumer Services only): access controls enforcing the two-sided visibility consent model; automated content safety scanning; rate limiting and abuse detection; audit logging of visibility changes; secure deletion processes.

Security of Business Portal Data. In addition to general security measures, we implement the following safeguards specific to the Business Portal:

• Tenant isolation. The Business Portal runs on a dedicated Firebase Auth tenant separate from consumer accounts; there is no shared session, token, or credential surface between consumer and business identities.
• Role-based access controls enforcing the Org Admin / Gift Sender model — Gift Senders cannot access Organization-wide billing, payment methods, or Authorized User management.
• Encryption of personal data in transit (TLS 1.2+) and at rest.
• Audit logging of Authorized User invitations, role changes, payment-method changes, exports of Recipient Data, and access to invoice/tax records.
• Sub-processor governance — written contracts with each sub-processor requiring confidentiality and security obligations at least as protective as those in this notice.
• Incident response. We will notify the Org Admin without undue delay (and in any event within the timeframe required by applicable law) of any confirmed security incident affecting Recipient Data or other Organization data.

Safeguards for Date of Birth. We hash dates of birth for identity-verification use, restrict client-side API responses so that only the authenticated user can see their own full date of birth, audit-log all changes to the Birthday Visibility preference, and only ever expose the month and day on any public API surface when Birthday Visibility is enabled.

9. DO WE COLLECT INFORMATION FROM MINORS?

• We do not knowingly solicit data from or market to children under 13.
• By using the Services, you represent that you are at least 13 or that you are the parent or legal guardian of such a minor and consent to (and act as the contracting party for) such minor dependent's use of the Services. Users between 13 and 17 may use the consumer Services only with the consent of a parent or legal guardian.
• If we learn that personal information from users less than 13 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data.
• Heightened privacy defaults for minor users (13–17). For users whose date of birth indicates an age of 13–17, the following public‑sharing settings are defaulted to off regardless of signup date or any adult‑oriented account‑level default, and must be affirmatively enabled by the minor user (with parent or guardian consent where required by applicable law): (a) Profile Visibility — the minor's profile is private and is not retrievable by other users, by signed‑out visitors, or through profile search and recipient lookup unless the minor opts in; (b) Birthday Visibility; (c) public gift sending — gifts sent by a minor are treated as Private unless the minor opts in to public sending; and (d) public display as a gift receiver — the minor's name, profile photo, and username are suppressed from public gift feeds, community feeds, search results, profile discovery, and curated or trending surfaces unless the minor opts in; and (e) contact-sync discovery — a minor is never identified as an On Me user to someone who has the minor's phone number or email address in their synced contacts, and this cannot be changed by opting in. We additionally suppress such users from targeted advertising and behavioral marketing audiences, exclude minor‑associated content from algorithmic ranking and recommendation to non‑connected users, and apply heightened‑privacy defaults consistent with applicable state minor‑protection laws (including the California Age‑Appropriate Design Code Act, the Maryland Online Data Privacy Act, the New York Stop Addictive Feeds for Kids Act, and analogous statutes). A minor user may disable any of the settings in (a) through (d) at any time, and disabling removes the associated information from public display on a going‑forward basis. These defaults do not affect the disclosure described in section 3 that is made to the sender of a gift when it is redeemed: if a minor redeems a gift, the name, username, and profile photo on the account used to redeem it are disclosed to the sender (or, for a Business Portal gift, to the sending Organization), because the sender is entitled to know their gift was claimed. This is a disclosure to one identified sender, not a public display, and it is not suppressed by Profile Visibility or by any other heightened‑privacy default. Parents or guardians who have questions about this disclosure should contact us at info@onme.com.

Minors and Social Gifting Features (consumer Services only). Users aged 13–17 may participate in our social gifting features — including sending public gifts and being publicly displayed as the receiver of a gift — only on an affirmative, opt‑in basis. For users whose date of birth indicates an age of 13–17, all such public‑sharing settings are defaulted to OFF, regardless of any adult‑oriented account‑level default that otherwise applies (adult users, by contrast, may have public sharing enabled by default subject to the per‑gift and account‑level controls described in §3). A minor user must affirmatively enable each public‑sharing setting before any associated information will appear on a public gift feed, community feed, search result, or other publicly viewable surface, and parent or guardian consent is required where applicable law (including the California Age‑Appropriate Design Code Act and analogous state minor‑protection laws) requires it. Where a sender designates a gift as public to a recipient whose date of birth indicates an age of 13–17 and who has not opted in to public receipt, the gift will be treated as private as to the recipient: the recipient's name, profile photo, and username will not be displayed publicly, and the recipient's public‑sharing default overrides the sender's public designation. Parents or guardians who believe their child's information has been displayed on a public gift feed should contact us immediately at info@onme.com.

Business Portal floor unchanged. The Business Portal eligibility floor in §13 remains 18+. Authorized Users may not be under 18, and the consumer 13+ floor above does not apply to Authorized User accounts.

Date of Birth and minor‑related screening. We collect date of birth at account creation in part to enforce age‑based eligibility, including the minimum cardholder age required by Mastercard and the COPPA age‑gate for users under 13. If we determine, at signup or later, that a user is below the minimum age, we will not issue a card, will not enable Birthday Visibility or any other public‑sharing setting, and will deactivate the account and delete the associated personal information except as required to be retained by law.

10. WHAT ARE YOUR PRIVACY RIGHTS?

Withdrawing your consent. Where we rely on your consent, you have the right to withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

Opting out of marketing and promotional communications. Click the unsubscribe link in our marketing emails, or contact us using the details below. You will be removed from the marketing lists. Service-related messages necessary for administration of your account will continue.

Account Information. You may log in to your account settings to update or terminate your account. Upon a termination request, we will deactivate or delete your account, subject to limited retention to prevent fraud, troubleshoot, assist investigations, enforce legal terms, or comply with law. Remaining funds on gift cards or other stored value are forfeited and non-refundable on termination — use them before terminating.

Cookies and similar technologies. Most browsers accept cookies by default; you can usually choose to remove or reject cookies, though doing so may affect the functionality of the Services. To opt out of the sale or sharing of your personal information for cross-context behavioral advertising, use our Your privacy choices page, turn on Global Privacy Control in your browser (see section 11), or contact us using the details below. Section 5 lists the tracking technologies we run and the vendors that receive data from them.

Social Gifting Visibility Rights (consumer Services only): right to control gift visibility as a sender; right to untag yourself as a receiver; right to set account-level visibility defaults; right to flag content; right to request removal of public gift content; right to opt out of gift-related notifications and nudges; impact of account deletion on public gift data — all as described in our existing consumer Privacy Policy.

Sync Contacts control (consumer mobile app only). You can turn Sync Contacts on or off at any time in the app's account settings. Turning it off on a device stops syncing from that device and deletes the contacts that only that device's sync was keeping. Contacts you have sent a gift to, edited, or added yourself, and contacts still synced from another of your devices, stay. Revoking Contacts access in your device's settings stops future syncing, but does not by itself delete contacts already uploaded; turn off Sync Contacts in the app to delete them. Deleting your account deletes all of your contacts.

If your information is in someone else's synced contacts, you can ask us to delete it by emailing info@onme.com.

Profile Visibility control (consumer Services only). You can set your profile to public or private at any time in your account settings. Setting your profile to private removes it from public view and from profile search and recipient lookup on a going-forward basis, and also disables Birthday Visibility. Setting your profile to private does not withhold your name, username, and profile photo from the sender of a gift you have already redeemed or later redeem, or from users who have your verified phone number or email address in their synced contacts, and does not remove information that was viewed, screenshotted, cached, or indexed by third parties while your profile was public. Profile Visibility is not available for Authorized User accounts on the Business Portal, which do not have public profiles.

Birthday Visibility control. You can enable or disable Birthday Visibility at any time in your account settings. Disabling Birthday Visibility removes your Birthday from public display on a going-forward basis. You can also request correction or deletion of your date of birth subject to the legal, regulatory, fraud-prevention, and card-network constraints described in §§2, 7, and 9 — including that we may be required to retain a record of your date of birth to satisfy KYC, AML, tax, and card-program obligations even after account closure.

Business Portal Authorized User Rights. As an Authorized User, you have the rights described above in your individual capacity. Additionally:

• Right to leave an Organization. You may remove your own Authorized User account from an Organization at any time through your account settings. The Organization will retain the historical orders you placed.
• Right to opt out of Business Portal marketing. Marketing communications about the Business Portal are sent to Org Admins by default. You may opt out at any time without affecting transactional or service-related communications.
• Right to disable transactional notifications — to the extent legally permissible (some, like delivery confirmations, may be necessary for Service delivery and cannot be disabled).

Recipient Rights. If you are a Recipient of a Business Portal gift, you may have privacy rights under the laws of your state or country. For most Recipient Data submitted to us by an Organization, the Organization is the controller (or business / data fiduciary) of that data, not On Me. This means:

• You may direct privacy-rights requests to the submitting Organization in the first instance — we will assist that Organization in honoring your request as required under our DPA.
• You may also contact us directly at privacy@onme.com, and we will route your request to the Organization (and, where required by law, respond directly).
• You always have the right to opt out of further gift-related communications from us by following the unsubscribe link in any email or by contacting us. Opting out will not retroactively prevent the redemption of any gift already sent to you.

If you have questions or comments about your privacy rights, you may email us at info@onme.com or, for Business Portal matters, at privacy@onme.com.

11. CONTROLS FOR DO-NOT-TRACK FEATURES AND UNIVERSAL OPT-OUT SIGNALS

Global Privacy Control (GPC) and Universal Opt-Out Mechanisms. We recognize and honor GPC signals and other universal opt-out preference signals as valid requests to opt out of the "sale" or "sharing" of personal information, as well as targeted advertising, where required by applicable state privacy laws (including CCPA, CPA, CTDPA, MCDPA, OCPA, and TDPSA). When we detect a GPC signal we will: (a) cease any sale or sharing of your personal information with third parties for advertising purposes; and (b) cease processing for targeted advertising. To enable GPC, visit globalprivacycontrol.org. Because we do share personal information for cross-context behavioral advertising as described in sections 3 and 5, a GPC signal has real effect on our Services. We detect the signal on the server when your browser requests a page, and apply it to that browser for the whole of your visit. What we then do differs by technology, and is described under "What opting out actually does" in section 5. Strictly necessary cookies, and the analytics and session-replay technologies we use solely to operate and improve the Services, continue to run. We treat a GPC signal as a valid opt-out request without requiring you to create an account or verify your identity, and we do not charge you a different price or provide a different level of service because you sent one.

Do-Not-Track (DNT) Signals. No uniform DNT standard has been finalized; we do not currently respond to DNT browser signals separately from the GPC signal above.

12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Indiana, Iowa, Tennessee, Minnesota, Maryland, Delaware, New Hampshire, New Jersey, Nebraska, Kentucky, or Rhode Island, you have specific privacy rights — preserved in full from our prior version. (See state-by-state subsections below.)

Categories of personal information collected (last 12 months):

• A. Identifiers — names, addresses, phones, emails, IP addresses, account names, and the names, phone numbers, email addresses, and birthdays in device contacts that users choose to sync — YES
• B. Personal information under California Customer Records statute — name, contact information, employment information, financial information — YES
• C. Protected classification characteristics — age, date of birth (collected at signup; month and day publicly displayable only with the user's affirmative Birthday Visibility opt-in), gender (where provided) — YES
• D. Commercial information — transaction information, purchase history, financial details, payment information — YES
• F. Internet or other similar network activity — browsing/search history, online behavior, interest data, interactions with our site/app and ads. Includes interactions with public gift feeds (consumer only). — YES
• G. Geolocation data — device location — YES
• I. Professional or employment-related information — business contact details, job title, work history, professional qualifications. Includes information provided by Organizations and Authorized Users on the Business Portal. — YES
• K. Inferences — preferences and characteristics inferred from collected information — YES
• L. Sensitive personal information — account login info, contents of email/text, debit/credit card numbers, and date of birth (treated as sensitive personal information; never sold or shared for advertising, and never publicly displayed in full) — YES

Categories of sources from which we collect personal information:

• Directly from you (account registration, gift building, checkout, support requests, surveys, and forms)
• Automatically from your device and browser as you use the Services (cookies, pixels, SDKs, session-replay scripts, and server logs) — see section 5
• From other users of the Services (for example, a sender who provides a recipient's name and contact information, or a user who syncs a device address book that includes you)
• From Organizations and their Authorized Users using the Business Portal (Recipient Data)
• From our service providers and processors (payments, card issuing, identity verification, communications, analytics)
• From advertising, attribution, affiliate, and business identity-resolution vendors — see section 5
• From social media providers, where you use a social login
• From public databases, data providers, and other publicly available sources

Business or commercial purposes for each category. We process every category listed above to provide, operate, secure, and improve the Services; to process transactions and issue and service cards; to communicate with you; to verify identity and age; to prevent fraud and abuse; to comply with legal, tax, banking, and card-network obligations; and to market our Services. Category F (internet and network activity) and Category K (inferences) are additionally processed for advertising, attribution, and conversion measurement. Category I (professional and employment-related information) is additionally processed to evaluate and pursue prospective business gifting relationships. Contacts synced from a device are processed only to operate Sync Contacts as described in section 2. Section 2 describes these purposes in full.

Categories of third parties to whom we disclose personal information for a business purpose: payment processors; card issuers, program managers, and banking partners; identity-verification and fraud-prevention providers; communications providers (email, SMS, push); cloud hosting and storage providers; customer-support and error-monitoring providers; analytics, product-measurement, and session-replay providers; tax and accounting providers; professional advisors; law enforcement and regulators where legally required; and Organizations using the Business Portal (for Recipient Data only).

Categories of personal information we have "sold" or "shared" in the preceding 12 months, and to whom. We have not sold personal information for monetary consideration. We have "shared" the following for cross-context behavioral advertising:

• Category A (identifiers) — online identifiers, cookie and device identifiers, IP address, and, on our public marketing pages, business-contact identifiers — disclosed to advertising and attribution networks, affiliate and referral networks, and our business identity-resolution vendor.
• Category F (internet or other similar network activity) — page views, referring URLs, campaign parameters, and on-site activity — disclosed to advertising and attribution networks and affiliate and referral networks.
• Category I (professional or employment-related information) — on our public marketing pages only — disclosed to and received from our business identity-resolution vendor.
• Category K (inferences) — audience and interest segments derived from the above — disclosed to advertising networks.

We have not sold or shared Category B, C, D, G, or L information, and we have not sold or shared any sensitive personal information, any contacts synced from a device, any Recipient Data, or the personal information of any consumer we know to be under 18 years of age. Section 5 names the vendors in each category, and sections 11 and 12 describe how to opt out.

We will use and retain the collected personal information as needed to provide the Services or as described in section 7.

California Residents

California Civil Code Section 1798.83, also known as the "Shine The Light" law permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with the Services, you have the right to request removal of unwanted data that you publicly post on the Services. To request removal of such data, please contact us using the contact information provided below and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g., backups, etc.).

CCPA Privacy Notice

This section applies only to California residents. Under the California Consumer Privacy Act (CCPA), you have the rights listed below.

The California Code of Regulations defines a "residents" as: (1) every individual who is in the State of California for other than a temporary or transitory purpose and (2) every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose. All other individuals are defined as "non-residents."

Your rights with respect to your personal data:

• Right to be informed — Request to know what personal information we collect, use, disclose, sell, and share
• Right to request deletion of your personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of your personal information, including for cross-context behavioral advertising
• Right to limit the use and disclosure of sensitive personal information
• Right to non-discrimination for exercising any of these rights

To exercise these rights, you can contact us by submitting a data subject access request, by email at info@onme.com, or by referring to the contact details at the bottom of this document. To opt out of sale or sharing you may also transmit a Global Privacy Control signal, which we honor as a valid opt-out request without requiring you to create an account or verify your identity — see section 11.

How we verify your request. For requests to know, delete, or correct, we will ask you to provide information sufficient to match you to the personal information we hold — typically the email address or phone number associated with your account, and, for requests involving sensitive or card-related information, confirmation of additional account details or completion of a signed-in verification step. We match the information you provide against our records. If we cannot verify you to the degree of certainty the law requires, we will tell you and explain why, and we may ask for additional information. We do not require you to create an account in order to make a request, and we do not require verification for an opt-out of sale or sharing or for a Global Privacy Control signal. We will respond within forty-five (45) days, extendable once by an additional forty-five (45) days where reasonably necessary, and we will tell you if we need the extension.

Authorized agents. You may use an authorized agent to submit a request on your behalf. The agent must provide us with written permission signed by you authorizing the agent to act, and we may contact you directly to confirm that you granted the authorization and to verify your own identity. An agent registered with the California Secretary of State may instead provide proof of that registration together with your signed permission. We may deny a request from an agent who does not submit proof of valid authorization.

Appeals. If we decline to act on your request, we will tell you why. You may appeal that decision by emailing info@onme.com with the subject line "Privacy Appeal." We will respond in writing within forty-five (45) days with our decision and reasoning. If your appeal is denied, you may file a complaint with the California Privacy Protection Agency or the California Attorney General.

Right to Limit Use and Disclosure of Sensitive Personal Information — Date of Birth. California residents (and residents of other states with comparable rights) may request that we limit our use and disclosure of date of birth to those uses necessary to perform the Services, comply with law, ensure security and integrity of the Services, and prevent fraud. Even where such a request is granted, we will continue to use your date of birth for age verification, KYC/AML compliance, account security, identity verification, fraud prevention, and other purposes permitted under the applicable statute. Granting such a request will result in Birthday Visibility being treated as disabled.

Colorado Residents

This section applies only to Colorado residents. Under the Colorado Privacy Act (CPA), you have the rights listed below. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law. Right to be informed whether or not we are processing your personal data; Right to access your personal data; Right to correct inaccuracies in your personal data; Right to request deletion of your personal data; Right to obtain a copy of the personal data you previously shared with us; Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling").

To submit a request to exercise any of the rights described above, please email info@onme.com or submit a data subject access request. If we decline to take action regarding your request and you wish to appeal our decision, please email us at info@onme.com. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

Connecticut Residents

This section applies only to Connecticut residents. Under the Connecticut Data Privacy Act (CTDPA), you have the rights listed below. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

To submit a request to exercise any of the other rights described above, please email info@onme.com or submit a data subject access request. If we decline to take action regarding your request and you wish to appeal our decision, please email us at info@onme.com. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

Virginia Residents

Under the Virginia Consumer Data Protection Act (VCDPA): "Consumer" means a natural person who is a resident of the Commonwealth acting only in an individual or household context. "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person. "Sale of personal data" means the exchange of personal data for monetary consideration.

Your rights with respect to your personal data:

• Right to be informed whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

You may contact us by email at info@onme.com or submit a data subject access request. If you are using an authorized agent to exercise your rights, we may deny a request if the authorized agent does not submit proof that they have been validly authorized to act on your behalf. Upon receiving your request, we will respond without undue delay, but in all cases, within forty-five (45) days of receipt. The response period may be extended once by forty-five (45) additional days when reasonably necessary. If we decline to take action regarding your request, we will inform you of our decision and reasoning behind it. If you wish to appeal our decision, please email us at info@onme.com. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may contact the Attorney General to submit a complaint.

Texas Residents

This section applies only to Texas residents. Under the Texas Data Privacy and Security Act (TDPSA), you have the following rights:

• Right to confirm whether we are processing your personal data and to access that data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable, readily usable format
• Right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects

We also recognize Global Privacy Control (GPC) signals as a valid opt-out mechanism under the TDPSA. To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond to your appeal within sixty (60) days. If the appeal is denied, you may contact the Texas Attorney General to file a complaint.

Oregon Residents

This section applies only to Oregon residents. Under the Oregon Consumer Privacy Act (OCPA), you have the following rights:

• Right to confirm whether we are processing your personal data and to access that data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling
• Right to obtain a list of specific third parties to whom we have disclosed your personal data (or, if not possible, the categories of third-party recipients)

We honor Global Privacy Control (GPC) signals as a valid opt-out under the OCPA. To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within forty-five (45) days. If the appeal is denied, you may contact the Oregon Attorney General.

Montana Residents

This section applies only to Montana residents. Under the Montana Consumer Data Privacy Act (MCDPA), you have the following rights:

• Right to confirm whether we are processing your personal data and to access that data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling

We honor Global Privacy Control (GPC) signals as a valid opt-out under the MCDPA. To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within sixty (60) days. If the appeal is denied, you may contact the Montana Attorney General.

Indiana Residents

This section applies only to Indiana residents. Under the Indiana Consumer Data Protection Act (INCDPA, effective January 1, 2026), you have the following rights:

• Right to confirm whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling

To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within sixty (60) days. If the appeal is denied, you may contact the Indiana Attorney General.

Iowa Residents

This section applies only to Iowa residents. Under the Iowa Consumer Data Protection Act (ICDPA, effective January 1, 2025), you have the following rights:

• Right to confirm whether we are processing your personal data
• Right to access your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the sale of your personal data or the processing of your personal data for targeted advertising

To exercise your rights, please email info@onme.com or submit a data subject access request. We will respond within ninety (90) days of receipt of your request.

Tennessee Residents

This section applies only to Tennessee residents. Under the Tennessee Information Protection Act (TIPA, effective July 1, 2025), you have the following rights:

• Right to confirm whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the sale of personal data, targeted advertising, or profiling

To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within sixty (60) days. If the appeal is denied, you may contact the Tennessee Attorney General.

Minnesota Residents

This section applies only to Minnesota residents. Under the Minnesota Consumer Data Privacy Act (MNCDPA, effective July 31, 2025), you have the following rights:

• Right to confirm whether we are processing your personal data and to access that data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of targeted advertising, the sale of personal data, or profiling
• Right to question the result of profiling decisions and be informed of the reasons behind those decisions

To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within forty-five (45) days. If the appeal is denied, you may contact the Minnesota Attorney General.

Maryland Residents

This section applies only to Maryland residents. Under the Maryland Online Data Privacy Act (MODPA, effective October 1, 2025), you have the following rights:

• Right to confirm whether we are processing your personal data and to access that data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the processing of your personal data for targeted advertising or the sale of personal data

The MODPA prohibits the sale of sensitive data and the use of personal data for targeted advertising without consent. To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within sixty (60) days. If the appeal is denied, you may contact the Maryland Attorney General.

Delaware Residents

This section applies only to Delaware residents. Under the Delaware Personal Data Privacy Act (DPDPA, effective January 1, 2025), you have the following rights:

• Right to confirm whether we are processing your personal data and to access that data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling

To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within sixty (60) days. If the appeal is denied, you may contact the Delaware Department of Justice.

New Hampshire Residents

This section applies only to New Hampshire residents. Under the New Hampshire Privacy Act (NHPA, effective January 1, 2025), you have the following rights:

• Right to confirm whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of targeted advertising, the sale of personal data, or profiling

To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within sixty (60) days. If the appeal is denied, you may contact the New Hampshire Attorney General.

New Jersey Residents

This section applies only to New Jersey residents. Under the New Jersey Data Privacy Act (NJDPA, effective January 15, 2025), you have the following rights:

• Right to confirm whether we are processing your personal data and to access that data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the sale of personal data, targeted advertising, or profiling

To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within forty-five (45) days. If the appeal is denied, you may contact the New Jersey Division of Consumer Affairs.

Nebraska Residents

This section applies only to Nebraska residents. Under the Nebraska Data Privacy Act (NDPA, effective January 1, 2025), you have the following rights:

• Right to confirm whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the sale of personal data, targeted advertising, or profiling

To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within sixty (60) days. If the appeal is denied, you may contact the Nebraska Attorney General.

Kentucky Residents

This section applies only to Kentucky residents. Under the Kentucky Consumer Data Protection Act (KCDPA, effective January 1, 2026), you have the following rights:

• Right to confirm whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the sale of personal data, targeted advertising, or profiling

To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within sixty (60) days. If the appeal is denied, you may contact the Kentucky Attorney General.

Rhode Island Residents

This section applies only to Rhode Island residents. Under the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA, effective January 1, 2026), you have the following rights:

• Right to confirm whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data in a portable format
• Right to opt out of the sale of personal data, targeted advertising, or profiling

To exercise your rights, please email info@onme.com or submit a data subject access request. If we decline your request, you may appeal by emailing us at info@onme.com. We will respond within forty-five (45) days. If the appeal is denied, you may contact the Rhode Island Attorney General.

Special note for Recipients of Business Portal gifts. When a Recipient submits a state-law privacy-rights request about data that an Organization uploaded to us, On Me acts as a service provider / processor and will route the request to the Organization (the business / controller). We will assist the Organization in honoring the request within the timeframes required under each applicable state law, and we will respond directly to the Recipient where the law requires us to do so. This routing does not delay the rights granted to the Recipient.

13. BUSINESS PORTAL: ORGANIZATIONS, AUTHORIZED USERS, AND RECIPIENT DATA

This Section 13 applies whenever an Organization or its Authorized Users access or use the On Me Business Portal at business.onme.com. It also applies to Recipients whose information is provided to us by an Organization through the Business Portal. In the event of conflict between this Section 13 and any other provision of this notice with respect to Business Portal data, this Section 13 controls.

13.1 Definitions

• "Business Portal" — the On Me product at business.onme.com.
• "Organization" — a legal entity that maintains a Business Account.
• "Authorized User" — an individual whom an Organization has invited and authorized to access its Business Account, including Org Admins and Gift Senders.
• "Recipient" — an individual designated by an Authorized User to receive a gift through the Business Portal.
• "Recipient Data" — personal information about a Recipient that an Organization or Authorized User provides to On Me, including name, email address, phone number (if provided), mailing address (if provided), employment or affiliation information, and any custom message or field directed to or about the Recipient.
• "DPA" — a Data Processing Addendum executed (or, in V1, made available on request) between On Me and the Organization.

Additional capitalized terms have the meanings given in the Business Portal Terms of Service.

13.2 Controller / Processor framework

As between the Organization and On Me, with respect to Recipient Data:

• The Organization is the controller (or "business" or "data fiduciary" under applicable U.S. state laws).
• On Me is the processor (or "service provider" under CCPA/CPRA), processing Recipient Data only on the documented instructions of the Organization, except where required to do otherwise by law.

With respect to Authorized User accounts and the operational data we generate about them, On Me is the controller.

13.3 Permitted processing of Recipient Data

On Me will process Recipient Data only:

• to deliver the Business Order to the Recipient and provide related transactional communications;
• to operate, secure, and improve the Services (including fraud detection, abuse prevention, automated content-safety scanning, and aggregated/de-identified analytics);
• to comply with applicable law, including tax, accounting, sanctions, anti-money-laundering, and financial-regulatory obligations applicable to On Me, Secure Gift Holdings LLC, and Sutton Bank;
• as instructed by the Organization through the Business Portal or in writing.

On Me will not:

• sell or "share" Recipient Data with third parties for cross-context behavioral advertising;
• use Recipient Data to send marketing communications on On Me's own behalf without a separate lawful basis;
• use Recipient Data to train general-purpose AI models;
• publicly disclose individual gift-message contents, individual Recipient Data, or any Recipient's identity in external Marketing Materials without the Organization's prior written consent or a separate lawful basis (note: pursuant to the Business Portal Terms of Service §11.4, On Me may use the Organization's name, logo, marks, and the existence of the customer relationship in external Marketing Materials).

13.4 Authorized User data

When an individual is invited to or signs up for a Business Account, we collect:

• name, work email, password (or Google OAuth identity), role within the Organization (Org Admin or Gift Sender), and acceptance metadata (timestamp, ToS / Privacy version hash);
• account activity, including campaigns created, orders placed, recipients added, and feature usage;
• billing actions taken (where the Authorized User is an Org Admin).

Authorized User accounts are technically and legally distinct from consumer accounts on onme.com. The same individual may hold both a personal consumer account and an Authorized User account using the same email; however, gift card balances and order history do not transfer between the two.

13.5 Organization-level data

We collect and process information that an Organization provides about itself, including:

• Organization name, business address, and Org Admin contact details;
• tax identification information (EIN, Form W-9 or equivalent);
• payment-method information (processed by Stripe);
• invoice and order history at the Organization level;
• support and operational communications.

13.6 Sub-processors

We use sub-processors to operate the Business Portal. As of the last-updated date above, our material sub-processors include:

• Stripe — payment processing for Business Orders
• Sutton Bank — issuing bank for the underlying gift card product
• Highnote — card program management
• Google Cloud / Firebase — hosting, authentication, and data storage
• Email and SMS providers — used for gift delivery and transactional notifications
• Customer support, security, and analytics tooling

We maintain written contracts with each sub-processor requiring confidentiality and security obligations at least as protective as those in this notice. A current sub-processor list and notification mechanism for changes will be made available under the DPA.

13.7 Data Processing Addendum (DPA)

Where processing of Recipient Data is subject to GDPR, UK GDPR, CCPA/CPRA, or similar laws, the DPA governs and is incorporated by reference into this notice and the Business Portal Terms of Service. Until a separate DPA is executed, the Organization may request the then-current standard DPA at privacy@onme.com. In the event of conflict, the DPA controls with respect to Recipient Data.

13.8 No-public-gifts carve-out

Gifts sent through a Business Account are always Private Gifts. They are never:

• displayed on Public Gift Feeds;
• displayed on community / category feeds;
• displayed on user profile pages;
• displayed in curated, trending, or product-detail surfaces;
• subject to sender-or-receiver "public" toggling, untagging, retagging, or visibility-default settings;
• subject to the AI anonymization or social-quality-scoring pipelines used for consumer public gifts;
• used as Recipient-identifying material in case studies, press releases, or testimonials without the Organization's prior written consent or a separate lawful basis (Organization-level marketing use of the Organization's name, logo, and customer relationship is governed by the Business Portal Terms of Service §11.4).

Sections 26 (Social Gifting Features and Public Gifts) and 28 (User Content License) of the consumer Terms of Service do not apply to Business Orders or to any User Content created or uploaded through a Business Account.

Authorized Users do not have publicly displayable birthdays. Birthday Visibility, and any other public display of birthday information described in this notice, is a consumer-Services feature only. Authorized User accounts on the Business Portal do not have public profiles, and dates of birth (where collected from Authorized Users for legal or compliance reasons) are never publicly displayed and never used in Marketing Materials.

13.9 Recipient privacy rights routing

Where a Recipient submits a privacy-rights request to On Me regarding data uploaded by an Organization, On Me will:

1. acknowledge the request directly to the Recipient;
2. route the request to the submitting Organization (the controller / business) within a commercially reasonable timeframe;
3. assist the Organization in honoring the request within the timeframes required under applicable law;
4. respond directly to the Recipient where the applicable law requires us to do so or where the Organization has authorized us to do so.

Recipients may always opt out of further gift-related communications from On Me by clicking the unsubscribe link in any email or by contacting us at privacy@onme.com.

13.10 Acceptance and authority to bind

By creating or accessing a Business Account, the individual doing so accepts this notice on behalf of the Organization and represents that they have authority to bind the Organization. By submitting Recipient Data to us, the Organization represents and warrants that it has provided all required notices and obtained all required consents under applicable law (including CAN-SPAM, TCPA, CASL, GDPR / UK GDPR, and applicable U.S. state privacy laws) to permit On Me to process the Recipient Data for the purposes described in this notice.

14. INTERNATIONAL DATA TRANSFERS

On Me is based in the United States. Our Services are operated from, directed to, and intended solely for users located in the United States, and we do not offer the Services to, or target them at, individuals in the European Economic Area, the United Kingdom, or Switzerland. We restrict access to the Services from outside the United States. Your information is stored and processed in the United States. Some of our service providers process limited data from other countries in the course of providing services to us; where they do, they are bound by contract to protect that information consistent with this notice and with applicable U.S. law. If you access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with your local law.

15. DO WE MAKE UPDATES TO THIS NOTICE?

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date and will be effective as soon as it is accessible. If we make material changes, we may notify you either by prominently posting a notice or by directly sending you a notification. For Business Portal customers, we will notify Org Admins of material changes through in-portal notification or email.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at info@onme.com, or for Business Portal privacy matters at privacy@onme.com, or contact us by post at:

On Me Gifting, 44 Montgomery St, 3rd Floor, San Francisco, CA 94104.

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state, you may have the right to request access to the personal information we collect from you, change that information, or delete it. To request to review, update, or delete your personal information, please contact info@onme.com or, for Business Portal data, privacy@onme.com for more information.