At or before the point of collection, we collect the categories of personal information described in Section 2. We use this information for the purposes described in Section 4, including providing the Platform, processing and supporting transactions between Buyers and Makers, communicating with you, personalizing your experience, marketing (with consent where required), preventing fraud, complying with law, and improving the Platform.

We retain personal information for the periods described in Section 7. We may "sell" or "share" certain personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act, as amended ("CCPA"), and similar laws. See Section 6. We may use or disclose sensitive personal information only for the purposes permitted by Section 7027(m) of the CCPA regulations, and we do not need to offer a Right to Limit because we do not use or disclose sensitive personal information for purposes beyond those permitted purposes.

We collect personal information from you directly, from your device automatically as you interact with the Platform, from Makers and other Users, from our service providers and contractors, from advertising and analytics partners, from social media platforms, and from publicly available sources.

We use personal information for the following business and commercial purposes:

• to operate, maintain, secure, and improve the Platform;
• to create and manage your account;
• to process and support transactions between Buyers and Makers, including order routing, payment processing, delivery coordination, and dispute support;
• to communicate with you, including transactional, service-related, security, and policy updates;
• to send marketing communications, where permitted by law and your preferences;
• to personalize content, listings, and recommendations;
• to measure and analyze the performance of the Platform and our marketing;
• to detect, investigate, and prevent fraud, security incidents, abuse, and other unlawful activity;
• to comply with legal obligations, defend legal claims, and enforce our Terms;
• for other purposes disclosed at the point of collection or with your consent.

We may disclose personal information to the following categories of recipients:

• Makers, to fulfill orders and provide customer service for those orders;
• service providers and contractors that perform services on our behalf, including hosting, analytics, customer support, communications, fraud prevention, marketing, advertising measurement, and payment processing, under written contracts that restrict use to the purposes for which they are engaged;
• advertising and analytics partners that use cookies and similar technologies to deliver and measure advertising. See Section 6 and our Cookie Policy;
• professional advisors, including lawyers, accountants, and auditors;
• government, regulatory, or law-enforcement authorities, when required by law or where we believe disclosure is necessary to comply with legal process, protect rights, property, or safety, or address fraud or security issues;
• parties to a corporate transaction, such as a merger, acquisition, financing, reorganization, or sale of assets, subject to standard confidentiality protections;
• other parties with your consent or at your direction.

Some U.S. state privacy laws define "sale" broadly to include disclosures of personal information for non-monetary consideration, and use the term "sharing" (under California law) or "targeted advertising" (under other state laws) to describe disclosures for cross-context behavioral advertising.

We do not sell personal information in exchange for money. However, when we use third-party advertising cookies, pixels, and similar technologies to deliver advertising about us on other websites and platforms, those disclosures may be considered a "sale" or "sharing" / "targeted advertising" under these state laws. The categories of personal information that may be involved are identifiers, internet or other electronic network activity information, geolocation (approximate), and commercial information.

You can opt out of these activities at any time. See Section 10 for state-by-state details, and visit our "Do Not Sell or Share My Personal Information" link in the Platform footer. We also honor Global Privacy Control ("GPC") signals as a valid opt-out for California, Colorado, Connecticut, and other states whose laws recognize it.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

We keep personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, including to provide the Platform, comply with legal, accounting, tax, and reporting obligations, resolve disputes, enforce our agreements, and maintain business records. To determine retention periods, we consider the nature and sensitivity of the information, the purposes for processing, the risk of harm from unauthorized use or disclosure, the availability of less identifiable alternatives, and applicable legal requirements. Examples:

• account information: while the account is active and for a reasonable period afterward;
• transaction records: for the period required by tax and recordkeeping laws (generally at least seven years);
• marketing data: until you unsubscribe or otherwise withdraw consent, plus a short suppression-list retention period;
• cookies and similar technologies: as described in our Cookie Policy;
• logs and security data: for a limited operational period appropriate to the purpose.

We implement reasonable and appropriate administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, loss, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You may opt out of marketing emails at any time by clicking the unsubscribe link in our marketing emails or by contacting privacy@alloyandash.com. We may continue to send transactional and service-related communications (such as order confirmations, customer service responses, and policy updates) regardless of your marketing preferences. We do not send SMS or text-message marketing.

Depending on where you reside, you may have some or all of the following rights with respect to personal information that we hold about you:

• the right to know what categories and specific pieces of personal information we collect, use, and disclose, and the categories of sources and recipients;
• the right to access and obtain a copy of personal information we hold about you;
• the right to request deletion of personal information, subject to legal exceptions;
• the right to request correction of inaccurate personal information;
• the right to opt out of "sale," "sharing," or "targeted advertising";
• the right to opt out of profiling that produces legal or similarly significant effects (we do not engage in this kind of profiling);
• the right to limit the use and disclosure of sensitive personal information for purposes beyond those permitted by law (we do not use or disclose sensitive personal information for any other purposes);
• the right to not be discriminated against for exercising your privacy rights.

To submit a request, email privacy@alloyandash.com or use the form on the Platform. We will verify your identity using information you provide. You may use an authorized agent; we may require the agent to provide proof of authorization. We will respond within the timeframes required by law (generally 45 days, extendable to 90 days for complex requests). If we decline your request in whole or in part, we will explain why and how to appeal.

The Platform is intended for users located in the United States. If you access the Platform from outside the United States, your information will be transferred to, and processed in, the United States, which may have different data protection rules than your country.

The Platform contains links to and integrations with third-party websites and services. Their privacy practices are governed by their own policies, not this Privacy Policy. We encourage you to read their policies.

We may update this Privacy Policy from time to time. The "Effective Date" and "Last Updated" dates show the latest revision. Material changes will be communicated by email, in-Platform notice, or other reasonable means.

Questions about this Privacy Policy or your personal information may be sent to privacy@alloyandash.com or to Alloy and Ash, LLC, Attn: Privacy, Austin, TX (full address to be posted on the Platform).