Privacy Policy

1. Introduction

StreetFeast, LLC (“StreetFeast,” “Company,” “we,” “us,” or “our”) operates the StreetFeast mobile application (the “App”), the website located at streetfeastapp.com (the “Site”), and any and all related services, features, and content (collectively, the App, Site or any and all related services, features, content, or functionality are referred to herein as the “Services”). This Privacy Policy (the “Privacy Policy”) describes how we collect, use, disclose, and protect your information.

This Privacy Policy constitutes a legally binding agreement between you (“you,” “your,” or “User”) and StreetFeast, LLC (“StreetFeast,” “Company,” “we,” “us,” or “our”). If you are accessing and/or using our Services for an entity, such as the company you work for, you represent that you have authority to bind that entity to this Privacy Policy, and you agree that “you,” and “your,” and “User” as used in this Privacy Policy includes both you personally and the entity you represent. If you are accessing our Services on behalf of only yourself as an individual, then you agree that “you,” and “your,” and “User” as used in this Privacy Policy includes only you personally as an individual.

BY ACCESSING, DOWNLOADING, INSTALLING, OR USING THE SERVICES IN ANY MANNER, YOU ACKNOWLEDGE THAT YOU HAVE READ, FAMILIARIZED, UNDERSTOOD, AND AGREE TO BE BOUND BY THE TERMS OF THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, YOU MUST IMMEDIATELY CEASE ALL USE OF THE SERVICES. YOUR CONTINUED USE OF THE SERVICES FOLLOWING THE POSTING OF ANY AMENDMENTS TO THIS PRIVACY POLICY SHALL CONSTITUTE YOUR ACCEPTANCE OF SUCH AMENDMENTS.

This Privacy Policy applies to all information collected through our Services, regardless of the device or method used to access them. This Privacy Policy does not apply to information collected by third parties, including but not limited to information collected by third parties through any application or content that may link to or be accessible from the Services.

2. Definitions

• “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.
• “Processing” means any operation or set of operations performed on Personal Information, including but not limited to collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.
• “Service Provider” means a legal entity that processes Personal Information on behalf of StreetFeast pursuant to a written contract.
• “Vendor” means any food truck operator, street food vendor, or pop-up restaurant that utilizes the Services including, but not limited to listing, promoting, and/or managing their business.
• “Device Identifier” means a unique string of characters assigned to or derived from your device, including but not limited to device fingerprints, advertising identifiers, and hardware identifiers.

3. Information We Collect

3.1 Personal Information You Provide Directly

When you create an account, register a food truck, or otherwise interact with the Services, we may collect:

• Information You Provide. Information you voluntarily provide to us
• Account Registration Information: first name, last name, email address, phone number, OTP code, password (stored in encrypted form), and ZIP code.
• Vendor Registration Information: truck/business name, ZIP code, and geographic coordinates derived therefrom (latitude and longitude)
• Profile Information: profile photographs, photographs, images, food preferences, favorites, dietary restrictions, and cuisine types
• Communication Data: name, email address, and message content submitted through our contact forms, as well as any correspondence you direct to our customer support channels
• Payment Information: subscription selections, payment data and billing preferences (note: payment card details are processed directly by our third-party payment processor and are not stored on our servers)

3.2 Information Collected Automatically

When you access or use the Services, we automatically collect:

• Location Data: precise GPS coordinates (with your consent); ZIP code-derived geographic coordinates. You may withdraw your consent to these location-based features of the Services by disabling the geolocation function on your mobile device. Please note that withdrawing consent may limit or eliminate certain functionality of the Services, including but not limited to the ability to discover nearby Vendors
• Device Information: device type, operating system, operating system version, unique Device Identifiers, platform, App version, mobile network information, system timezone, firebase installation ID, Android ID, and user-agent strings
• Device Fingerprint: we utilize device fingerprinting technology to generate a unique Device Identifier based on your browser and device attributes (including but not limited to browser type, installed plugins, screen resolution, and hardware characteristics) for fraud prevention and security purposes
• Usage Data: search queries, Vendor interactions, pages and screens visited, features utilized, favorites saved, in-app activities, and navigation patterns
• Log Data: Internet Protocol (IP) address, browser type and version, referring/exit pages, date/time stamps, clickstream data, and diagnostic information
• Local Storage Data: authentication tokens and session identifiers stored on your device via browser local storage mechanisms
• Push Notification Tokens: unique device tokens required for the delivery of push notifications to your device

3.3 Information from Third-Party Sources

We may receive information about you from third-party sources, including but not limited to:

• Authentication Providers: account verification data from Supabase, our authentication infrastructure provider
• Analytics Platforms: aggregated and individual usage metrics from PostHog, our product analytics platform
• Payment Processors: transaction confirmation data, subscription status, and billing events from Apple App Store and/or Google Play in-app purchase systems
• Bot Detection Services: risk assessment scores and verification tokens from Google reCAPTCHA v3
• Mapping Services: geocoding data and location services from the Google Maps Platform and/or Apple Maps Platform

4. Legal Bases for Processing (Applicable Jurisdictions)

Where required by applicable law, we process your Personal Information on the following legal bases:

• Contractual Necessity: Processing necessary for the performance of our contract with you, including but not limited to account creation, service delivery, Vendor-user interactions, and subscription management.
• Consent: Where you have provided explicit, informed, and freely given consent, including but not limited to for precise location data collection, push notification delivery, and marketing communications. You may withdraw consent at any time as described in Section 9.
• Legitimate Interests: Processing necessary for our legitimate business interests, provided such interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include but are not limited to fraud prevention, Services improvement, analytics, security, and enforcement of our terms.
• Legal Obligation: Processing necessary for compliance with applicable legal requirements, including but not limited to tax obligations, regulatory mandates, law enforcement requests, and litigation preservation duties.

5. How We Use Your Information

5.1 Services Provision and Operations

• Create, maintain, and administer your account
• Facilitate connections between users and Vendors
• Process and manage subscriptions through Apple App Store and Google Play in-app purchases
• Provide location-based Vendor discovery and recommendations
• Display Vendor locations via Google Maps integration and/or Apple Maps integration
• Deliver push notifications regarding Vendors, events, and Services updates
• Enable contact form submissions and customer support communications
• Authenticate your identity and manage session security

5.2 Security and Fraud Prevention

• Verify human interaction and prevent automated abuse via Google reCAPTCHA v3
• Detect and prevent fraudulent activity, unauthorized access, and other illegal activities through device fingerprinting
• Monitor and analyze patterns of suspicious behavior
• Protect the integrity, security, and availability of the Services

5.3 Analytics and Improvement

• Analyze usage patterns, trends, and user behavior including, but not limited to through PostHog analytics
• Conduct session recording and replay analysis to identify usability issues
• Evaluate feature adoption and the effectiveness of Services improvements
• Conduct A/B testing and feature flag experimentation
• Perform research and analysis for product development and business planning

5.4 Communications

• Send Services-related notices, including but not limited to account verification emails, password reset communications, and subscription confirmations
• Deliver push notifications about nearby Vendors, events, promotions, and Services updates
• Provide customer support and respond to inquiries submitted through our contact form or support email
• Send marketing and promotional communications (with your prior consent, where required by law)

5.5 Legal Compliance and Protection

• Comply with applicable laws, regulations, legal processes, and governmental requests
• Enforce our Terms of Service, this Privacy Policy, and other agreements
• Protect the rights, property, and safety of StreetFeast, the Services, our users, Vendors, and the public
• Investigate and address potential violations of our policies or applicable law

6. How We Share Your Information

StreetFeast does not sell, rent, or trade your Personal Information to third parties for their own marketing purposes. We may disclose your information in the following circumstances:

6.1 Service Providers and Processors

We engage third-party Service Providers to perform functions on our behalf, subject to contractual obligations of confidentiality and data protection:

• Supabase — authentication, database hosting, and backend infrastructure
• Apple App Store — in-app purchase processing and subscription management for iOS devices (Apple's processing of payment data is governed by Apple's Privacy Policy at https://www.apple.com/legal/privacy/)
• Google Play — in-app purchase processing and subscription management for Android devices (Google's processing of payment data is governed by Google's Privacy Policy at https://policies.google.com/privacy)
• PostHog — product analytics, session recording, and user behavior analysis (PostHog's data processing is governed by the PostHog Privacy Policy at https://posthog.com/privacy)
• Google (Maps Platform) — geocoding, mapping, and location-based services (subject to Google's Privacy Policy at https://policies.google.com/privacy)
• Google (reCAPTCHA v3) — bot detection and abuse prevention (subject to Google's Privacy Policy and Terms of Service)
• Apple (Maps Platform) — geocoding, mapping, and location-based services subject to Apple's Privacy Policy at https://www.apple.com/legal/privacy/)
• Push Notification Services — device token management and push notification delivery infrastructure
• Fraud Prevention Services — device fingerprinting for security and abuse prevention

6.2 Data Processing Inventory

6.3 Vendors

When you interact with Vendors on the platform (e.g., saving favorites, viewing Vendor profiles, or engaging with Vendor content), certain information may be shared with those Vendors to facilitate the Services. We do not share your precise location, contact information, or payment details with Vendors without your explicit consent.

6.4 Legal and Regulatory Disclosures

We may disclose your information without your consent where we have a good-faith belief that disclosure is necessary to:

• Comply with applicable laws, regulations, or legal processes, including subpoenas, court orders, or governmental requests
• Enforce our Terms of Service, this Privacy Policy, or other contractual obligations
• Protect the rights, property, or safety of StreetFeast, our users, or the public
• Detect, investigate, prevent, or address fraud, security, or technical issues

6.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, dissolution, asset sale, financing or similar corporate transaction, your Personal Information may be transferred, sold, or otherwise disclosed to the successor entity. We will use reasonable efforts to direct the transferee to use your Personal Information in a manner consistent with this Policy. In such event, you will be notified via email and/or a prominent notice on our Services of any change in ownership or uses of your Personal Information, as well as any choices you may have regarding your Personal Information.

6.6 With Your Consent

We may share your Personal Information for purposes not described in this Policy with your express, informed consent, including but not limited to fulfill requests from you.

6.7 Aggregated and De-Identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, marketing, analytics, and other purposes.

7. Data Retention

We retain your Personal Information for as long as reasonably necessary to fulfill the purposes for which it was collected, including but not limited to:

• Active Account Data: retained for the duration of your account's existence and active use of the Services
• Transaction and Subscription Records: retained for a minimum of seven (7) years following the transaction date, as required by applicable tax and financial regulations
• Communication Records: contact form submissions and customer support correspondence retained for three (3) years from the date of submission
• Usage and Analytics Data: retained in identifiable form for up to twenty-four (24) months, after which it is aggregated or anonymized
• Security and Fraud Prevention Data: device fingerprints and security logs retained for up to thirty-six (36) months
• Authentication Logs: retained for twelve (12) months from the date of the session

Upon account deletion, we will delete or anonymize your Personal Information within thirty (30) calendar days, except where retention is required by applicable law, necessary for the establishment, exercise, or defense of legal claims, or required for our legitimate business interests (e.g., fraud prevention). Cached or archived copies of your information may persist in non-public backup systems for up to ninety (90) days following deletion.

8. Data Security

We implement and maintain commercially reasonable administrative, technical, organizational, and physical security measures designed to protect your Personal Information from unauthorized access, use, alteration, disclosure, and destruction. These measures include, without limitation:

• Encryption of data in transit using TLS/SSL protocols and encryption of data at rest
• Secure password hashing algorithms for credential storage
• Role-based access controls and principle of least privilege
• Regular security assessments, vulnerability scanning, and penetration testing
• Incident response and data breach notification procedures
• Employee and contractor confidentiality obligations and security training

NOTWITHSTANDING THE FOREGOING, NO METHOD OF ELECTRONIC TRANSMISSION OR STORAGE IS COMPLETELY SECURE, PERFECT OR IMPENETRABLE AND WE CANNOT AND DO NOT PROMISE OR GUARANTEE THE ABSOLUTE SECURITY OF YOUR PERSONAL INFORMATION. ANY TRANSMISSION OF PERSONAL INFORMATION IS AT YOUR OWN RISK. YOU ARE RESPONSIBLE FOR MAINTAINING THE CONFIDENTIALITY OF YOUR ACCOUNT CREDENTIALS AND FOR ALL ACTIVITIES THAT OCCUR UNDER YOUR ACCOUNT. YOU SHOULD ONLY ACCESS THE SERVICES WITHIN A SECURE ENVIRONMENT. YOU AGREE TO IMMEDIATELY NOTIFY US IMMEDIATELY OF ANY UNAUTHORIZED USE OF YOUR ACCOUNT OR ANY OTHER BREACH OF SECURITY.

9. Your Rights and Choices

9.1 Access and Correction

You may access and update your Personal Information through your account settings within the App. You may also submit a verifiable request to access the specific pieces of Personal Information we hold about you by contacting us as described in Section 21.

9.2 Data Portability

You have the right to request a copy of your Personal Information in a structured, commonly used, and machine-readable format (e.g., JSON or CSV).

9.3 Deletion

You may request deletion of your account and Personal Information through the App or by visiting our Delete My Data page. You may also submit a deletion request by contacting us as described in Section 21. Note that we may retain certain information as required by law or as described in Section 7.

9.4 Restriction and Objection

Where permitted by applicable law, you have the right to request restriction of processing of your Personal Information and to object to processing based on our legitimate interests. Where required by applicable law, we will review and respond to such requests.

9.5 Consent Withdrawal

Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Withdrawal of consent may limit the functionality of the Services available to you.

9.6 Marketing and Push Notification Opt-Out

You may opt out of marketing communications by:

• Adjusting notification preferences in the App's settings
• Using the unsubscribe mechanism included in marketing emails
• Texting STOP in response to SMS marketing messages
• Disabling push notifications through your device's operating system settings

9.7 Location Services

You may disable precise location services at any time through your device's operating system settings. Disabling location services may limit the functionality of the Services, including but not limited to the ability to discover nearby Vendors.

9.8 Do Not Track Signals

The Services do not currently respond to “Do Not Track” (DNT) browser signals or similar mechanisms, as there is no industry-accepted standard for DNT signal interpretation.

9.9 Exercising Your Rights

To exercise any of the rights described in this Section, please contact us as described in Section 21. We may require you to verify your identity before processing your request. We will respond to verifiable requests within the timeframes required by applicable law. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

You can also designate an authorized agent to make a request on your behalf. If you use an authorized agent, please include written permission that you have designated that agent to make the request, or proof of the agent's power of attorney. We may follow up with you to verify your identity before processing your authorized agent's request.

If you are a resident of certain jurisdictions, then please see your additional rights listed in Section 14.

10. Cookies Policy, Local Storage, and Tracking Technologies

10.1 Overview

We and our third-party Service Providers use the following technologies to collect information:

• Cookies: small data files placed on your device to remember preferences, authenticate sessions, and analyze usage patterns. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted or expired)
• Local Storage: the Services use browser local storage to persist authentication tokens (access tokens and refresh tokens) and session data on your device. This data is essential for maintaining your authenticated session and is not transmitted to third parties
• Web Beacons and Pixels: small electronic images used to monitor user engagement and deliver analytics data
• Device Fingerprinting: we generate a unique identifier from your browser and device attributes (including browser type, installed plugins, screen resolution, and hardware characteristics) for fraud detection purposes
• reCAPTCHA Tokens: Google reCAPTCHA v3 operates in the background to assess the risk of interactions and may collect hardware and software information, browser data, and interaction patterns

10.2 Cookies Policy

By continuing to use the Services you are agreeing to the use of cookies and other similar technologies for the purposes we describe in this Cookies Policy.

The Services uses both first party cookies which are set directly by us and third party cookies which are set by third parties. We use first party and third party cookies for several reasons. Some cookies are required for technical reasons in order for the Services to operate, and we refer to these as “Strictly Necessary” cookies. Some cookies allow us to measure and improve the performance of the Services, such as by counting visits and traffic sources, and we refer to these as “Performance” cookies. Some cookies enable us to provide enhanced functionality and personalization of the Services, and we refer to these as “Functional” cookies. The specific types of cookies served through the Services and the purposes they perform are described below:

• Strictly Necessary Cookies: These cookies enable you to navigate the Services and to use their services and features. These cookies are necessary for the Services to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, authenticating users, or logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the Services will not work.
• Performance Cookies: These cookies and other technologies improve your experience by enabling personalization (for example, remembering if you have logged into the Services before), as well as enabling certain features. Performance cookies may also help you fill out forms in the Services more easily.
• Functional Cookies: These cookies and other technologies help us learn how well the Services are performing. We use these cookies to understand, improve, and research the Services.
• Unclassified: Unclassified cookies are cookies that we are in the process of classifying, together with the providers of individual cookies.

You may manage cookie preferences through your browser settings. Clearing cookies and local storage will terminate your authenticated session and require you to log in again. Certain tracking technologies are essential for the Services to function and cannot be disabled without impairing core functionality. In addition, you may: (1) delete your cookies (see below for information on deleting cookies); and then (2) refresh the web page. If you do not agree to the use of cookies, you also may disable or delete the cookies by following the instructions for your browser(s) set out at http://www.allaboutcookies.org/manage-cookies/index.html. Please note that the Services will not function well if cookies are disabled. It may also stop you from saving customized settings, like login information or a multitude of other critical functions. You may download a browser extension that will help preserve the opt-out preferences you set by visiting www.aboutads.info/PMC.

11. Third-Party Analytics and Services

We use PostHog as our primary product analytics platform. PostHog collects and processes data on our behalf to help us understand user behavior, improve the Services, and optimize user experience. PostHog may collect:

• Device Identifiers and technical information
• App usage data, screen views, and interaction events
• User session recordings and interaction replays
• Feature flag assignments and experiment participation data

For information about how PostHog processes data, please review their privacy policy at https://posthog.com/privacy and their terms of service at https://posthog.com/terms.

We also utilize Google services (Maps Platform and reCAPTCHA v3), which are governed by Google's Privacy Policy at https://policies.google.com/privacy and Google's Terms of Service at https://policies.google.com/terms. Google reCAPTCHA v3 may collect hardware and software information (including but not limited to device and application data), and this data is used for improving reCAPTCHA and general security purposes. We also utilize Apple services (Maps Platform), which is governed by Apple's privacy policy is available at https://www.apple.com/legal/privacy/.

Our payment processing is handled through Apple App Store and Google Play in-app purchase systems. When you subscribe to paid services, your payment information is collected and processed directly by Apple or Google, depending on your device platform, pursuant to their respective privacy policies. StreetFeast does not store, process, or have access to your payment card numbers or billing details. Apple's privacy policy is available at https://www.apple.com/legal/privacy/ and Google's privacy policy is available at https://policies.google.com/privacy.

12. Children's Privacy

The Services are not directed to, and we do not knowingly collect Personal Information from, solicit Personal Information from or market to individuals under the age of thirteen (13). If you are under the age of thirteen (13), you may not use the Services or provide any Personal Information to us. If you are a parent or legal guardian and believe that your child under the age of thirteen (13) has provided us with Personal Information, please contact us immediately at customer-support@streetfeastapp.com. Upon verification, we will take prompt steps to deactivate the account and delete such information from our systems. If we become aware that we have collected Personal Information from a child under the age of thirteen (13) without verification of parental consent, we will take commercially reasonable steps to delete that information.

13. Geographic Scope

The Services are operated in the United States of America and is intended for users located within the United States of America. We do not knowingly offer Services to individuals in the European Union or other jurisdictions outside the United States of America. As such, we make no representation that the Services are appropriate or available for use beyond the United States of America. If you use the Services outside of the United States of America, you are doing so on your own initiative and you are solely responsible for compliance with applicable local laws regarding your online conduct and acceptable content, if and to the extent local laws apply. Your Personal Information is stored and processed in the United States of America, and by using the Services, you consent to the storage and processing of your information within the United States of America.

14. State Specific Privacy Rights

14.1 California Privacy Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”). This information supplements our Privacy Policy for California residents only. The following rights do not apply to individuals who reside outside of California.

14.1.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of Personal Information we have collected about you, the categories of sources from which the information was collected, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share the information.

14.1.2 Right to Delete

You have the right to request deletion of your Personal Information, subject to certain exceptions provided by law. For example, we are not required to delete Personal Information if it is necessary for us to complete your transaction. We are also not required to delete your Personal Information if it is for an ongoing business relationship. Upon receipt and verification of a consumer request to delete Personal Information, we will delete (and direct third-party service providers to delete) your Personal Information from our records, unless an exclusion applies.

14.1.3 Right to Correct

You have the right to request correction of inaccurate Personal Information that we maintain about you.

14.1.4 Right to Opt-Out of Sale or Sharing

StreetFeast does not sell your Personal Information as defined under the CCPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

14.1.5 Right to Limit Use of Sensitive Personal Information

To the extent we process sensitive Personal Information (such as precise geolocation), we do so only for purposes authorized under the CCPA, including providing the Services you request.

14.1.6 Right to Non-Discrimination

We shall not discriminate against you for exercising any of your CCPA rights, including by denying goods or services, charging different prices, providing a different level or quality of goods or services, or suggesting that you will receive a different price or rate.

14.1.7 Categories of Information Collected

In the preceding twelve (12) months, we have collected the following categories of Personal Information as defined by the CCPA: Identifiers (name, email, phone number, IP address, Device Identifiers); Personal information categories listed in Cal. Civ. Code 1798.80(e) (name, telephone number); Commercial information (subscription records, purchasing history); Internet or electronic network activity (browsing history, interaction with Services); Geolocation data (precise and approximate location); and Inferences drawn from the above to create a profile.

14.1.8 Exercising Your Rights

To exercise your CCPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “California Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

In addition, you may report a complaint to the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs by telephone at (800) 952-5210 or by mail at California Department of Consumer Affairs, 400 R Street, Sacramento, CA 95814.

14.2 Colorado Privacy Rights

If you are a Colorado resident, you have the following rights under the Colorado Privacy Act (“CPA”). This information supplements our Privacy Policy for Colorado residents only. The following rights do not apply to individuals who reside outside of Colorado.

Under the CPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the CPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your CPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Colorado Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.3 Connecticut Privacy Rights

If you are a Connecticut resident, you have the following rights under the Connecticut Data Privacy Act (“CTDPA”). This information supplements our Privacy Policy for Connecticut residents only. The following rights do not apply to individuals who reside outside of Connecticut.

Under the CTDPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the CTDPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your CTDPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Connecticut Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.4 Delaware Privacy Rights

If you are a Delaware resident, you have the following rights under the Delaware Personal Data Privacy Act (“DPDPA”). This information supplements our Privacy Policy for Delaware residents only. The following rights do not apply to individuals who reside outside of Delaware.

Under the DPDPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the DPDPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your DPDPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Delaware Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.5 Florida Privacy Rights

If you are a Florida resident, you have the following rights under the Florida Digital Bill of Rights (“FDBR”). This information supplements our Privacy Policy for Florida residents only. The following rights do not apply to individuals who reside outside of Florida.

Under the FDBR, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the FDBR. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your FDBR rights, please contact us at customer-support@streetfeastapp.com with the subject line “Florida Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.6 Indiana Privacy Rights

If you are an Indiana resident, you have the following rights under the Indiana Consumer Data Protection Act (“INCDPA”). This information supplements our Privacy Policy for Indiana residents only. The following rights do not apply to individuals who reside outside of Indiana.

Under the INCDPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the INCDPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your INCDPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Indiana Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.7 Iowa Privacy Rights

If you are an Iowa resident, you have the following rights under the Iowa Consumer Data Protection Act (“ICDPA”). This information supplements our Privacy Policy for Iowa residents only. The following rights do not apply to individuals who reside outside of Iowa.

Under the ICDPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the ICDPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your ICDPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Iowa Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.8 Kentucky Privacy Rights

If you are a Kentucky resident, you have the following rights under the Kentucky Consumer Data Protection Act (“KCDPA”). This information supplements our Privacy Policy for Kentucky residents only. The following rights do not apply to individuals who reside outside of Kentucky.

Under the KCDPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the KCDPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your KCDPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Kentucky Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.9 Maryland Privacy Rights

If you are a Maryland resident, you have the following rights under the Maryland Online Data Privacy Act (“MODPA”). This information supplements our Privacy Policy for Maryland residents only. The following rights do not apply to individuals who reside outside of Maryland.

Under the MODPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the MODPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your MODPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Maryland Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.10 Minnesota Privacy Rights

If you are a Minnesota resident, you have the following rights under the Minnesota Consumer Data Privacy Act (“MCDPA”). This information supplements our Privacy Policy for Minnesota residents only. The following rights do not apply to individuals who reside outside of Minnesota.

Under the MCDPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the MCDPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your MCDPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Minnesota Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.11 Montana Privacy Rights

If you are a Montana resident, you have the following rights under the Montana Consumer Data Privacy Act (“MTCDPA”). This information supplements our Privacy Policy for Montana residents only. The following rights do not apply to individuals who reside outside of Montana.

Under the MTCDPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the MTCDPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your MTCDPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Montana Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.12 Nebraska Privacy Rights

If you are a Nebraska resident, you have the following rights under the Nebraska Data Privacy Act (“NDPA”). This information supplements our Privacy Policy for Nebraska residents only. The following rights do not apply to individuals who reside outside of Nebraska.

Under the NDPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the NDPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your NDPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Nebraska Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.13 Nevada Privacy Rights

If you reside in the State of Nevada, you have the right to request that we do not sell your personal information. Please contact us at customer-support@streetfeastapp.com with the subject line “Nevada Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request. This information supplements our Privacy Policy for Nevada residents only. The above rights do not apply to individuals who reside outside of Nevada.

14.14 New Hampshire Privacy Rights

If you are a New Hampshire resident, you have the following rights under the New Hampshire Privacy Act (“NHPA”). This information supplements our Privacy Policy for New Hampshire residents only. The following rights do not apply to individuals who reside outside of New Hampshire.

Under the NHPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the NHPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your NHPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “New Hampshire Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.15 New Jersey Privacy Rights

If you are a New Jersey resident, you have the following rights under the New Jersey Data Privacy Act (“NJDPA”). This information supplements our Privacy Policy for New Jersey residents only. The following rights do not apply to individuals who reside outside of New Jersey.

Under the NJDPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the NJDPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your NJDPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “New Jersey Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.16 Oregon Privacy Rights

If you are an Oregon resident, you have the following rights under the Oregon Consumer Privacy Act (“OCPA”). This information supplements our Privacy Policy for Oregon residents only. The following rights do not apply to individuals who reside outside of Oregon.

Under the OCPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the OCPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your OCPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Oregon Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.17 Rhode Island Privacy Rights

If you are a Rhode Island resident, you have the following rights under the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”). This information supplements our Privacy Policy for Rhode Island residents only. The following rights do not apply to individuals who reside outside of Rhode Island.

Under the RIDTPPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the RIDTPPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your RIDTPPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Rhode Island Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.18 Tennessee Privacy Rights

If you are a Tennessee resident, you have the following rights under the Tennessee Information Protection Act (“TIPA”). This information supplements our Privacy Policy for Tennessee residents only. The following rights do not apply to individuals who reside outside of Tennessee.

Under the TIPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the TIPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your TIPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Tennessee Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.19 Texas Privacy Rights

If you are a Texas resident, you have the following rights under the Texas Data Privacy and Security Act (“TDPSA”). This information supplements our Privacy Policy for Texas residents only. The following rights do not apply to individuals who reside outside of Texas.

Under the TDPSA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the TDPSA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your TDPSA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Texas Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.20 Utah Privacy Rights

If you are a Utah resident, you have the following rights under the Utah Consumer Privacy Act (“UCPA”). This information supplements our Privacy Policy for Utah residents only. The following rights do not apply to individuals who reside outside of Utah.

Under the UCPA, you have the rights listed below which are not absolute, and in certain cases, we may decline your request as permitted by law:

• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising or the sale of personal data.

We do not sell or share your personal information, as those terms are defined under the UCPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your UCPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Utah Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request.

14.21 Virginia Privacy Rights

If you are a Virginia resident, you have the following rights under the Virginia Consumer Data Protection Act (“VCDPA”). This information supplements our Privacy Policy for Virginia residents only. The following rights do not apply to individuals who reside outside of Virginia.

Under the VCDPA:

• “Consumer” means a natural person who is a resident of the Commonwealth acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.
• “Personal data” means any information that is linked or reasonably linkable to an identified or identifiable natural person. “Personal data” does not include de-identified data or publicly available information.
• “Sale of personal data” means the exchange of personal data for monetary consideration. If this definition of “consumer” applies to you, we must adhere to certain rights and obligations regarding your personal data. Your rights with respect to your personal data are the:
• Right to be informed whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

We do not sell or share your personal information, as those terms are defined under the VCDPA. We do not share your Personal Information for cross-context behavioral advertising purposes.

To exercise your VCDPA rights, please contact us at customer-support@streetfeastapp.com with the subject line “Virginia Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. We will respond to verifiable requests within forty-five (45) calendar days. In the event that we need additional time to respond, we will notify you in writing of the reason why additional time is necessary and the extension period for response which shall comply with current law. In order to be able to provide such writing, we will need your email address or U.S. mailing address. The response to a verifiable consumer request will cover the twelve (12) month period preceding our receipt of the request or the amount required by law, whichever is greater. If for any reason we cannot comply with all or part of your request, we will explain the reasons why. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit information easily from one entity to another entity. We will not charge you a fee to process or respond to your verifiable consumer request unless your request is excessive, repetitive or manifestly unfounded. Should we determine that your request warrants that we charge a fee, we will communicate why it made that decision along with the estimated costs associated with your request prior to completing your request. If your appeal is denied, you may contact the Attorney General to submit a complaint.

14.22 Privacy Rights For Other Jurisdictions

If you are located in another jurisdiction that is not specifically discussed in this Privacy Policy, you may have rights, under applicable data privacy laws, to request information about or access to your personal information that we maintain, to require that inaccurate information be corrected or, in some circumstances, to object to our processing of your personal information. To exercise any rights you may have in another jurisdiction, please contact us at customer-support@streetfeastapp.com with the subject line “Other Jurisdiction Privacy Rights.” You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We will verify your identity before fulfilling any request. We may follow up with you to verify your identity before processing your authorized agent's request. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

15. Data Breach Notification

In the event of a security breach that results in the unauthorized access, acquisition, or disclosure of your Personal Information, we will:

• Investigate the nature and scope of the breach promptly
• Take reasonable steps to contain and remediate the breach
• Notify affected individuals without unreasonable delay, and in no event later than the timeframes required by applicable state breach notification laws in the United States of America
• Provide notification to applicable regulatory authorities as required by law
• Include in such notification a description of the nature of the breach, the categories and approximate number of individuals concerned, the likely consequences, and the measures taken or proposed to address the breach

16. Updates to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time in our sole discretion. Amendments to this Privacy Policy shall apply to information already collected as well as information collected after the effective date of the amendment. We will notify you of material changes by:

• Posting the updated Policy on the App and Site
• Updating the “Effective Date” at the top of this Policy
• Sending notification through the App or via email for material changes

Your continued use of the Services following the posting of any amendments constitutes your acceptance of such amendments. If you do not agree to the amended Policy, you must immediately discontinue use of the Services and request deletion of your account.

17. Terms of Service

Your use of the Service is also governed by our Terms of Service, which is hereby incorporated into this Privacy Policy by reference. Please review the Terms of Service carefully since you acknowledge and agree that you have read our Terms of Service and agree to our Terms of Service by accessing and/or using the Services. As stated in the Terms of Service, the Terms of Service may be changed from time to time and such changes are effective immediately upon their posting. Capitalized terms used but not defined in this Privacy Policy will have the meanings assigned to them in the Terms of Service.

18. Severability

If any provision of this Privacy Policy is held by a court or arbitrator of competent jurisdiction to be invalid, illegal, or unenforceable, such provision shall be modified and interpreted to accomplish the objectives of such provision to the greatest extent possible under applicable law, and rhe remaining provisions shall continue in full force and effect.

19. Entire Agreement

This Privacy Policy, together with our Terms of Service and any other agreements, policies, or guidelines expressly incorporated by reference, constitutes the sole and entire agreement between you and StreetFeast with respect to the subject matter hereof and supersedes all prior or contemporaneous communications, understandings, representations, warranties, and/or agreements, whether oral or written, with respect to such subject matter.

20. Waiver

No failure or delay by StreetFeast in exercising any right, remedy, power, or privilege under this Privacy Policy shall operate as a waiver thereof. No single or partial exercise of any right or remedy shall preclude any other or further exercise thereof or the exercise of any other right or remedy. Any waiver must be in writing and signed by StreetFeast to be effective.

21. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: