Privacy Policy

Privacy Policy Effective Date: December 2, 2026 Last Updated: November 2, 2026 1. Introduction and Scope Addi, Inc. (“Addi,” “we,” “us,” or “our”), a Delaware corporation located in Kansas City, Missouri, provides this Privacy Policy to describe how we collect, use, disclose, and protect information when you use the Addi platform, website, and related services (collectively, the “Services”). This Privacy Policy applies to all users of the Services. It also applies to business contact information we process for our own marketing, including information about individuals who are not users of the Services. Addi is an AI-powered platform that helps businesses create and launch professional audio, video, and other display advertisements. The platform builds brand profiles using publicly available data, generates on-brand ads, and connects to Advertising Platforms to manage, publish, and monitor advertising campaigns, and connects to Business Platforms to import transaction and customer data for ad personalization. Please read this Privacy Policy carefully. It describes our data practices in connection with the Services. Where the law requires your consent for a specific processing activity (such as use of non-essential cookies or certain marketing communications), we will request that consent separately. We do not sell your Personal Information for monetary consideration. Some of our advertising and analytics activities may be treated as “sharing” or “targeted advertising” under U.S. state privacy laws, and you may opt out through the “Your Privacy Choices” link on our website. 1.1 Data Controller and Processor Roles For purposes of applicable data protection laws, Addi’s role depends on the data and the activity: Controller / Business: Addi is the data controller (and “business” under U.S. state privacy laws) for information we collect directly from you, such as account data, billing data, usage and log data, and inquiries to us. Addi is also the controller for business contact information it obtains from third-party data providers for its own business-to-business marketing. Processor / Service Provider: When we process data on your behalf, including brand materials you provide, ad content we generate at your direction, audience data from your connected Advertising Platform accounts, or transaction and customer data from your connected Business Platform accounts, and Customer Lists you upload, Addi acts as a processor (under GDPR/UK GDPR) and as a service provider (under U.S. state privacy laws) on your instructions and pursuant to our Terms of Service and Data Processing Addendum where applicable. Independent Controller (limited): To the extent Addi operates its own Advertising Platform accounts to deliver campaigns on your behalf, Addi may be an independent controller in its relationship with the relevant Advertising Platform (e.g., Meta, Google, TikTok, Spotify, MadHive, or others) for platform-level relationship data. 2. Information We Collect 2.1 Information You Provide Directly Category Examples Purpose Account Information Name, email address, business name Account creation, authentication, communication Billing Information Payment method details, billing address, transaction history Invoicing (processed by third-party payment processor; not stored on our servers) Brand Information Business name, website, industry, logos, images, colors, brand voice, target audience descriptions, campaign goals, geography, competitors Building brand profiles, generating advertisements Ad Content and Inputs Text, images, audio, video, scripts, prompts, creative briefs you submit AI content generation, ad creation Rights Confirmation Your confirmation that you own or have permission to use the images, video, and voice recordings you upload, along with who confirmed, the Content or campaign covered, the wording you agreed to, the Terms version, and the date and time Confirming you have the right to use your Content in the Services; responding to copyright and other rights complaints and removal requests; dispute resolution Consent Confirmation Your confirmation that anyone shown or heard in your Content (including you) has agreed to appear in your ads, including when their image or voice is edited, animated, or copied with AI, along with who confirmed, the Content or campaign covered, the wording you agreed to, the Terms version, and the date and time Confirming that real people in your Content agreed to be included; responding to concerns raised by people who appear in Content; dispute resolution Communications Support tickets, feedback, survey responses Customer support, service improvement 2.2 Information from Connected Advertising Platforms When you use the Services to run campaigns on Advertising Platforms (e.g., Spotify Ad Studio, TikTok Ads Manager, YouTube/Google Ads, Meta Ads Manager, MadHive), we may collect or generate the following data in connection with delivering those campaigns: Category Examples Purpose Campaign Data Campaign names, settings, budgets, schedules, ad creative assets, bid strategies Campaign management, optimization Audience Data Audience segment definitions, demographic information, interest categories, custom audience parameters Ad targeting, audience insights Performance Analytics Impressions, clicks, conversions, engagement rates, cost-per-action metrics, reach Performance reporting, optimization Customer Lists Hashed email addresses or phone numbers uploaded to ad platforms for custom audiences Audience targeting as directed by you Account Metadata Ad account IDs, account status, connected pages/profiles Service delivery, platform integration 2.3 Information from Third-Party Data Sources To build and enrich your brand profile, Addi compiles publicly available and API-sourced information about your business from third-party data sources. The categories of sources, data collected, and purposes are described below. Category of Source Categories of Data Collected Purpose Business directories and review platforms Business name, address, hours, categories, ratings, review excerpts Brand profile enrichment and verification Brand and visual identity providers Logos, color palettes, fonts, social media links Brand visual identity profiling Social media and web data providers Publicly available posts, engagement metrics, brand sentiment, business reviews Brand perception and market intelligence for ad relevance Company and firmographic data providers Industry classification, employee count estimates, company profile information Business profile enrichment Mapping and location services Business name and address identification Brand identification and verification This information pertains to businesses, not individuals, and is used solely to build and refine brand profiles for ad creation. Business contact information about individuals, which Addi obtains separately for its own business-to-business marketing, is not used for brand profiling. A list of our current third-party data source providers is available upon request by contacting [email protected]. Addi does not guarantee the accuracy, completeness, or timeliness of third-party data. You may review and edit your brand profile at any time within the Services. 2.4 Information Collected Automatically Category Examples Purpose Usage Data Features used, actions taken, pages viewed, session duration, ad creation history Product improvement, analytics Session Recordings Recordings of in-app interactions within defined flows, including page content, clicks, scrolling, and navigation, with input fields and on-screen text masked Customer support, troubleshooting, and understanding how users interact with the Services Device and Technical Data Device type, operating system, browser type/version, screen resolution Service optimization, troubleshooting Log Data IP addresses, access times, referring URLs, error logs, timestamps Security, fraud prevention, diagnostics Inferences Brand sentiment, target audience characteristics, brand positioning Brand profiling, ad recommendations 2.5 Cookies and Similar Technologies We use cookies and similar technologies for the following purposes: Type Purpose Lifespan Essential Authentication, security, core service functionality. Cannot be disabled. Session or up to 1 year Analytics Understanding how visitors use our website and how users interact with the Services. On our website, analytics providers (PostHog and Google Analytics) set cookies to recognize returning visitors. In the Services, PostHog is configured to operate without setting cookies, and records in-app interactions (session replay) within defined flows, with input fields and on-screen text masked; a pseudonymous session identifier associates a recording with a single session. Website: up to 1 year. Services: no cookie set Preference Remembering your settings and preferences Up to 1 year Marketing Measuring effectiveness of Addi’s own advertising campaigns and tracking ad performance Up to 1 year We do not serve third-party advertisements within the Services. For users in the EEA and UK: Analytics (including session replay), preference, and marketing technologies are placed or activated only after you provide consent through our cookie consent manager. You may withdraw consent at any time. Do Not Track and Global Privacy Control: We do not currently respond to Do Not Track browser signals, as there is no accepted industry standard for doing so. We do honor Global Privacy Control (GPC) and other recognized universal opt-out preference signals. 2.6 Information from Connected Business Platforms When you connect Business Platform accounts (e.g., Square point-of-sale or Shopify) to Services, we may collect: Category Examples Purpose Transaction Data Order records, order completion timestamps, gross and net sales, discounts, refunds, tax and tip amounts, order line items Business insights, ad content personalization Product and Catalog Data Product names, categories, pricing, inventory status Ad content generation, campaign targeting Customer Metrics Customer counts, visit frequency, aggregate purchasing patterns Audience insights, ad performance context Customer Identifiers Pseudonymous customer identifiers assigned by your connected Business Platform Distinguishing new from returning customers, aggregate audience insights Marketing Preference Flags Marketing consent status assigned by your connected Business Platform, without associated contact information Retained as part of the customer record; not used to contact your customers Account Metadata Merchant ID, location IDs, connected account status Service delivery, platform integration Important: We do not collect your customers' contact information (such as name, email address, or phone number) through Business Platform connections, and we do not sell your Business Platform data. 2.7 Biometric / Audio-Video Audio and video content you upload to the Services is processed solely as advertising creative input for generating ad Outputs. Addi does not use uploaded audio or video to identify any individual and does not knowingly create biometric identifiers (such as voiceprints or faceprints) or biometric information from uploaded content. To help you confirm that you have permission to use images of people, the Services may automatically check whether an uploaded or imported photo or video appears to show a person. The Services may also locate where a person appears in an image so it can be cropped correctly. These checks detect only whether and where a person may be present. They do not identify who the person is, compare faces against other images, or create a biometric identifier or template. Voice and Likeness Features. Certain features, such as voice cloning and AI voice synthesis, send audio to third-party service providers to generate Outputs. 2.8 Business Contact Information for Addi's Own Marketing Separately from the business information we compile for brand profiles, Addi obtains business contact information from third-party business data providers in order to market its own services to other businesses. This activity is limited to recipients in the United States. Category Examples Purpose Business Contact Information Name, job title, employer, work email address, and where provided, business phone number and professional profile link; company information such as industry, size, location, advertising activity, and website technology Business-to-business marketing of Addi's services Our role. For this activity Addi is a data controller (and a "business" under U.S. state privacy laws). We are not acting on behalf of any customer, and this information is unrelated to the data we process for merchants through connected Advertising Platform and Business Platform accounts. We do not contribute your information to shared databases. Addi does not upload, submit, or otherwise contribute contact information to any data provider’s shared, pooled, or contributory database, and chooses data providers whose terms limit their reuse of the data we send them. We do not sell your information. We do not sell business contact information. Advertising to business contacts. We may provide business contact information, such as a work email address, to advertising platforms like LinkedIn, Meta, and Google so they can show ads for Addi’s services to those contacts. Under some state privacy laws, this may be considered “sharing” for cross-context behavioral advertising or “targeted advertising.” You can opt out at any time by emailing [email protected], and we will exclude you from future uploads. How to opt out. Every marketing message includes an unsubscribe link and supports one-click unsubscribe. You may also reply to any message asking not to be contacted, or email [email protected]. We honor opt-outs permanently and across all domains we send from, and we can suppress an entire organization on request. We retain a record of your opt-out indefinitely for the sole purpose of continuing to honor it. Your rights. You may request access to, correction of, or deletion of the business contact information we hold about you by emailing [email protected], whether or not you are a user of the Services. The privacy rights set out in this Policy apply to this information. 3. How We Use Your Information 3.1 Service Delivery and Operations * Providing, operating, and maintaining the Services, including AI-powered ad generation, brand profiling, and Advertising Platform integrations * Processing your payments * Authenticating your account and managing access via WorkOS * Providing customer support and responding to inquiries * Recording and reviewing session interactions (session replay) within defined flows, to diagnose issues and assist you 3.2 AI Content Generation * Processing your Inputs (prompts, brand data, creative briefs, images, video and audio) through AI models to generate advertising content (“Outputs”) and to write insights and campaign recommendations in the Services * Sending your Inputs to third-party AI model providers solely to provide these features 3.3 Product Improvement * Analyzing usage patterns to improve the Services and develop new features * Reviewing session recordings to understand how users interact with the Services * Generating aggregated, de-identified analytics and benchmarks 3.4 Security and Compliance * Detecting, preventing, and addressing fraud, abuse, security incidents, and technical issues * Enforcing our Terms of Service * Complying with legal obligations, including responding to lawful requests from public authorities 3.5 Communications * Sending transactional communications (e.g., billing notices, security alerts) * Sending product updates, feature announcements, and marketing communications. You may opt out at any time. * Sending business-to-business marketing communications to business contacts obtained from third-party data providers. You may opt out at any time. 4. How We Share Your Information We do not sell your Personal Information. We share information only in the following circumstances: 4.1 Service Providers and Sub-Processors Provider Category Data Shared Cloud infrastructure All data (encrypted at rest and in transit) Authentication and access management Account credentials, authentication tokens Payment Processing Billing information only Business platform integrations Transaction and order records, product and catalog data, business location data, platform-assigned customer identifiers and aggregate customer metrics from connected Business Platform accounts, processed on your behalf to generate ad targeting insights and content personalization AI model providers Input content submitted for generation purposes, including ad scripts, brand context, and generation parameters; and aggregate sales and product data from connected Business Platforms, used to write insights and recommendations AI observability and evaluation Prompts, model outputs, and generation metadata used to monitor AI quality, latency, reliability and compliance with our Terms of Service Brand and business data sources Business identifiers such as name, address, URL Company and firmographic data providers Business name, industry classification, employee estimates, and company profile information for brand enrichment Product analytics Product usage and event data (such as pages viewed, features used, and actions taken), and masked session recordings of in-app interactions used for support, troubleshooting, and understanding how users interact with the Services. Session recordings mask input fields and on-screen text, are limited to defined flows, and remain linked to a pseudonymous user identifier, so they are not de-identified. Email and communications Email addresses, names, and message content for transactional communications (e.g., account invitations, billing notices) and for onboarding and marketing emails Bot protection and security IP addresses and browser signals for automated abuse prevention Geolocation lookup IP address submitted to infer approximate location (such as city or region) when you use location-based features Cookie consent management Cookie preference selections, consent status, and consent identifiers Application monitoring Application performance metrics, request traces, and log records used to monitor availability, latency, and errors. These records include IP address, request method and path, and response status. A list of our current sub-processors is published at addi.ai/sub-processors, including a log of changes. You may also request by contacting [email protected]. 4.2 Advertising Platforms When you use the Services to create and publish advertisements, we transmit ad content and campaign configurations to your connected Advertising Platforms on your behalf and at your direction. This includes ad creative assets, targeting parameters, budgets, and schedules. 4.3 Legal Requirements and Safety We may disclose your information if required by law or in good faith belief that disclosure is necessary to: (a) comply with a legal obligation, court order, or lawful request by public authorities; (b) protect and defend the rights or property of Addi; (c) prevent fraud or address security or technical issues; (d) protect the personal safety of users or the public. 4.4 Aggregated and De-Identified Data We may derive aggregated, de-identified insights from usage, performance, and Business Platform data across our merchant base to improve the Services and deliver platform-wide intelligence features. These aggregates are used to generate industry benchmarks, and identify effective advertising patterns. No individual merchant’s raw data, business identity, customer records, or transaction details are disclosed to other merchants or third parties through these features. We do not use raw Business Platform data, including transaction records, customer identifiers, or individual campaign performance, to generate cross-merchant insights without first de-identifying and aggregating that data in a manner that cannot reasonably be re-identified. 4.5 Business Transfers In the event of a business transfer such as a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. Any such transfer will be subject to the same protections described in this Policy. 4.6 Advertising for Addi’s Own Services Our website uses advertising technologies from providers such as Google, Meta, and TikTok to measure and target ads for Addi’s services, and we may provide business contact information to advertising platforms to show ads for Addi’s services. You can opt out through the “Your Privacy Choices” link on our website or by emailing [email protected]. 5. Advertising Platform Data This section provides additional detail about how we handle data from your connected Advertising Platform accounts. 5.1 Limitations on Use We do not use your Advertising Platform data to: * Serve other customers or build advertising profiles for our own purposes * Train AI models * Contact individuals in your audience segments or Customer Lists * Combine your Advertising Platform data with data from other Addi customers 5.2 Platform Compliance We comply with the data use policies of each integrated Advertising Platform, including Meta, Google, TikTok, Spotify, and MadHive, with respect to data received through their respective APIs and integrations. 5.3 Data Deletion Upon your request, upon disconnecting an Advertising Platform account, or upon receiving an authenticated deletion request from a connected Advertising Platform, we will delete the associated Advertising Platform data from our active systems within 30 days, except as required to comply with legal obligations or our data retention policy. 5.4 Customer Lists If you upload or connect Customer Lists (such as email lists for custom audience targeting), Addi processes them solely to facilitate audience targeting at your direction. 6. Business Platform Data This section provides additional detail about how we handle data from your connected Business Platform accounts (e.g., point-of-sale systems). 6.1 Limitations on Use We do not use your Business Platform data to: * Serve other merchants with your raw Business Platform data or disclose your business identity in connection with any cross-merchant analytics * Train AI models * Contact your customers or individuals reflected in transaction data * Combine your Business Platform data with data from other Addi customers (except in de-identified, aggregated form) 6.2 Data Deletion Upon your request, or upon disconnecting a Business Platform account, we will delete the associated Business Platform data from our active systems within 30 days, except as required to comply with legal obligations or our data retention policy. 7. AI and Automated Processing 7.1 AI Content Generation The Services use artificial intelligence, including third-party foundation models, to generate advertising content based on your Inputs. When you submit Inputs, they are processed by our AI systems (and, where necessary, transmitted to third-party AI model providers) to produce Outputs. We also use third-party AI observability tooling to trace and monitor AI generation requests; such tooling may receive Input and Output content for the purpose of performance monitoring and debugging. Finished Output files generated through the Services are signed with C2PA Content Credentials, cryptographically signed provenance metadata identifying Addi as the generator and recording information about how the file was made, which may include the AI model used and the generation timestamp. Certain intermediate or component files, such as draft previews, video remixes, and separate voice or music tracks, may not be signed. Finished audio, video, and display files also carry an invisible watermark that marks them as generated through the Services. 7.2 AI Model Improvement Addi does not use your Content (Inputs, Outputs, Advertising Platform data, or Business Platform data) to train or improve any AI model. This includes any Media Assets you upload to the Services, which are used solely to generate the advertising creative you requested. Addi does not sell your Personal Information, and does not use your Personal Information to train any AI model. Where a provider offers a setting to prevent its use of submitted data for model training, we use it. Some providers’ terms may still permit them to use data submitted through their services to improve their models. This never applies to Business Platform data. A current list of AI model providers is available upon request by contacting [email protected]. 7.3 Automated Decision-Making The Services use automated processing to generate ad content and provide recommendations (e.g., ad format suggestions, creative approaches based on your industry and audience). These automated processes assist you but do not make final decisions without your review and approval. You maintain full control over what content is created and published. 7.4 Human Review Addi may use human reviewers to examine content for: safety and trust investigations, quality assurance, legal compliance, and customer support. 8. Data Retention We retain your information only for as long as necessary to fulfill the purposes described in this Policy, or as required by law: Data Category Retention Period Account Information Duration of account + 30 days after deletion Billing and Transaction Records 7 years (tax and legal compliance) Brand Information and Ad Content (Inputs/Outputs) Duration of account + 90 days (exportable during this period). Uploaded Media Assets (music, audio tracks, and other uploaded media files) Duration of account + 90 days (exportable during this period). Advertising Platform Data Duration of platform connection + 30 days after disconnection Business Platform Data Duration of platform connection + 30 days after disconnection. Sales history older than 36 months is deleted on a rolling basis. Usage and Log Data Usage data: up to 24 months from collection. Log data: 30 days from collection Session Recordings Up to 30 Days from collection. A recording preserved for an active support investigation is kept until that matter is resolved, then deleted Cached Data (brand profiles, session data) 24 hours (automatically cleared) Customer Support Records Account duration + 90 days Marketing Contact Data (business contact information used for Addi's own business-to-business marketing) Until opt-out, or 24 months from last engagement, whichever is earlier. Opt-out records are retained indefinitely so the request continues to be honored Rights Confirmations and Consent Confirmations Duration of account + 7 years. Not deleted when the related Content or campaign is deleted Flagged Content (violations) Up to 1 year for investigation Cookie Data Essential cookies: session or up to 1 year. Analytics: up to 1 year on our website; no cookies set in the Services. Preference and marketing cookies: up to 1 year. Aggregated / De-Identified Data Retained indefinitely (cannot identify you) Terms and Privacy Policy Acceptance Records IP address and browser/device information: duration of account. Document version, document hash, and timestamp: 7 years following account deletion When you accept our Terms of Service or Privacy Policy, we record your IP address, browser/device information (User-Agent), the version and cryptographic hash of the document you accepted, and the timestamp, as a legal compliance audit trail. When your account is deleted, we remove the IP address and browser/device information from this record. The remaining record, consisting of the document version, its hash, and the timestamp, is retained for 7 years after account deletion so that we can evidence which version of our terms you agreed to. You may request deletion of your data at any time from your account page or by contacting [email protected]. We will process deletion requests within 30 days, except where retention is required by law. Copies held by our service providers are deleted on their own retention schedules. 9. Data Security We implement industry-standard technical and organizational measures to protect your information, including: * Encryption: AES-256 encryption at rest; TLS 1.2+ encryption in transit for all data * Authentication: Secure authentication via WorkOS with support for multi-factor authentication (MFA) * Access Controls: Role-based access controls limiting employee access to personal data on a need-to-know basis * Infrastructure: Hosted on DigitalOcean, with certain processing on Amazon Web Services (AWS), using commercially reasonable security practices * Monitoring: Security monitoring, intrusion detection, and automated alerting * Vendor Security: Security reviews of sub-processors, with data processing agreements where the provider offers one * Compliance: Addi’s security practices are designed to align with SOC 2 Type II requirements. * Breach Notification: Documented incident response procedures with commitment to notify without undue delay and in accordance with applicable law. No method of transmission or storage is 100% secure. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. To report security vulnerabilities: Contact [email protected]. 10. Your Privacy Rights 10.1 Rights for All Users Regardless of your location, you may: * Access your Personal Information by contacting us * Correct inaccurate or incomplete information by contacting us * Delete your account and associated data from your account page or by contacting [email protected] * Request a copy of your data in a machine-readable format * Opt out of marketing communications via the unsubscribe link in any marketing email * Opt out of the sharing of your Personal Information for targeted advertising through the “Your Privacy Choices” link on our website or by emailing [email protected] * Manage cookies through our cookie preference center or your browser settings To exercise these rights, contact [email protected]. We will not discriminate against you for exercising your rights. 10.2 California Residents: CCPA/CPRA If you are a California resident, you have the following additional rights: Right Description Right to Know Request disclosure of what Personal Information we collect, use, and share Right to Delete Request deletion of your Personal Information Right to Correct Request correction of inaccurate Personal Information Right to Opt-Out Opt out of the “sale” or “sharing” of Personal Information (we do not sell your data; you may opt out of sharing) Right to Limit Limit use of sensitive Personal Information Right to Non-Discrimination Not be discriminated against for exercising your rights Under CPRA, certain categories of Personal Information are classified as "sensitive personal information" (SPI) and are subject to additional rights and restrictions. The following describes Addi's collection and use of SPI: Categories of Personal Information Collected (Prior 12 Months) CCPA Category Collected? Sold? Shared for Behavioral Ads? A. Identifiers (name, email, IP address) Yes No Yes B. Personal info per Cal. Civ. Code §1798.80(e) Yes No No C. Protected classification characteristics No No No D. Commercial information (transactions, subscriptions) Yes No No E. Biometric information No No No F. Internet or network activity (usage data) Yes No Yes G. Geolocation data (IP-derived approximate; precise coordinates for business location and campaign targeting area) Yes No No H. Sensory data (audio/video you upload) Yes No No I. Professional information (job title, business) Yes No Yes J. Education information No No No K. Inferences drawn from above Yes No No Sensitive Personal Information: The categories of sensitive Personal Information (as defined under Cal. Civ. Code § 1798.140(ae)) that Addi collects are: (1) account log-in credentials, used solely for authentication; and (2) precise geolocation data in the form of business location coordinates and campaign targeting area coordinates, used solely to provide the Services. We do not collect biometric identifiers, financial account information, health data, or other sensitive Personal Information categories. We do not use or disclose sensitive Personal Information for purposes beyond those necessary to provide the Services, and we do not sell or share it. You have the right to limit our use of your sensitive Personal Information by contacting [email protected]. Authorized Agents: Authorized agents may submit requests on your behalf with (a) signed written authorization from the consumer, or (b) a valid power of attorney. We may contact the consumer directly to verify the request. To exercise your rights: Contact [email protected] or call 1-866-879-2334. We will verify your identity and respond within 45 days (extendable by an additional 45 days with notice). 10.3 EEA, UK, and Switzerland: GDPR If you are located in the European Economic Area, United Kingdom, or Switzerland, the following applies: Legal Bases for Processing Processing Activity Lawful Basis Account creation and service delivery Performance of contract (Art. 6(1)(b)) Payment processing Performance of contract (Art. 6(1)(b)) AI content generation Performance of contract (Art. 6(1)(b)) Security and fraud prevention Legitimate interests (Art. 6(1)(f)) Usage analytics and product improvement in the Services Legitimate interests (Art. 6(1)(f)) Marketing communications, and website analytics and advertising cookies Consent (Art. 6(1)(a)) Legal compliance Legal obligation (Art. 6(1)(c)) Your GDPR Rights * Right of Access (Art. 15): Request a copy of your personal data * Right to Rectification (Art. 16): Correct inaccurate personal data * Right to Erasure (Art. 17): Request deletion (“right to be forgotten”) * Right to Restriction (Art. 18): Request restriction of processing * Right to Data Portability (Art. 20): Receive data in a structured, machine-readable format * Right to Object (Art. 21): Object to processing based on legitimate interests * Withdraw Consent: At any time, without affecting lawfulness of prior processing * Lodge a Complaint: File a complaint with your local supervisory authority To exercise your rights: Contact [email protected]. We will respond within 30 days. Data Controller Addi, Inc., 117 W. 20th Street, Suite 202, Kansas City, MO 64108 Data Protection Contact: [email protected] EU Representative: If the nature and volume of our processing of EU personal data requires appointment of an EU representative under GDPR Article 27, we will appoint one and update this section. For EU data subject inquiries, contact [email protected]. 10.4 Other U.S. State Privacy Rights Residents of other U.S. states with comprehensive privacy laws may have similar rights to access, delete, correct, and port Personal Information, and to opt out of targeted advertising and profiling. Universal Opt-Out Signals: We honor universal opt-out preference signals, including Global Privacy Control (GPC), as required by applicable state laws. When we detect a recognized universal opt-out signal, we will treat it as a valid request to opt out of the sale or sharing of Personal Information and targeted advertising for that browser or device. To exercise your rights: Contact [email protected] or call 1-866-879-2334. Appeals Process: If we decline your request, you have the right to appeal. Send appeals to [email protected] with “Privacy Rights Appeal” in the subject line. We will respond within 60 days. 11. International Data Transfers Addi is based in the United States, and we process and store your information primarily in the United States. Some of our service providers process information in other countries. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States. For EEA/UK/Swiss users, we rely on the following mechanism for lawful international data transfers: * Standard Contractual Clauses (SCCs) approved by the European Commission, or another lawful transfer mechanism, where required Data Processing Addendum: Customers who process personal data subject to GDPR or other applicable data protection laws may request a Data Processing Addendum (DPA) by contacting [email protected]. The DPA incorporates Standard Contractual Clauses (Module Two: Controller to Processor) and UK IDTA where applicable. 12. Children’s Privacy The Services are designed for business users and are not directed at children. You must be at least 18 years old to use the Services, as set forth in our Terms of Service. We do not knowingly collect Personal Information from anyone under 18, and specifically comply with COPPA with respect to children under 13, and apply equivalent protections under EEA and UK law for children under 16. We do not knowingly permit customers to use the Services to upload, target, or build custom audiences from Personal Information about children, and we do not knowingly process children's Personal Information for ad targeting, delivery, or campaign management. If we learn that we have collected Personal Information from a person under 18, we will take reasonable steps to delete that information promptly. If you believe a child has provided us with Personal Information, please contact [email protected]. Advertising Directed at Children: If you create advertisements for products or services intended for children, you may not use the Services to collect, target, or process children's Personal Information, and you are responsible for compliance with the Children's Online Privacy Protection Act (COPPA) and Advertising Platform policies on ads to minors. 13. Third-Party Links The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information. 14. Changes to This Privacy Policy We may update this Privacy Policy from time to time. We will provide at least 30 days’ notice of material changes by posting the updated Policy on our website. When material changes take effect, you will be prompted to review and accept the updated Policy before continuing to use the Services. The “Last Updated” date at the top indicates when it was last revised and the "Effective Date" indicates when it takes effect. Your continued use of the Services after the effective date constitutes acceptance. 15. Contact Us If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: Addi, Inc. 117 W. 20th Street, Suite 202 Kansas City, MO 64108 Privacy and data rights requests: [email protected] Security issues: [email protected] Legal inquiries: [email protected] Phone: 1-866-879-2334