Follow'd Privacy Policy

This Privacy Policy is published by Reach Labs Inc., a Delaware corporation ("Reach Labs," "Followd," "we," "our," or "us"), which operates the Followd platform. Followd was previously offered under the name "Boon"; this Policy replaces any prior Boon privacy policy.

SECTION 1 — SCOPE AND CHANGES TO THIS POLICY

1.1 Who We Are

Reach Labs Inc. is the data controller (or "business" under U.S. state privacy laws) for the personal information described in this Policy. Our principal place of business is [●]. Questions about this Policy may be directed to privacy@followd.com.

1.2 What This Policy Covers

This Policy applies to personal information collected through followd.com, the Followd web application, the Followd iOS and Android apps, our APIs, and any other services or features that link to this Policy (collectively, the "Platform"). It does not apply to third-party websites, partner games and apps, survey providers, affiliate merchants, payment processors, shipping carriers, social platforms, or other services linked from or integrated with the Platform — those services have their own privacy policies, which we encourage you to review.

1.3 Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will: (a) update the "Last Updated" date at the top of this page; (b) post a prominent notice in the Platform; and (c) for registered Users, send a notification to the phone number, email address, or in-app inbox associated with your account. Material changes take effect 30 days after notice is provided for existing Users, and immediately for new Users. Your continued use of the Platform after the effective date constitutes your acceptance of the updated Policy.

SECTION 2 — INFORMATION WE COLLECT

2.1 Information You Provide Directly

Account registration and onboarding

• Mobile phone number (used for SMS one-time passcode login and verification), or name, email address, and profile photo received from Apple or Google if you use third-party sign-in.
• Username, display name, date of birth or age confirmation, avatar, cover photo, bio, links, and any other information you add to your public profile.
• Interest Categories you select during onboarding, Categories you tag your posts with, and the Creators you choose to follow.

Contacts and invitations

• If you choose to import your device contacts to find or invite friends, we receive the names, phone numbers, and email addresses in your address book. We use this information to match you with existing Users, to send invitations you choose to send, and to credit referral rewards. You can revoke contacts permission at any time in your device settings.

Content you create

• Posts (text, images, carousels, video, links), reposts, quote reposts, comments, likes, Community forum posts, Community and direct chat messages, recommendation lists, listings, Courses and lessons, Events, Live Room broadcasts and recordings, and any other content you publish or send.
• Reports you submit about other Users or content, and your block and mute lists.

Commerce and transactions

• Purchase, subscription, membership, unlock, tip, Paid Message, Paid Call, Course enrollment, Event RSVP/ticket, and order history: what you bought or sold, when, from whom, at what price, and status.
• Shipping name, address, and delivery instructions for Physical Goods orders; order messages between buyer and seller.
• Payment method metadata (card brand, last four digits, expiration, billing postal code). Full card numbers go directly to our payment processor.

Creator, seller, and payout information

• Legal name, address, date of birth, and tax identification information (SSN/TIN/EIN, Form W-9 or W-8).
• Payout account details (bank account, PayPal, or Venmo identifiers).
• Government-issued photo ID and selfie, where identity verification is required — collected and processed by our identity verification partner on our behalf.
• Phone number verification results for cash-out (including whether a number is VOIP or virtual).
• Page, Community, Membership Tier, Storefront, Course, and Event configuration, pricing, inventory, member roles, and earnings.

Connected accounts and Brand Campaigns

• If you connect a TikTok, Instagram, YouTube, or other social account (for example, to verify eligibility for Brand Campaigns), we receive the information you authorize that platform to share — typically your handle, display name, profile photo, follower count, and public engagement metrics — and basic statistics about campaign posts.
• Brand Campaign applications, submissions, and posted content URLs.

Communications

• Customer support inquiries and correspondence, survey responses and feedback you submit to us voluntarily, and appeals.

2.2 Information We Collect Automatically

Device and connection information

• IP address, approximate location derived from IP, device type and model, operating system and version, browser type and version, app version, language, time zone, screen resolution, carrier, and network type.
• Mobile advertising identifiers (IDFA/IDFV on iOS, GAID on Android) where permitted by your device settings, and app-instance identifiers used for attribution and push notifications.
• Push notification tokens (mobile and web push), and whether you browse as a guest or a signed-in User.

Usage and activity data

• Pages and screens visited, features accessed, search queries, content viewed, feed sort and filter selections, Categories and Pages browsed, links clicked, session duration, navigation paths, and interactions (likes, reposts, follows, joins).
• Rewards activity: tasks and quests completed, streaks, spins, tutorial progress, Points earned and redeemed, referral events, and partner game, survey, and offer events attributed to your account.
• Live Room and Paid Call participation and duration, Paid Message allowances used, Course progress and completion, Event RSVPs and attendance.
• Crash reports, performance data, and error logs.

Transaction metadata

• Transaction timestamps, amounts, currency, fees, status, withdrawal status, chargeback and dispute history, and fraud-risk signals.

2.3 Information from Third Parties

• Payment processors and payout providers (e.g., Stripe, PayPal, Venmo): transaction status, payment method metadata, billing address confirmation, payout status, and fraud signals.
• Identity, phone, and age verification partners: verification outcomes (pass/fail and flags), phone-number type, and fraud signals.
• Partner game, survey, and offer networks (for example, Unity, adjoe, BitLabs/BitBurst, or similar): confirmation that you completed a qualifying action (install, milestone, survey complete, video view), the reward amount, and an event identifier, so we can credit Points. Survey providers may share screening attributes (for example, age range, gender, or region) used to match you with surveys.
• Affiliate and commerce partners (e.g., Button): click, conversion, and commission data for purchases made through Affiliate Links.
• Brand Campaign partners and brands: campaign eligibility, approval decisions, and payout amounts.
• Social platforms you connect: the profile and statistics you authorize.
• Analytics, attribution, and advertising partners: install attribution, campaign source, and aggregated audience information.
• Fraud-prevention services: risk scores and signals used to detect fraudulent, duplicate, or automated activity.
• Other Users: for example, when someone invites you, tags you, messages you, reports you, or imports contacts that include you.

SECTION 3 — COOKIES, SDKS, AND TRACKING TECHNOLOGIES

3.1 Technologies We Use

• Cookies and local storage: small data files and browser storage that keep you logged in, remember preferences, secure your session, and measure use of the web app.
• Web beacons / pixels: tiny images in pages and emails that tell us whether content was viewed and links clicked.
• Mobile SDKs: software libraries in our apps that provide analytics, crash reporting, attribution, push notifications, chat, video, offerwalls, and advertising measurement.
• Product analytics and session replay: tools (such as PostHog) that record how you navigate and interact with the Platform (clicks, scrolls, screens, form interactions) to help us improve the experience. Session replay masks payment fields and sensitive inputs.
• Error and performance monitoring: tools (such as Sentry) that capture crash and error reports, which may include device information and the actions leading up to an error.

3.2 Categories of Cookies and SDKs

3.3 Third-Party Analytics and Advertising

We use third-party analytics, attribution, and advertising services (which may include Google, Meta, TikTok, Apple Search Ads, a mobile measurement partner such as Adjust or Singular, and similar providers) to understand how Users find and use Followd and to advertise Followd on other platforms. These providers may collect information about your activity across different websites and apps. We share only the minimum data necessary for these purposes and do not share your transaction details, message content, or government ID with advertising platforms. You can opt out of personalized advertising from Google at adssettings.google.com, from Meta in your Facebook ad settings, and from other participating companies via optout.aboutads.info or optout.networkadvertising.org.

3.4 Do Not Track and Global Privacy Control

Because there is no industry consensus on how to respond to browser "Do Not Track" signals, we do not currently alter our data practices based on DNT. We honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information where required by applicable law.

SECTION 4 — HOW WE USE YOUR INFORMATION

4.1 Platform Operations and Service Delivery

• Creating, authenticating (including SMS one-time passcodes), and maintaining your account.
• Showing your Page, posts, Community, listings, Courses, Events, and recommendation lists to other Users; operating the feed, search, discovery, notifications, and the follow graph.
• Processing Subscriptions, memberships, content unlocks, Tips, Storefront orders, Courses, Event tickets, Paid Messages, and Paid Calls; generating shipping quotes; sending order updates; issuing refunds.
• Operating Communities, Community chat, forums, Membership Tiers, direct messaging, Live Rooms, and calls.
• Running the Rewards Program: awarding and tracking Points, tasks, streaks, spins, tutorials, referrals, and bounties; attributing partner game, survey, video, and affiliate events; detecting duplicate accounts and abuse.
• Operating Brand Campaigns: verifying social accounts, matching you with campaigns, reviewing submissions, and paying approved submissions.
• Verifying phone numbers, identity, and age; onboarding Creators for payouts; processing cash-outs and withdrawals; generating earnings statements, receipts, and tax forms (e.g., IRS Forms 1099-K, 1099-NEC).
• Matching imported contacts to existing Users and delivering invitations you choose to send.

4.2 Safety, Security, and Fraud Prevention

• Detecting, investigating, and preventing fraud, duplicate or automated accounts, bots, emulators, location spoofing, reward abuse, chargebacks, unauthorized account access, and policy violations.
• Moderating content (including through automated classifiers), processing reports, enforcing blocks and mutes, and enforcing our Terms of Service and Community Guidelines.
• Operating age-gating and verification systems.
• Sharing information with law enforcement when required by law or to prevent imminent harm.

4.3 Communications

• Transactional SMS, push, in-app, and email messages: passcodes, receipts, order and shipping updates, payout and withdrawal status, subscription renewals and cancellations, Event reminders, Rewards updates, and security alerts.
• Social notifications (likes, comments, follows, reposts, pokes, Community activity, messages) according to your notification settings.
• Product updates and policy change notices; in-app announcements.
• Customer support responses and appeals.
• Marketing communications (where you have opted in or where permitted by applicable law).

4.4 Personalization and Recommendations

• Recommending creators, friends, Categories, posts, products, and Events based on your interest Categories, follows, engagement, memberships, purchases, and imported contacts (where you have chosen to import them).
• Ranking and filtering your feed (e.g., Top, New, Following, by Category, Brand Posts) and discovery surfaces.
• AI-assisted features, such as content suggestions for creators, smarter discovery, and community Q&A. Where we use your information to provide an AI feature, we use it to deliver that feature to you; we do not use your private messages or Paid Content to train generalized AI models without your separate consent.

4.5 Platform Improvement and Research

• Analyzing usage patterns, feature engagement, funnel and conversion data, and crash reports to improve the Platform; session replay analysis to identify usability issues; A/B testing and product experiments.
• Training internal models for recommendations, search, fraud detection, and content moderation using aggregated or de-identified data.

4.6 Legal Compliance and Business Operations

• Complying with applicable laws, regulations, tax obligations, court orders, and government requests; enforcing our Terms; exercising and defending legal rights and claims; maintaining records required for tax, financial, and regulatory compliance.
• Evaluating potential mergers, acquisitions, financings, or investment transactions; conducting audits, accounting, and financial reporting.

SECTION 5 — HOW WE SHARE YOUR INFORMATION

We do not sell your personal information to third parties for money. Sharing is limited to what is necessary to operate the Platform, as described below.

5.1 Service Providers

We share personal information with vendors who perform services on our behalf, including: payment processing and payouts (e.g., Stripe, PayPal, Venmo); phone, identity, and age verification; SMS and email delivery; push notification delivery; cloud hosting and storage; messaging and chat infrastructure (e.g., Sendbird); video, streaming, and calling infrastructure; customer support tools; analytics, attribution, and session replay (e.g., PostHog); error monitoring (e.g., Sentry); fraud detection and risk scoring; shipping-rate and label providers; and tax form generation and reporting. Service providers are contractually prohibited from using your information for their own purposes beyond the scope of services they provide to us.

5.2 Other Users

• Public information. Your username, display name, avatar, cover photo, bio, public posts, reposts, comments, likes (where shown), follower and following counts and lists, Categories, public memberships and Community roles, Storefront listings, Courses, Events, and recommendation lists are visible to other Users and, where we offer public web pages, to the internet.
• Creators and sellers you interact with. When you follow, subscribe to, join, unlock, tip, message, book, enroll, RSVP, or buy from a Creator, we share your username and the transaction details with that Creator, and for Physical Goods, your shipping name and address. Creators see the username and amount for Tips. Creators and their authorized moderators can see member lists, roles, activity, and billing status for their Page.
• Buyers. Sellers' usernames, Storefront details, and order messages are shared with buyers of their goods and services.
• Messaging and chat. Messages, chat content, and call participation are visible to the other participants.
• Contacts and referrals. If a friend imports contacts that include you, we may show them that you are on Followd. Referrers can see whether an invitation was accepted but not your activity.

5.3 Partner Networks and Brands

• Game, survey, and offer partners. To let you earn Points, we share a pseudonymous user identifier and, where required by the partner, your advertising identifier, IP address, device information, and basic attributes (e.g., country, language) with the partner so they can serve offers and confirm completions. Survey providers may collect demographic and screening answers directly from you under their own policies.
• Affiliate and commerce partners. When you click an Affiliate Link, the affiliate network (e.g., Button) and the merchant receive click and attribution data; we receive conversion and commission data to credit the Creator.
• Brand Campaign partners. When you apply to or participate in a Brand Campaign, we share your profile, connected social account statistics, and submissions with the sponsoring brand or agency for review and payment.

5.4 Legal Requirements and Law Enforcement

We may disclose personal information when we have a good-faith belief that disclosure is required by or permitted under applicable law, including: (a) in response to a valid subpoena, court order, or other legal process; (b) to comply with applicable law or regulation; (c) to protect the rights, property, or safety of Reach Labs, our Users, or the public; or (d) to detect, prevent, or address fraud, security, or technical issues. We report apparent child sexual exploitation to NCMEC as required by law. Where legally permissible, we will notify affected Users before disclosing their information in response to a legal request.

5.5 Business Transfers

If Reach Labs or the Followd business is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or substantially all of its assets, your personal information may be transferred to the acquiring entity. We will notify you via email, SMS, or a prominent in-Platform notice prior to any such transfer and any change in how your information is used.

5.6 With Your Consent

We may share your personal information with third parties in other circumstances when you have given us your informed, specific consent (for example, if you authorize a third-party integration or participate in a co-sponsored promotion).

5.7 Aggregated and De-Identified Data

We may share aggregated or de-identified information (which cannot reasonably be used to identify you) with partners, brands, investors, and the public for research, analytics, industry reporting, and marketing. We maintain and use de-identified data only in de-identified form and do not attempt to re-identify it.

SECTION 6 — CREATOR AND SELLER DATA PRACTICES

6.1 What We Collect from Creators

In addition to the data described in Section 2, we collect from Creators and sellers: identity and phone verification documents and results; tax identification information; payout account details; earnings, withdrawal, and paystub history; Storefront inventory, pricing, and fulfillment data; Page and Community configuration, Membership Tier settings, member roles, activity and billing logs; Course and Event configuration; connected social account statistics; and Brand Campaign and affiliate performance data.

6.2 Earnings Dashboard and Analytics

Creators have access to analytics about their own Page, including follower and member counts, revenue by source, engagement, post insights, referral performance, and payout history. Dashboard data is derived from Fan activity but is aggregated so that it does not individually identify Fans except where the Platform deliberately shows the Fan's username (for example, subscribers, Members, tippers, buyers, and message senders).

6.3 Creator Responsibility for Fan Data

Creators and sellers receive limited personal information about their Fans, Members, and buyers (for example, usernames, membership status, order details, and shipping addresses) in connection with delivering their content, goods, and services. You must: (a) use that data only for the purpose of providing the purchased content, benefits, goods, or services; (b) not contact Fans outside the Platform using information received through the Platform, except as necessary to fulfill an order; (c) not sell or share Fan data with any third party; (d) delete shipping addresses once an order is complete and any dispute window has closed; and (e) comply with all applicable data protection laws, including as an independent controller for any Fan personal information you process outside the Platform. Creators who use managers, moderators, or agents remain personally responsible for how Fan data is handled by those persons.

6.4 Identity and Phone Verification Data

Government-issued ID and selfie data submitted during verification is processed by our identity verification partner, which may act as an independent controller for this data under its own privacy policy. Followd receives only the verification outcome and limited metadata and does not retain raw copies of your ID documents on our own systems beyond what is required by applicable law. Phone verification results (including line type) are retained to prevent fraud.

6.5 Tax Data

Tax identification information (e.g., SSN, TIN, or EIN) is collected for IRS and other tax compliance purposes and is transmitted to our tax reporting partner in encrypted form. This data is retained for as long as required by applicable tax law (typically seven years in the U.S.).

SECTION 7 — FAN, MEMBER, AND BUYER DATA PRACTICES

7.1 What We Collect from Fans

In addition to the data described in Section 2, we collect from Fans: follow and membership history; Subscription and Membership Tier history; content unlock, Course, Event, Paid Message, and Paid Call purchase history; tip history; order history and shipping addresses; purchase library contents; and payment method metadata.

7.2 What Creators Can See

When you subscribe to, join, unlock, tip, message, book, enroll, RSVP, or buy from a Creator, that Creator sees your username and the transaction details, and for Physical Goods, your shipping name and address. We do not share your phone number, email address, full legal name, payment card details, or other sensitive identifiers with Creators by default. If you voluntarily include personal information in messages, order notes, or Course custom-note requests, that information is shared with the Creator as part of fulfilling the request.

7.3 Shipping Addresses

When you purchase Physical Goods, your shipping name and address are shared with the seller and any shipping carrier or label provider involved in delivery. You can save and manage addresses in your account. After delivery is confirmed, we retain shipping addresses for order records only as long as needed for returns, disputes, and legal obligations.

7.4 Recommendations and Personalization

We use your interest Categories, follows, memberships, views, engagement, purchases, and (if you import them) contacts to personalize your feed, Category feeds, discovery, recommended friends, creators you might like, and search results. You can influence recommendations by adjusting your Categories, following or unfollowing, joining or leaving Communities, dismissing suggestions, and blocking or muting. We do not use sensitive categories of personal information (such as inferred health, religious, or political views) to personalize your experience.

SECTION 8 — REWARDS PROGRAM, PARTNER GAMES, SURVEYS, AND BRAND CAMPAIGNS

8.1 Rewards Activity

To run the Rewards Program we keep a ledger of the Points you earn and redeem, the activity that earned them (tasks, quests, streaks, tutorials, spins, referrals, bounties, partner events, Brand Campaigns), timestamps, and device and risk signals used to confirm that rewards were legitimately earned. We use this data to credit and, where necessary, reverse rewards, to enforce eligibility and one-account rules, and to detect fraud.

8.2 Partner Games, Surveys, and Incentivized Videos

Games, surveys, and incentivized video offers are provided by third-party partners. When you open an offer, the partner receives a pseudonymous identifier for your Followd account and, where required, your advertising identifier, IP address, and device information so it can serve the offer and report completion back to us. Partner apps and surveys collect data directly from you under their own privacy policies; we receive completion confirmations and reward amounts, not your individual survey answers or in-game behavior, except where a partner's policy says otherwise. If you disable ad tracking or use a VPN, partners may be unable to attribute your activity and rewards may not be credited.

8.3 Referrals and Contact Import

When you send an invitation, we deliver it using the contact information you select and record whether it was accepted so we can credit rewards to you and the invitee. We do not use imported contacts for marketing to non-Users beyond the invitations you choose to send, and we do not sell contact data.

8.4 Brand Campaigns and Connected Social Accounts

When you connect a social account for Brand Campaigns, we store the account identifier and the profile and statistics the platform shares (e.g., follower counts and engagement) for as long as the account remains connected, and we share them with sponsoring brands for campaigns you apply to. You can disconnect a social account at any time in settings, which stops further collection; statistics already shared with a brand for an accepted campaign may be retained by the brand under its policy.

SECTION 9 — DATA RETENTION

When you delete your account (on web or in the app), we begin the deletion process within 30 days. Some data may be retained longer where required by law, ongoing legal proceedings, unresolved disputes, pending payouts or chargebacks, or active fraud investigations. Deleted account data is not recoverable after the retention period expires.

SECTION 10 — DATA SECURITY

10.1 Our Security Measures

We implement commercially reasonable administrative, technical, and physical safeguards to protect your personal information, including: encryption of data in transit (TLS 1.2+) and at rest; tokenization of payment card data by our PCI-DSS compliant payment processor (we do not store full card numbers); processing of government ID documents by our verification partner rather than on our own systems; role-based access controls limiting employee access to personal information; multi-factor authentication for administrative access to production systems; logging and monitoring; regular security assessments; and incident response procedures.

10.2 Your Responsibilities

No security system is impenetrable. You are responsible for: (a) keeping your phone number current and your device secure, since SMS passcodes are used to log in; (b) logging out on shared devices; (c) reviewing your connected accounts and active sessions; and (d) promptly notifying us at security@followd.com if you suspect unauthorized access to your account.

10.3 Data Breach Notification

In the event of a data breach that is reasonably likely to result in risk to your rights and freedoms, we will notify you and applicable regulators as required by applicable law, via email, SMS, and/or in-Platform notification, including what happened, what data was affected, steps we are taking, and what you can do to protect yourself.

SECTION 11 — CHILDREN'S PRIVACY

The Platform is intended solely for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. We ask Users to confirm their age during onboarding and use verification tools as part of payout onboarding to help enforce this requirement. If we learn that we have collected personal information from a person under 18, we will take steps to delete that information and terminate the associated account.

If you are a parent or guardian and believe we may have collected personal information from your child, please contact us at privacy@followd.com with the subject line "Child Account Report." We will investigate and respond promptly.

SECTION 12 — YOUR PRIVACY CHOICES AND RIGHTS

12.1 Account Information

You may access, review, and update most of your account information — profile, username, interests, connected accounts, saved addresses, payment methods, payout methods, and notification preferences — directly in your settings on web or in the app. To correct information you cannot update yourself, contact privacy@followd.com.

12.2 Notifications and Marketing

You may manage in-app, push, and email notification categories (e.g., likes, comments, follows, purchases, Community activity, Events, Rewards) in your notification settings, and may disable push notifications in your device or browser. You may opt out of marketing emails via the "Unsubscribe" link and of marketing SMS by replying STOP. Opting out of marketing does not affect transactional communications (passcodes, receipts, security alerts, payout notifications) necessary for the Platform to function.

12.3 Cookies, Tracking, and Advertising

You can manage cookie preferences through our Cookie Preferences center (accessible from the footer of followd.com) or your browser's privacy settings. On iOS, you can decline tracking via App Tracking Transparency; on Android, you can delete or reset your advertising ID and opt out of ads personalization. Blocking certain technologies may affect Platform functionality, including the ability to credit rewards for partner activities.

12.4 Contacts and Connected Accounts

You can revoke contacts permission in your device settings and disconnect social accounts in your Followd settings at any time. We will stop collecting from that source and delete imported contacts within 30 days of revocation.

12.5 Access and Data Portability

You may request a copy of the personal information we hold about you in a portable format by submitting a request in your account settings or by emailing privacy@followd.com. We will respond within 45 days (extendable as permitted by law).

12.6 Account Deletion

You may delete your account from your settings on web or in the app, or by contacting privacy@followd.com. Deletion is subject to our retention obligations described in Section 9. Unredeemed Points are forfeited on deletion, and some records (such as transaction and tax records) must be retained for legal and regulatory compliance.

12.7 Objection and Restriction

Where we process your personal information based on our legitimate interests, you may object to that processing or ask us to restrict it. We will honor your request unless we have compelling legitimate grounds that override your interests or where processing is necessary for legal claims. Contact privacy@followd.com.

SECTION 13 — CALIFORNIA RESIDENTS — CCPA/CPRA

This Section applies to California residents and provides disclosures and rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

13.1 Categories of Personal Information Collected

In the last 12 months, we have collected the following categories of personal information (as defined under CCPA):

13.2 Sale and Sharing of Personal Information

We do not sell personal information for monetary compensation. We may share certain information (such as device identifiers, advertising identifiers, and usage data) with advertising, attribution, and partner offer networks for purposes that may constitute "sharing" for cross-context behavioral advertising under CPRA. California residents have the right to opt out of this sharing. To opt out, use our Cookie Preferences center, click "Your Privacy Choices" in the footer of our website, enable Global Privacy Control, decline tracking in iOS, or email privacy@followd.com with the subject line "CPRA Opt-Out – Do Not Sell or Share." Opting out may prevent partner rewards from being credited.

13.3 Sensitive Personal Information

We collect the following categories of Sensitive Personal Information: account login credentials; precise government ID and biometric data (for verification, processed by our partner); financial account data (for payouts); SSN/TIN (for tax reporting); and the contents of your messages (which we do not read except for safety, moderation, support, or legal purposes). We use this information only as necessary to operate the Platform and comply with legal obligations, and do not use or disclose it for purposes other than those permitted by CPRA § 1798.121.

13.4 Your California Rights

California residents have the right to: know what personal information we collect, the sources, purposes, and third parties with whom it is shared; correct inaccurate personal information; delete personal information, subject to exceptions; opt out of the sale or sharing of personal information; limit the use of Sensitive Personal Information; not be discriminated against for exercising these rights; and appeal a denial.

13.5 How to Submit a California Request

Submit a verifiable consumer request by emailing privacy@followd.com with the subject line "California Privacy Request" or by using the Privacy Request option in your account settings. We will verify your identity (for example, by confirming your phone number or email) before processing requests, and will respond within 45 days (with a possible 45-day extension for complex requests, with notice). Authorized agents may submit requests on your behalf with appropriate documentation.

13.6 Retention and Financial Incentives

We retain personal information for the periods described in Section 9. The Rewards Program (including signup bonuses, referral rewards, and Welcome Boosts) may be considered a financial incentive under California law because it provides Points in exchange for activity that involves the collection of personal information. Participation is voluntary; you may opt in by completing Rewards activities and may opt out at any time by not participating or by deleting your account. We value the personal information involved at an amount reasonably related to the Points offered, based on the costs of operating the program.

SECTION 14 — OTHER U.S. STATE PRIVACY RIGHTS

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Tennessee, Minnesota, Maryland, and other U.S. states with comprehensive consumer privacy laws have rights substantially similar to those described in Section 13, including rights to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. To exercise any such right, submit a request to privacy@followd.com with your state of residence and the right you wish to exercise, or use the Privacy Request option in your settings. We will respond in accordance with applicable law (typically within 45 days). You may appeal a denial by emailing privacy@followd.com with the subject line "Privacy Request Appeal." Nevada residents may submit an opt-out request for any future sale of covered information by emailing privacy@followd.com with the subject line "Nevada Opt-Out."

SECTION 15 — EEA, UK, AND OTHER INTERNATIONAL USERS

This Section applies if you are located in the European Economic Area (EEA), the United Kingdom (UK), Switzerland, or another jurisdiction with similar data protection laws. Reach Labs Inc. is the data controller. The Platform, and in particular cash-out, Brand Campaigns, partner surveys and games, may not be available in all countries.

15.1 Legal Bases for Processing

15.2 Your Rights

If you are in the EEA, UK, or Switzerland, you have the right to: access your personal data; rectify inaccurate or incomplete data; erase your data where there is no compelling reason for continued processing; restrict processing in certain circumstances; receive your data in a structured, machine-readable format; object to processing based on legitimate interests (including profiling) or for direct marketing; request human review of automated decisions that significantly affect you (for example, automated fraud decisions affecting payouts); and withdraw consent at any time without affecting prior processing. To exercise these rights, contact privacy@followd.com. We will respond within one month (extendable by two months for complex requests, with notice). You may lodge a complaint with your local supervisory authority; a list of EEA authorities is available at edpb.europa.eu, and the UK authority is the Information Commissioner's Office (ico.org.uk).

15.3 EEA and UK Representative

[Reach Labs will appoint an EEA representative (GDPR Art. 27) and a UK representative prior to actively offering the Platform to Users in these jurisdictions. Their contact details will be inserted here upon appointment.]

SECTION 16 — INTERNATIONAL DATA TRANSFERS

Reach Labs is based in the United States. Your personal information is collected, processed, and stored on servers located in the United States and in other countries where our service providers operate. If you access the Platform from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your home country. For transfers of personal data from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission (and the UK Addendum), the EU-U.S. Data Privacy Framework to the extent certified, or your explicit consent where required. Copies of applicable transfer mechanisms are available upon request by contacting privacy@followd.com.

SECTION 17 — CONTACT US

17.1 How to Contact Us

For questions about this Privacy Policy or our data practices, to exercise your privacy rights, or to report a privacy concern:

For security incidents or suspected unauthorized access to your account: security@followd.com. For DMCA / copyright notices: legal@followd.com. For Trust & Safety issues: trust@followd.com. For payout and tax document inquiries: payments@followd.com.

17.2 Data Protection Officer

Reach Labs will designate a Data Protection Officer prior to actively offering the Platform to Users in the EEA or UK. Until then, all privacy inquiries should be directed to privacy@followd.com.

— End of Privacy Policy —

Reach Labs Inc. (d/b/a Followd) | followd.com/privacy | privacy@followd.com | © 2026 Reach Labs Inc. All rights reserved.