TwoBit Platform — Privacy Policy

1. Introduction and Scope

BrandBridg Inc. ("Company," "BrandBridg," "we," "our," or "us"), the parent company and operator of the TwoBit influencer marketing platform (the "Platform"), is committed to protecting the privacy and security of your personal information. This Privacy Policy ("Policy") describes how we collect, use, disclose, store, and protect information about you when you use our Platform, and explains your rights with respect to your personal information.

This Policy applies to all Users of the TwoBit Platform, including Brands, Creators, and visitors. By accessing or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you must discontinue use of the Platform.

This Policy is incorporated by reference into our Terms of Service. Capitalized terms not defined herein shall have the meanings ascribed to them in the Terms of Service.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you provide directly when you:

• Register for an account (name, email address, username, password, phone number, business name, tax identification information)
• Complete your profile (profile photo, biography, social media handles, website URLs, content categories, audience demographics)
• Create or participate in Campaigns (campaign briefs, deliverable specifications, content submissions)
• Execute Partnership Agreements (contract terms, signatures, negotiation history)
• Make or receive payments (payment method information, bank account details, billing address, transaction records)
• Use in-Platform messaging (message content, attachments)
• Submit content to the Platform (images, videos, text, links)
• Contact our support team (support correspondence)
• Complete surveys or provide feedback

2.2 Information Collected Automatically

When you use the Platform, we automatically collect certain technical and usage information, including:

• Log data: IP address, browser type and version, operating system, referring URLs, pages viewed, time and date of visits
• Device information: device identifiers, hardware model, operating system version, unique device IDs
• Usage data: features accessed, Campaigns created, Matches viewed, Partnership Agreements executed, messages sent, content calendar interactions, payment transactions
• Performance data: campaign performance metrics, engagement analytics, audience reach data
• Location data: approximate geographic location derived from IP address
• Cookie and tracking data: as described in Section 5 below
• Subscription usage metering data: real-time counts of Seats consumed versus permitted, Active Campaigns consumed versus permitted, and Partnered Creators consumed versus permitted under the Brand's current Subscription Plan and any Add-Ons, used to enforce Usage Capacity limits and display usage indicators within the Platform

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Social media platforms: if you connect your social media accounts to the Platform, we may receive profile information, follower counts, engagement metrics, and audience demographics in accordance with your permissions on those platforms
• Payment processors: transaction confirmations, payment method verification, and fraud prevention signals
• Analytics providers: aggregated usage and behavioral analytics
• Identity verification services: verification results to confirm your identity or business legitimacy
• Marketing partners: business contact information for outreach purposes
• Publicly available sources: business registrations, public social media profiles

2.4 Sensitive Information

We do not intentionally collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, health information, or sexual orientation. Please do not submit such information through the Platform.

3. How We Use Your Information

3.1 Platform Operations

We use your information to:

• Create and manage your account and authenticate your identity
• Operate the Platform's proprietary matching algorithm to suggest relevant Brand-Creator pairings
• Facilitate the creation, negotiation, and execution of Campaign briefs and Partnership Agreements
• Power the Partnerships dashboard, content calendar, and collaboration tools
• Process and facilitate Creator Payment transactions between Brands and Creators
• Enable in-Platform messaging between Brands and Creators
• Provide customer support and respond to inquiries
• Enforce Subscription Plan Usage Capacity limits across Seats, Active Campaigns, and Partnered Creators in real time
• Display real-time usage meters showing consumption relative to Subscription Plan limits, and present contextually appropriate Add-On or plan upgrade prompts when a Brand approaches or reaches a Usage Capacity limit
• Generate campaign performance analytics and reporting

3.2 Business Purposes

We also use your information to:

• Improve, personalize, and optimize the Platform and its features
• Conduct research and analytics to understand Platform usage patterns
• Develop new features, products, and services
• Detect, investigate, and prevent fraudulent transactions, abuse, and security threats
• Enforce our Terms of Service and Acceptable Use Policy
• Comply with applicable legal obligations and respond to lawful requests
• Send service-related communications, including transactional emails and administrative notices
• Send marketing communications where permitted by applicable law and your preferences
• Generate anonymized, aggregated industry reports and benchmarks

3.3 Legal Bases for Processing (GDPR)

For Users located in the European Economic Area (EEA) or United Kingdom (UK), we process your personal data under the following legal bases: (i) Performance of a contract: processing necessary to provide Platform services; (ii) Legitimate interests: fraud prevention, security, product improvement, and analytics; (iii) Consent: for certain marketing communications and cookie usage; and (iv) Legal obligation: compliance with applicable laws.

4. Sharing Your Information

4.1 Between Platform Users

To facilitate collaborations, certain profile information of Creators (such as handle, content categories, audience demographics, and performance metrics) is made visible to Brands on the Platform. Similarly, basic Brand information is shared with Creators to enable informed partnership decisions. Information shared within the context of executed Partnership Agreements is visible to both contracting parties.

4.2 Service Providers

We share your information with trusted third-party service providers that assist us in operating the Platform, subject to data processing agreements that prohibit them from using your information for any purpose other than providing services to us. These include:

• Cloud infrastructure and hosting providers
• Payment processors and financial institutions
• Analytics and business intelligence platforms
• Email and communication service providers
• Identity verification and fraud prevention services
• Customer relationship management platforms
• Legal, accounting, and professional advisory services

4.3 Legal and Regulatory Disclosures

We may disclose your information when required to do so by law, regulation, court order, or other valid legal process. We may also disclose information where we believe in good faith that disclosure is necessary to: (i) comply with applicable law; (ii) protect the rights, property, or safety of BrandBridg, our Users, or the public; (iii) detect and prevent fraud or security incidents; or (iv) enforce our Terms of Service.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity, subject to applicable law. We will notify you via email and/or a prominent notice on the Platform prior to your information being transferred and becoming subject to a different privacy policy.

4.5 With Your Consent

We may share your information for other purposes with your explicit prior consent.

4.6 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you with third parties for research, analytics, or industry reporting purposes.

5. Cookies and Tracking Technologies

5.1 Types of Cookies We Use

We use the following categories of cookies and similar tracking technologies:

• Strictly Necessary Cookies: Essential for Platform operation, authentication, and security. Cannot be disabled.
• Functional Cookies: Enable personalization and enhanced features such as remembering preferences and settings.
• Performance and Analytics Cookies: Help us understand how Users interact with the Platform, enabling us to improve functionality and user experience.
• Marketing Cookies: Used to deliver relevant advertisements and measure the effectiveness of marketing campaigns.

5.2 Cookie Management

You can manage your cookie preferences through your browser settings or through our cookie consent management tool on the Platform. Please note that disabling certain cookies may affect the functionality of the Platform. For more information about cookies and how to manage them, visit www.allaboutcookies.org.

5.3 Do Not Track

Some browsers include a Do Not Track (DNT) feature. We do not currently respond to DNT signals, as there is no industry-standard approach to honoring DNT requests. We will reassess this approach as standards develop.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Specifically:

• Account data: retained for the duration of your account and for a period of up to seven (7) years following account deletion to comply with legal obligations
• Transaction and payment records: retained for a minimum of seven (7) years for tax and accounting compliance
• Partnership Agreement records: retained for seven (7) years following the completion or termination of the applicable agreement
• Communications: retained for the duration of your account and for two (2) years following deletion
• Marketing data: retained until you opt out or withdraw consent

When we no longer have a legitimate need to process your personal information, we will securely delete or anonymize it.

7. Data Security

BrandBridg implements commercially reasonable technical, administrative, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit (TLS) and at rest, access controls and authentication mechanisms, regular security assessments and penetration testing, employee training on data protection, and incident response protocols.

However, no method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and applicable regulatory authorities as required by applicable law.

8. International Data Transfers

BrandBridg is headquartered in the United States. If you are located outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. For transfers of personal data from the EEA, UK, or Switzerland, we rely on appropriate transfer mechanisms including Standard Contractual Clauses approved by the European Commission.

9. Your Rights and Choices

9.1 Access and Portability

You have the right to request access to the personal information we hold about you and, where applicable, to receive a copy of that information in a structured, machine-readable format.

9.2 Correction

You have the right to request correction of inaccurate or incomplete personal information. You may update your profile information directly in your account settings.

9.3 Deletion

You may request deletion of your personal information, subject to our need to retain certain information for legal compliance, fraud prevention, or other legitimate business purposes.

9.4 Restriction and Objection

Where applicable, you have the right to request restriction of processing or to object to processing of your personal information based on our legitimate interests.

9.5 Withdrawal of Consent

Where processing is based on your consent, you may withdraw consent at any time by adjusting your Platform settings or contacting us. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

9.6 Marketing Opt-Out

You may opt out of receiving marketing communications from us at any time by clicking the "unsubscribe" link in any marketing email or by adjusting your notification preferences in your account settings. You will continue to receive transactional and service communications.

9.7 California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt-out of the sale or sharing of personal information. BrandBridg does not sell your personal information. To exercise your California privacy rights, contact us at support@twobitco.com.

9.8 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us at support@twobitco.com. We will respond to verifiable requests within thirty (30) days, or within the timeframe required by applicable law. We may need to verify your identity before processing your request.

10. Children's Privacy

The Platform is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18 without parental consent, we will take steps to delete such information promptly. If you believe we have inadvertently collected information from a minor, please contact us at support@twobitco.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other legitimate business reasons. We will notify you of material changes by posting the updated Policy on the Platform with a revised effective date and, where required by law, by providing additional notice such as email notification. We encourage you to review this Policy periodically.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• BrandBridg Inc. — Privacy & Data Team
• Email: support@twobitco.com
• Website: www.twobitco.com

For EU/UK data subjects, you also have the right to lodge a complaint with your local data protection authority.