California Consumer Privacy Statement

Effective Date; Last Updated: September 22, 2026

This California Consumer Privacy Statement describes how Right Side Up and its subsidiaries (collectively, “Right Side Up,” “we,” “our,” and “us”) process personal information about residents of California. This Statement applies to you if you are a resident of California under the California Consumer Privacy Act, as amended, along with its implementing regulations (collectively the “CCPA”). Unless preempted by a superseding law, this section will apply in addition to provisions within Right Side Up’s Privacy Policy that may be applicable to California residents.

For purposes of this section, “personal information” has the meaning given in the CCPA but does not include information exempted from the scope of the CCPA. In some cases, we may provide a different privacy notice to certain categories of California residents, such as employees, contractors, and job applicants, in which case that notice will apply instead of this section.

This Statement applies to personal information we collect:

When you visit or use websites or portals operated by us or software applications;
Contact our customer service team;
Communicate with us; or
Otherwise interact with us.

If you have any questions, please contact us using the information provided under the Contact Us section below.

BY USING THE SITE OR OTHERWISE PROVIDINGUS WITH PERSONAL INFORMATION, YOU ARE CONSENTING TO THIS STATEMENT. PLEASE READ IT CAREFULLY.

1. Personal Information We Collect

In the twelve months preceding the effective date of this Statement, we have collected the following personal information from the sources set forth below:

Information California Residents Provide to Us: Personal information California residents (such as you) may provide to us through the services or otherwise, includes:
- Contact Information, including your first and last name, email address, a home, postal, or other physical address, and phone number.
- Account Data, including identifiers, such as, for example, your name, email address, phone number, postal address, driver’s license number, username, preferences; classification information, such as, for example, age, race, ethnicity, gender, and military/veteran status; and any other information that you add to or is associated with your account.
- Communications we exchange when you contact us with questions, feedback, for support or otherwise, which may include recordings of customer support calls where permitted by law.
- Inferential Information derived from personal information used to generate information about likely preferences or other characteristics about you.
- Other Information we may collect which is not specifically listed here but compatible with collection and use as described in this Statement or as otherwise disclosed at time of collection.
Automatic Data Collection: We, our service providers, and our business partners may automatically log information that may identify you, your computer, or mobile device, such as:
- Account Data, including identifiers, such as, for example, your name, email address, phone number, postal address, driver’s license.
- Device Data, such as your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type, IP address, unique identifiers, language settings, mobile device carrier, radio/network information, and general location information derived from your IP address, such as city, state or region.
- Location Information, such as your rough geo-location based upon your device’s IP address.
- Online Activity Data, such as pages or screens you viewed, how long you spent on a page or screen, the online services you visited before browsing to the service, navigation paths between pages or screens, information about your activity on a page or screen, access dates and times, and duration of access.

2. How We Use Personal Information

In the twelve months preceding the effective date of this Statement, we have used personal information for the following purposes:

Operate Our Sites: We use personal information to improve, customize and enhance the Sites by expanding their features and functionality and tailoring them to our users’ needs and preferences.
Service Delivery: We use personal information to:
- provide, operate, and improve the service and our business;
- verify your identity;
- establish and maintain your user profile on the service;
- enable security features of the service, such as by sending you security codes via email or SMS, and remembering devices from which you have previously logged in;
- enable personalization of your service account, such as creating quick access to recent pickup locations, accessibility needs, destinations or retail locations for orders, or allowing users to track favorite places;
- facilitate payment in connection with using the service;
- communicate with you about the service, including by sending status updates, announcements, updates, security alerts, and support and administrative messages;
- understand your needs and interests, and personalize your experience with the service and our communications;
- provide support for the service, and monitor and improve our customer support responses and processes; and
- respond to your requests, questions, and feedback.
Research and Development: We may use your personal information for research and development purposes, including to analyze and improve the services and our business. This helps us to improve and enhance the safety, security, and accessibility of the services and develop new features and products. As part of these activities, we may create aggregated, de-identified, or other anonymous data from personal information we collect. We make personal information into anonymous data by removing information that makes data personally identifiable to you. We may use this anonymous data and disclose it to third parties for lawful business purposes, including, for example, analyzing and improving the services and promoting our business.
Compliance and Protection: We may use your personal information to:
- comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government agencies;
- protect our, your, or others’ rights, privacy, safety or property (including by making and defending legal claims);
- audit our internal processes for compliance with legal and contractual requirements and internal policies;
- enforce the terms and conditions that govern the services; and
- prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks, identity theft, and accidents.
Legal: We use personal information to comply with our legal obligations, including reporting requirements, and defend ourselves in legal proceedings, and protect our company and our property, employees, and others through legal proceedings.
Other Purposes: We use personal information for other reasons we may describe to you.

3. How We Disclose Personal Information

In the twelve months preceding the effective date of this Statement, we disclosed personal information with the following parties or as otherwise described in this Statement or at time of collection:

Service Providers: Companies and individuals that provide services on our behalf or help us operate the services or our business (such as information technology, information security, payment processing, hosting and cloud storage, customer relationship management and support, print and mail fulfillment, email delivery, advertising, marketing, data analytics, consumer research, and identity verification).
Affiliates: We may disclose personal information with businesses controlling, controlled by, or under common control with Right Side Up.
Professional Advisors: Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of professional services rendered.
Authorities and Others: Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.
Business Transactions: Information that we collect from our users, including personal information, is considered to be a business asset. Thus, if we are acquired by a third party as a result of a transaction such as a merger, acquisition or asset sale or if our assets are acquired by a third party in the event we go out of business or enter bankruptcy, some or all of our assets, including your personal information, may be disclosed or transferred to a third party acquirer in connection with the transaction.
Business Partners: Our research partners and other business partners.
Other Reasons: We may disclose personal information for other reasons we may describe to you if you consent to the disclosure or direct us to disclose your information.

4. Sale and Sharing of Personal Information

Our website may display general, non-personalized advertisements, but we do not serve personalized or targeted advertisements and do not share your personal information with advertising partners. However, our use of analytics and mobile measurement partners (such as Google Analytics) for analytics and attribution purposes may involve sharing certain information (such as device identifiers and app usage data) that could constitute a “sale” or “sharing” of personal information under the CCPA/CPRA and similar state laws.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

California law requires that we tell you if we sell personal information with a third party for monetary or other valuable consideration. We do not do this. We also do not sell personal information of minors under the age of 16 for monetary or other valuable consideration.

The chart below outlines disclosures we have made for business purposes to contractors/service providers as well as disclosures for cross-context behavioral advertising purposes:

Category of Personal Information	Disclosure, for a Business Purpose to Contractors/Service Providers	Cross-Context Behavioral Advertising
Contact Information	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies
Account Data	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies
Communications	Service Providers and Business Partners	No
Inferential Information	Service Providers and Business Partners	No
Other Information	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies
Device Data	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies
Location Information	Service Providers and Business Partners	No
Online Activity Data	Service Providers and Business Partners	Yes, via Cookies and Tracking Technologies

5. Cookies and Similar Technologies

5.1. Our Use of Cookies and Tracking Technologies
Like most websites, when you use our sites, we automatically collect certain information about you, your device, or your use of our sites via automated means such as cookies, pixels, beacons, invisible tags, and similar technologies (collectively “Cookies”). These typically involve pieces of information or code that a website transfers to or accesses from your computer or mobile device to store, share, and sometimes track information about you or your device.

These Cookies allow us to understand how users navigate to and around our site, view different pages, access content and more. Cookies enable you to be remembered when using a specific computer or device to interact with websites and online services and can be used to manage a range of features and content as well as storing searches and presenting personalized content. We may use them, for example, to keep track of your preferences and profile information and collect general usage and volume statistical information. Certain Cookies also enhance our ability to serve you targeted advertising on websites and platforms other than on the sites.

5.2. Our Use of Targeted Advertising
We partner with platforms such as Google, and similar digital analytics and advertising partners. Our analytics and advertising partners may collect information about your activities on our sites and combine it with information about your activities on other websites, mobile apps, and devices. This may result in you seeing our banners and ads when you are on other websites, apps and social media platforms or seeing other ads that may interest you on our website or other sites.

We use analytics services provided by Google Analytics. If you would like more information on how Google uses data when you visit or use our site, please visit www.google.com/policies/privacy/partners. If you would like to opt-out, Google provides an opt-out tool which is available at https://tools.google.com/dlpage/gaoptout.

5.3. Your Choices
Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies. If you disable cookies, some parts of the website may not function as intended. You can find instructions on how to manage Cookies on different types of web browsers at www.allaboutcookies.org. To learn more about interest-based advertising, tracking technologies, and how to opt out, you can visit http://www.aboutads.info/choices.

Options you make are browser and device specific.

5.4. Do Not Track Signals
Some browsers have a “do not track” feature. It lets you tell websites you visit that you do not want them to track your online activity. These features are not yet uniform across browsers. Our sites are thus not currently set up to respond to these signals. For more information on Do Not Track signals, please visit https://allaboutdnt.com/.

6. California Resident Rights

6.1. Your Rights
As a California resident, you have the rights listed below and may exercise the rights by submitting a verifiable consumer request. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law.

Right to Know/Access: You can request the following information about how we have collected and used your personal information during the past twelve months:
- Categories of personal information that we have collected.
- Categories of sources from which we collected personal information.
- Categories of personal information we have disclosed about you for a business purpose and categories of recipients to which it was disclosed.
- Categories of personal information that we sold or, for cross-context behavior advertising, shared and categories of third parties to whom personal information was sold or, for cross-context behavior advertising, shared.
- Categories of third parties to whom personal information was disclosed for a business purpose.
- Business or commercial purposes for collecting, selling, or, for cross-context behavior advertising, sharing personal information.
- Specific pieces of personal information collected.
Right to Data Portability: You can request a copy of your personal information that we maintain.
Right to Correct: You can ask us to correct inaccurate personal information we have collected about you.
Right to Delete: You can ask us to delete personal information we have collected from you. Please be aware that certain information we have collected from you may still be retained for legal, accounting, security, information technology backup, and anti-fraud reasons, as well as for solely internal uses reasonably aligned with your expectation based on your relationship with us and compatible with the context in which you provided the information.
Right to Nondiscrimination: You are entitled to exercise the rights described above free from discrimination as prohibited by the CCPA.
Right to Opt-Out of Marketing Communications: You may opt out of marketing-related emails by following opt-out or unsubscribe instructions included in the emails, or by contacting us using the contact information provided below. You may continue to receive service-related and other non-marketing emails. If you receive text messages from us, you may opt out of receiving further text messages by replying STOP to the text messages.
Right to Opt-Out of Sale and, for Cross-Context Behavior Advertising, Sharing: You may opt out of sales or, for cross-context behavior advertising, sharing via cookies or tracking technologies. You can learn more about how to opt out at the Do Not Sell or Share My Personal Information page.
Right to Appeal: If we deny your request, or if we were unable to fulfill your request, you may appeal our decision by contacting us as described in the Contact Us sections, and provide a detailed reason for your appeal, as well as your state of residence.

6.2. How to Exercise Your Rights
To exercise your rights, please contact us as specified in the Contact Us section and:

Provide sufficient identifying information (including full name and email address) to allow us to reasonably verify you are the person about whom we collected and retained personal information, and/or your authority to make such request on behalf of the data subject; and
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Note that we will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request or to review and comply with the request, or as otherwise permitted by applicable law.

6.3. Authorizing Agents to Act on Your Behalf‍
You may authorize someone to act as your agent and submit a request on your behalf. Due to the sensitivity of such requests, you must verify the agent’s authorization before we will act. Accordingly:

You or your agent must supply other written permission for a specific agent to act on your behalf; and
We will use your email address or other available contact information to connect directly with you to verify agent identity and authority.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm with a level of confidence appropriate to the sensitivity of the information that the personal information we have collected and retained in our systems and databases relates to you.

7. California Shine the Light

The California Shine the Light law (Cal. Civ. Code § 1798.83) permits residents of California to request certain details about how their information is shared with third parties for the third-parties’ direct marketing purposes. If you are a California resident and would like to make such a request, please contact us using the information provided under the Contact Us section below, and include “CA Shine the Light” in the subject line of your email.

8. Sensitive Personal Information

We do not use or disclose sensitive information, as that term is defined by the CCPA.

9. Our Sites Are Not Intended for Children

Our sites are meant for adults. We do not knowingly collect personally identifiable information from children under thirteen. If you are a parent or legal guardian and think your child under thirteen has given us information, you can contact us at the email or address below. Please mark your inquiries “COPPA Information Request.” Parents can learn more about how to protect children’s privacy online here.

10. How Long We Keep Personal Information

We will retain and use your information for as long as we need it to provide you services, or as long as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Where we process personal information for marketing purposes, we process the data until you ask us to stop and for a short period thereafter (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing so that we can respect your request in future. We use the following criteria to determine retention periods:

How long the information is needed to provide our services and operate our business;
Whether there are contractual or legal obligations that exist that require us to retain the information for a period of time;
Whether any law, statute, or regulation allows for a specific retention period;
Whether an individual has agreed to a longer retention period;
Whether the data is considered to be sensitive data; and
What the expectation for retention was at the time the data was provided to us.

11. We Use Reasonable Security Measures

We use reasonable security measures as required by relevant law. The Internet is not 100% secure. We cannot promise that your use of our sites will be completely safe. We encourage you to use caution when using the Internet.

12. Our Platforms Are Based in the United States

Information we collect may be stored and processed in the United States. This site is intended for people who are in the United States. If you live outside of the United States, you understand and agree that we may transfer your information to the United States. The United States may not afford the same level of protection as the laws in your country. By submitting your information you agree to the processing of it in the US as permitted by law. Information we transfer to the United States from another country will be subject to appropriate safeguards under applicable law.

13. Third Party Sites and Links

We may link to third-party sites. Our sites may also include third party content that collects information. We do not control these third parties. This Statement does not apply to the privacy practices of that website. Please read the privacy policy of other websites carefully. We are not responsible for the practices of these third-party sites.

14. How to Contact Us

If you have other questions about this Statement or our privacy practices please email us at security@rightsideup.co. You can also call us at 720-549-7324.

15. Changes to This Statement

We may make changes or updates to this Statement. We will notify you of any material changes to this Statement as required by law. Changes will also be posted on our website. Please check our site periodically for updates.