Privacy Policy

Tipmo ("GratifID," "Tipmo," "we," "us," or "our") values the privacy of individuals who have access to and use the Tipmo platform, including our websites located at tipmo.com and gratifid.com ("website," "site," "websites," or "sites"), apps, web-based tipping pages, NFC (Near Field Communication) tags, and other devices, Tipmo Pulse or other venue dashboards, payment facilitation workflows, software, content, support, pilots, and related services (collectively, our "Services"). We collect data to perform these Services, to understand how our consumers use the service, to identify new features and opportunities, debug platform issues, and to protect the platform from fraud and abuse.

Tipmo is an application that offers service workers the ability to collect electronic tips from customers. To that end, Tipmo gives service workers three different types of tags when downloading the application:

• Personal Tag – a tag that is exclusive to an individual, and can be used wherever the person receives tips anywhere, such as bars, airports, hotels, etc. It cannot be transferred to anyone;
• Property Personal Tag - a tag that an employee receives from the property that employs him/her. The tag is sponsored by the property but is associated to a specific employee to receive tips and ratings. While on the job, the employee cannot use his/her Personal Tag if he/she has one; and
• Property Desk Tag– a tag that is associated to a specific location within the property like a floor of a hotel, the bell desk or a specific bar. Employees can associate themselves to this tag and receive tips. Tips are divided between the participants in the Property Desk Tag in accordance with the employer's policies.

The term "Property" refers to the owner of the operation where the employee works or the owner of the location where the tag is enabled.

This Privacy Policy (the "Policy") explains how we collect, use, and share information from or about Tipmo users ("User(s)" or "you" or "your") or their devices. By using our Services, you acknowledge the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service and our Cookie Policy. Unless otherwise specified, the Terms of Service are incorporated herein by reference, including any terms not explicitly mentioned in this Policy.

For purposes of this Privacy Policy, the term "Personal Data" refers to "personal information" and "personal data" as defined under U.S. state privacy laws, and includes "sensitive" Personal Data when so specified. The meanings of these terms refer back to terms as defined in U.S. state privacy laws that are inclusive of but not limited to: the California Consumer Privacy Act, California Privacy Rights Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, and Virginia Consumer Data Protection Act. The meanings of these terms refer back to terms defined in such state privacy laws and may exclude publicly available, deidentified, and aggregated information; information subject to the Fair Credit Reporting Act, Gramm Leach Bliley Act, Health Insurance Portability and Accountability Act, and Driver's Privacy Protection Act; or information that is otherwise exempted or excluded by state privacy laws. Any additional defined terms found in this Privacy Policy will have the same meaning as found in our Terms of Service. The Service is hosted in the United States of America ("United States" or "U.S.") and is subject to U.S. state and federal law. If you are utilizing the Service from other jurisdictions, please be advised that you are transferring your personal information to us in the United States. By accessing the Service, you consent to that transfer and use of your personal information in accordance with this Privacy Policy.

When you contact us or interact with the Services, we collect information that alone or in combination with other information could be used to identify you as follows:

Information You Provide to Us

We may collect personal information, such as your name, phone number, industry role, company information, email address, mailing address, date of birth, profile photo, and password when you register for our Service, utilize certain aspects of the Service, sign up for our mailing list, or otherwise communicate with us. We may also collect any communications between you and Tipmo and any other information you provide to us, such as, but not limited to, customer reviews, comments, or survey responses. We may also collect general payment information for utilizing our service, such as bank account details, payment processor information, and tax identification information.

Information We Collect Automatically

We may automatically collect information about you when you access the Services, including:

• Device information such as device usage patterns, NFC device serial numbers, Device activation dates, device type, OS, and browser.
• Activity information such as when you accessed the Services, which pages you viewed, the time spent on our Services, referral source, and which sites you visited before and after accessing the Services.
• Transaction Data such as the type of device used, tip amounts and timestamps, transaction data, and payout history.

We collect and store some of the information described in this subsection by using cookies and other similar technologies like pixels, tags, and web beacons (collectively, "Cookies"). Refer to our Cookie Policy for more information, including management of your Cookie preferences.

Information We Collect from Third Parties

We may receive personal information about you from third parties and combine that with information we collect through our Service, for example, by allowing third parties to place their own cookies on the site that help us with measuring site traffic or analytics. The data we receive from these third-party sites is dependent upon that third party's policies and your privacy settings on that third-party site. You should always review and, if necessary, adjust your privacy settings on third-party websites and services before linking or connecting them to our website or Service. We may also collect payment processing data and compliance information (Stripe), and identity verification data for fraud prevention.

We may use the information and Personal Data we collect about you to serve the following legitimate business purposes:

• to provide the Services to you, including shipping NFC devices;
• to manage our relationship with you, including responding to your inquiries, providing you with notices, and requesting your feedback;
• to verify your identity for verification, payment processing and know your customer requirements
• to market the Services to you;
• to analyze your use of our Services;
• to develop, test, improve and enhance our Services, including internal development of our features;
• to conduct research and analytics;
• to sell non-sensitive data to interested third parties such as small business lenders or other providers;
• to enhance user experience and platform functionality;
• to train and improve our systems, including machine learning models using de-identified data;
• to detect and protect against security incidents or fraudulent or unlawful activity, including geolocation to confirm location of services completed;
• to comply with legal and regulatory requirements; or other purposes at your direction or with your consent.

Where feasible, we will use information in aggregated or de-identified form for these purposes. However, if you wish to opt-out of our selling your Personal Data, you can use the Your Privacy Choices control, also found in the footer of every page.

In certain circumstances, we may disclose your Personal Data to third parties, as set forth below:

Property Owners/Sponsors. Whenever the application is sponsored by an employer such as Property Personal Tags or Property Desk Tags, we will share any information you provide with the Property. However, even in those instances, your rights as specified in this Privacy Policy still apply when it comes to data we process and collect. For purposes of this Privacy Policy, as it relates to Property Personal Tags and Property Desk Tags, the Property is considered the "controller" of the data, and Tipmo is considered the "processor." However, because Tipmo acts as both controller and processor depending on your usage, this Privacy Policy seeks to enumerate your rights generally as if Tipmo is a controller for all purposes. That said, we still cannot control or guarantee what the Property does with your data as "controller" or at minimum "joint controller" of your Personal Data.

Vendors and Service Providers. To assist us in meeting business operations needs and to perform certain services and functions, we may disclose Personal Data to service providers, including hosting, cloud services, and other information technology services providers; IRS and tax authorities, email communication software providers, advertising and marketing service providers; customer relationship management, customer engagement, and customer feedback services; payment processors (Stripe); identity verification services; and analytics services. Pursuant to our instructions, these parties will access, process, or store Personal Data in the course of performing their duties to us.

Professional Advisers. We may disclose the necessary information with our professional advisers, such as auditors, accountants, or lawyers, to continuously update, monitor, support, and improve our legal, financial, reporting, and operational obligations.

Advertising and Analytics Partners. To assist us in marketing our products and services, we may disclose Personal Data to third-party advertising companies, including for the interest-based advertising purposes described above, that can collect information on our website through cookies and other automated technologies. See our Cookie Policy to learn more about managing your preferences regarding cookie data collection. These third parties also may use your information to provide you with offers, advertisements, and other communications about products or services that may be of interest to you. Thus, where required by applicable law, we will obtain your consent before sharing your information for such purposes or provide you with the opportunity to opt out of such sharing. Third parties receiving your information are contractually required to use it only for authorized purposes and to maintain appropriate safeguards.

Business Transfers. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of all or a portion of our assets, or transition of service to another provider, Personal Data and other information may be transferred to a successor or affiliate as part of that transaction, along with other assets.

Legal Requirements. If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of Users of the Site, or the public, or (v) protect against legal liability.

With Your Consent. We will share your information at your discretion, for example, when you direct us to do so.

Artificial Intelligence (AI) Processing & Automated Decision Disclosure. We do not make a decision, score, or rank based solely on automated processing that produces legal or similarly significant effects concerning you, and this platform is not intended for hiring, promotion, evaluation, or termination of employment. To the extent we engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, you have the right to opt out of that profiling by contacting us at info@gratifid.com.

We keep Personal Data for as long as needed to provide the Services you request, or as long as reasonably necessary for the purposes described in this Privacy Policy, while we have a legitimate business need to do so, or as required by law (e.g., for tax, legal, accounting, or other purposes), whichever is longer.

To determine the appropriate retention period for your Personal Data, we will consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we use your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements. In some circumstances, we may anonymize your Personal Data so that it can no longer be identifiable to you, in which case it is no longer Personal Data.

We retain each category of Personal Data for the period necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. The criteria we use to determine the retention period for each category are as follows: Identifiers (e.g., name, email address, account information) are retained for as long as your account remains active, plus ninety (90) days following account deletion, to allow for account recovery, fraud prevention, and legal recordkeeping. Commercial Information and Transaction Data (e.g., tip amounts, payout history, payment processing records) are retained for as long as necessary to complete the applicable transaction and to comply with tax, accounting, and payment-processor recordkeeping requirements, which may exceed the retention period applicable to other categories, and for the business purposes of the Property. Internet or Network Activity (e.g., pages viewed, referral source) is retained for the period reasonably necessary to support the analytics and platform-improvement purposes described in this Policy. Geolocation Data is retained only as long as necessary to support the fraud-prevention and service-verification purposes described in this Policy. Inferences are retained for as long as the underlying Personal Data from which the inference was drawn is retained, after which the inference is deleted or de-identified. In most cases, Personal Data associated with your account is deleted within ninety (90) days of account deletion, unless a longer period is legally necessary.

Various U.S. states (e.g., as of the date of this Privacy Policy, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) allow consumers to opt out of sharing of their data, and regulate businesses' use of consumers' Personal Data, including sensitive Personal Data. If you are located in the European Union, United Kingdom, or other countries outside the United States additional rights may apply. Otherwise, subject to the applicable law and depending on your location within the United States, you have the following general rights in relation to your Personal Data:

• Right of access: If you ask us, we will confirm whether we are processing your Personal Data and, if so, provide you with a copy of that Personal Data along with certain other details, such as the categories of sources of such information, the business or commercial purpose for collecting your information, and the categories of third parties with whom we shared your information. If you require additional copies, we may charge a reasonable fee. These rights, and the applicable types of data and time periods, will vary depending on the laws applicable to the state or country in which you reside.
• Right to rectification: If your Personal Data is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we have disclosed your Personal Data to others, we will tell them about the correction where possible. If you ask us, and where possible and lawful to do so, we will also tell you to whom we disclosed your Personal Data so you can contact them directly.
• Right to erasure: You may ask us to delete or remove your Personal Data, such as when you withdraw your consent. If we have disclosed your data to others, we will tell them about the erasure where possible. If you ask us, and where possible and lawful to do so, we will also tell you to whom we disclosed your Personal Data with so you can contact them directly.
• Right to restrict processing: You may ask us to restrict or 'block' the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or object to us processing it (please read below for information on your right to object). We will tell you before we lift any restriction on processing. If we have disclosed your Personal Data to others, we will tell them about the restriction where possible. If you ask us, and where possible and lawful to do so, we will also tell you to whom we disclosed your Personal Data so you can contact them directly. This includes the Right to Limit Use and Disclosure of Sensitive Personal Information under California's privacy laws.If you wish to limit our use and disclosure of your sensitive Personal Data to what is necessary to provide the Services, you can use the Your Privacy Choices control, also found in the footer of every page.
• Right to data portability: You have the right to obtain your Personal Data from us that you consented to give us or that was provided to us as necessary in connection with our contract with you, and that is processed by automated means. We will give you your Personal Data in a structured, commonly used, and machine-readable format. You may reuse it elsewhere.
• Right to object: You may ask us at any time to stop processing your Personal Data, and we will do so:
  • If we are relying on a legitimate interest to process your Personal Data—unless we demonstrate compelling legitimate grounds for the processing or we need to process your data in order to establish, exercise, or defend legal claims;
  • If we are processing your Personal Data for direct marketing.
• Right to withdraw consent: If we rely on your consent to process your Personal Data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect any processing of your data before we received notice that you wished to withdraw consent.
• Right to opt out of selling and sharing Personal Data: We use cookies and other similar technologies on our Site to help us advertise our Services on other websites or services you visit. We share non-sensitive information we collect on our Site, such as information about the pages you visit and the actions you take on our Site, with lenders, advertising networks and analytics partners to support our interest-based advertising, which may qualify as a sale or sharing of Personal Data, or targeted advertising, under applicable law. Where required by law, we obtain opt-in consent; otherwise, we provide opt-out mechanisms.If you wish to opt-out of our selling your Personal Data, you can use the Your Privacy Choices control, also found in the footer of every page. We also honor Global Privacy Control (GPC) signals and any other universal opt-out mechanisms from anyone accessing our Services. As to Do Not Track (DNT) signals, see our Cookie Policy.
• Right to lodge a complaint with the data protection authority: Depending on where you reside, such as California, you can report concerns about our privacy practices, including the way we handled your Personal Data, to the California Privacy Protection Agency or similar data protection authority that is authorized to hear those concerns where you reside.
• Right to appeal: If we decline to take action on your request to exercise any of the rights described above, you may appeal our decision by contacting us at info@gratifid.com with the subject line "Rights Request Appeal" and a description of the basis for your appeal. We will respond to your appeal within forty-five (45) days of receipt; where reasonably necessary, we may extend this period by an additional forty-five (45) days, in which case we will notify you of the extension and the reason for the delay. If we deny your appeal, you may contact the attorney general or other data protection authority in your state of residence to submit a complaint.

In general, we, including our vendors and service providers, collect the following California-regulated categories of Personal Data (PI in below chart) from you.

Sharing Your Information for a Business Purpose. In the preceding twelve (12) months, we have disclosed the following categories of Personal Information for a business purpose with our affiliates and service providers:

• Category A: Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address
• Category D: Commercial Information
• Category F: Internet or other similar network activity
• Category G: Geolocation Data
• Category K: Inferences drawn from other PI

Note: As to Category I, the Property collects employee reviews, which are captured through our Services. However, we do not share this information with any other third parties, other than the Property as the controller who employs our Services as processor of such Personal Data.

Categories Sold. In addition to the above noted disclosures for a business purpose, we may sell the following categories of non-sensitive Personal Data:

• Category A: Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, and email address
• Category D: Commercial Information
• Category K: Inferences drawn from other PI

Shine Your Light Law. Under California law, California residents are entitled, once per calendar year, to ask us for a notice identifying the categories of personal customer information that we share with certain third parties for the third parties' direct marketing purposes, and providing contact information (i.e., names and addresses) for these third parties. If you are a California resident and would like a copy of this notice, please submit a written request to us via email at info@gratifid.com. You must put the statement "Your California Privacy Rights" in your request and include your name, street address, city, state, and ZIP code. We are not responsible for notices that are not labeled or sent properly, or do not have complete information.

You may request access to, correction of, or deletion of your Personal Data by contacting either the business you communicated with (for data collected on their behalf) or Tipmo directly (for data collected by us). We will respond to deletion requests within 45 days of receipt.

We will not discriminate against you for exercising any of your rights. However, note that we may not be able to technically continue providing all or some of our Services, depending upon the nature and specifics of your request.

If you wish to exercise any of these rights, you may contact us at: info@gratifid.com. We will respond within 45 days of receipt.

Verifying Your Request: To protect your Personal Data from unauthorized access or disclosure, we will take reasonable steps to verify your identity before fulfilling a request to exercise your rights under this Policy. Depending on the nature of your request and the sensitivity of the Personal Data involved, we may ask you to provide information sufficient to match against records we already maintain about you, such as your name, email address, or account details, and we may require additional or alternative verification for requests involving more sensitive Personal Data or requests to delete your Personal Data. If we are unable to verify your identity to a sufficient degree of certainty, we may decline to act on the request and will explain the basis for that decision.

Authorized Agent: You may designate an authorized agent to submit a request to exercise your rights under this Policy on your behalf. To protect your Personal Data, we will require the authorized agent to provide proof that you have given them written permission to act on your behalf, and we may also require you to verify your own identity directly with us or to directly confirm with us that you provided the authorized agent permission to submit the request. We may deny a request submitted by an authorized agent who cannot provide proof that they have been authorized by you to act on your behalf.

Geolocation Choices and Consent. Before collecting precise geolocation information, we provide notice and request your affirmative consent. You may decline geolocation collection or withdraw your consent at any time. We also provide all users with the ability to opt out of or limit our processing of geolocation and other sensitive Personal Data during account creation and within your account privacy settings in the Tipmo app. You may also decline or withdraw geolocation consent at any time in the Tipmo app, or by emailing us at info@gratifid.com. After you withdraw consent or exercise an applicable opt-out right, we will stop collecting new geolocation information, although certain location-dependent features may no longer be available and withdrawal will not affect processing that occurred before your request.

If you would like to make a complaint about how we have handled your Personal Data, or to make a complaint about a breach of data protection laws, please email us. We will investigate complaints and will communicate the outcome of the investigation to you after the complaint is made in accordance with applicable law.

The Services are not intended for children, and we do not knowingly collect personal information from individuals under the age of 18. Any collection of data will not be processed in any manner that is likely to cause any detrimental effect to children or would aid in targeted advertising at children. If we learn that personal information has been collected from anyone under 18 years of age, or the equivalent in your jurisdiction, then we will take the appropriate steps to cause this information to be deleted. If you believe we might have any personal information from or about a child under 18, please contact us immediately at info@gratifid.com.

You use the Services at your own risk. We deploy measures to protect Personal Data both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. For example, we use available technology and other techniques to implement systems like firewalls, and/or encryption to secure data transfers. However, no Internet or e-mail transmission is ever fully secure or error-free. In particular, e-mail sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us via the Services or e-mail. Please keep this in mind when disclosing any Personal Data to us via the internet. Any sensitive data collected is encrypted in our database. Payment card data is handled by Stripe and is never stored on our servers. In addition, we are not responsible for circumvention of any privacy settings or security measures contained in the Services or third-party websites.

The Sites, Services, and our business may change from time to time. As a result, we may change this Policy at any time. When we do, we will post an updated version on this page, unless another type of notice is required by applicable law.

Where there is a conflict between this Privacy Policy and an explicit provision of the Terms of Service, this Privacy Policy will prevail over those other Terms as to our processing of personal information.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: info@gratifid.com
• Company: GratifID, Inc.
• Website: gratifid.com