Platform Privacy Policy

Introduction

SipSocial, Inc., a Delaware corporation (**SipSocial**, **we**, **us**, or **our**), respects your privacy. This Platform Privacy Policy (**Privacy Policy**) describes how we collect, use, disclose, and protect personal information when you visit or use brand storefront websites, create an account, browse products, complete checkout, receive communications, or otherwise interact with services we provide as a technology and marketplace platform (collectively, the **Platform**).

This Privacy Policy applies to personal information we process in our role as **controller** (or business, under California law) for Platform operations. When you purchase alcoholic beverages, an independent **Licensed Retailer** may also process your information as a separate controller for fulfillment, payment (where applicable), tax, and regulatory compliance. Their practices are governed by their own privacy notices, which we encourage you to read.

By using the Platform, you acknowledge this Privacy Policy. If you do not agree, do not use the Platform.

Roles: Controller and Processors

**SipSocial as controller.** We determine the purposes and means of processing personal information related to hosting Storefronts, operating Accounts, facilitating Checkout, routing Orders to Licensed Retailers, analytics on Platform performance, fraud prevention, security, and customer support tools we provide.

**Licensed Retailers as separate controllers.** Retailers receive Order and delivery information necessary to sell, ship, and comply with alcohol laws. They decide how long to retain records required by regulators and how to respond to product or delivery inquiries.

**Processors and service providers.** We use vetted companies that process personal information on our instructions and subject to contractual safeguards (**Processors**), including hosting, payments, email delivery, analytics, and advertising technology as described below. We do not authorize Processors to use your data for their own marketing unrelated to our services.

**Brand Partners.** Brands whose trademarks appear on a Storefront may receive aggregated or de-identified insights, or limited personal information when you opt in to brand marketing programs clearly disclosed at collection.

Information We Collect

We collect information you provide, information collected automatically, and information from third parties.

Information you provide

• **Account and profile:** name, email address, phone number, password or authentication tokens, marketing preferences, and optional date-of-birth or age affirmation where permitted.
• **Checkout and Orders:** delivery and billing addresses, gift messages, delivery instructions, products selected, order history on the Platform, and communications you send to support.
• **Identity and age verification:** government ID details or verification results when required by law, Retailer policy, or fraud prevention vendors (we minimize retention of raw ID images where possible).
• **Communications:** content of emails, chat, or forms you submit to us or through Platform tools.
• **Surveys and promotions:** responses and eligibility information when you participate in optional programs.

Information collected automatically

• **Device and usage:** IP address, browser type, operating system, device identifiers, pages viewed, referring URLs, clickstream, session duration, and crash logs.
• **Location:** approximate location derived from IP or, with permission, more precise location for shipping eligibility or local compliance.
• **Cookies and similar technologies:** see Section 8. We use cookies, pixels, local storage, and SDKs for authentication, preferences, analytics, and advertising measurement.

Information from third parties

• **Payment processors** such as Stripe provide transaction status, last four digits of cards, and fraud signals (we do not receive full payment card numbers in our databases when properly tokenized).
• **Licensed Retailers** may update fulfillment status, delivery outcomes, or chargeback information tied to your Order.
• **Authentication providers** if you choose social or single sign-on where offered.
• **Advertising and analytics partners** such as Meta may provide aggregated campaign performance or, where configured, hashed identifiers for measurement.
• **Data brokers or identity services** only where necessary for age verification, address validation, or fraud prevention and permitted by law.

We do not knowingly collect sensitive categories beyond what is reasonably necessary for age verification and compliance, and we do not use such information to infer characteristics about you for unrelated purposes.

How We Use Personal Information

We use personal information for the following **purposes**:

1. **Provide the Platform:** operate Storefronts, Accounts, Checkout, order routing, receipts, and service notifications. 2. **Facilitate transactions:** transmit Orders to Licensed Retailers, display availability and shipping options, and support payment flows integrated with Stripe or Retailer systems. 3. **Compliance and safety:** verify age eligibility, enforce alcohol shipping restrictions, prevent fraud, investigate abuse, and comply with legal obligations. 4. **Communications:** send transactional messages (order confirmations, shipping updates) via email providers such as Resend; send service announcements; and, with consent where required, marketing about Platform features or Brand programs. 5. **Improve and secure:** monitor performance hosted on Vercel and related infrastructure, debug errors, conduct analytics, test features, and protect against security incidents. 6. **Advertising and measurement:** measure effectiveness of campaigns, including through Meta technologies where disclosed, using hashed or device identifiers subject to your choices. 7. **Legal and enforcement:** establish, exercise, or defend legal claims; respond to lawful requests; and enforce our Terms. 8. **De-identified data:** create aggregated statistics that do not identify you.

We do not sell personal information for money. We may use or disclose personal information for targeted advertising or “sharing” as defined under California law; see Section 10 for your opt-out rights.

How We Disclose Personal Information

We disclose personal information as follows:

Licensed Retailers

When you place an Order, we share name, contact information, delivery address, products purchased, age-verification outcomes, and payment-related tokens or status with the fulfilling Licensed Retailer so they can accept, prepare, ship, and comply with law.

Service providers (Processors)

| Provider | Role | | -------- | ---- | | **Stripe** | Payment processing, fraud prevention, and payouts infrastructure where SipSocial or Retailers use Stripe | | **Resend** | Transactional and operational email delivery | | **Vercel** | Application hosting, edge delivery, and related logs | | **Meta** (Facebook/Instagram) | Advertising measurement, pixels, and custom audiences where enabled | | Other subprocessors | Customer support tooling, databases, monitoring, and security vendors under contract |

We require Processors to use personal information only to perform services for us and to protect it with appropriate security measures.

Brand Partners

If you opt in to brand marketing or a loyalty program, we may share limited identifiers and purchase history with the relevant Brand Partner as disclosed at signup. Brands must honor your opt-out choices and applicable law.

Legal and safety

We may disclose information to comply with subpoenas, court orders, or lawful government requests; to protect rights, property, or safety of SipSocial, users, or the public; and in connection with mergers, acquisitions, or asset sales subject to confidentiality and continued protection.

With your direction

We disclose information when you instruct us, such as sending a gift or contacting a Retailer through integrated tools.

We do not disclose personal information to third parties for their independent marketing without your consent where consent is required.

Cookies and Tracking Technologies

We and our partners use cookies and similar technologies to keep you signed in, remember preferences, understand usage, and measure advertising. You can control cookies through browser settings and, where offered, platform cookie banners. Disabling certain cookies may limit Checkout or Account features.

For California residents, some analytics or advertising cookies may constitute “sharing” for cross-context behavioral advertising; see Section 10.

Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, including:

• **Account data:** for the life of your Account and a reasonable period thereafter for reactivation, disputes, and legal holds.
• **Order and transaction records:** as required for tax, audit, and alcohol regulatory obligations, often several years depending on jurisdiction.
• **Marketing data:** until you opt out or delete your Account, plus a short suppression period to honor unsubscribe requests.
• **Logs and security data:** typically months to a few years unless needed for incident investigation.
• **Age-verification artifacts:** minimized; raw ID images deleted when verification vendors permit and law allows.

Licensed Retailers may retain Order information longer where required by their licenses. When we no longer need personal information, we delete or de-identify it subject to backup retention cycles.

Security

We implement administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, access controls, environment isolation on Vercel, secrets management, and vendor security reviews. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

If we become aware of a breach affecting your personal information, we will notify you and regulators as required by law.

International Users

The Platform is operated from the United States. If you access the Platform from outside the U.S., you understand that personal information may be processed in the U.S. and other countries where our providers operate, which may have different data protection laws than your country.

Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to opt out of certain uses.

California residents (CCPA/CPRA)

California consumers have the right to:

• **Know** what categories of personal information we collect, sources, purposes, and disclosures;
• **Access** specific pieces of personal information we hold about you;
• **Delete** personal information, subject to exceptions (for example, completing transactions or compliance records);
• **Correct** inaccurate personal information;
• **Opt out** of “sale” or “sharing” of personal information for cross-context behavioral advertising;
• **Limit** use of sensitive personal information to permitted purposes;
• **Non-discrimination** for exercising privacy rights.

To submit a request, email **legal@sipsocial.com** with “California Privacy Request” in the subject line. We will verify your identity using information associated with your Account or Order before responding. You may use an authorized agent with proof of authorization.

We provide a **Do Not Sell or Share My Personal Information** link or mechanism on Storefronts where required. Global Privacy Control signals are honored where legally mandated for opt-out of sharing.

Other U.S. states

Residents of Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws may have similar rights. Contact legal@sipsocial.com with your state and request type.

EEA/UK (if applicable)

If we offer services subject to GDPR, you may have rights to access, rectification, erasure, restriction, portability, objection, and lodging a complaint with a supervisory authority. Our lawful bases include contract, legitimate interests, consent, and legal obligation.

We will respond within timelines required by applicable law, generally forty-five (45) days for California requests with possible extension.

Children

The Platform is not directed to anyone under **twenty-one (21)** years of age, and we do not knowingly collect personal information from minors. If you believe we have collected information from a minor, contact legal@sipsocial.com and we will delete it promptly.

Third-Party Links and Retailer Sites

Storefronts may link to Brand websites, social media, or Retailer policies. We are not responsible for privacy practices of third parties. Review their policies before providing personal information.

Automated Decision-Making

We do not make solely automated decisions that produce legal or similarly significant effects about you without human review, except where permitted by law and disclosed at the point of collection (for example, fraud scoring that may block Checkout). Retailers and payment processors may apply automated fraud or age-verification rules under their own policies.

Your Choices

You may update certain Account information by signing in, unsubscribe from marketing emails using the link in messages, adjust cookie preferences through browser or banner controls, and submit privacy rights requests as described above. Deleting your Account may not delete Order records held by Licensed Retailers where retention is legally required.

Nevada and Other State Notices

Nevada residents may submit a request to limit certain sales of covered information under NRS 603A. We do not currently sell covered information as defined by that statute in ways that require a separate Nevada notice beyond our general practices. Residents of other states with emerging privacy laws should contact legal@sipsocial.com for applicable rights as those laws take effect.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect operational, legal, or regulatory changes. We will post the revised version with an updated effective date and provide additional notice for material changes when appropriate. Continued use after the effective date constitutes acknowledgment unless law requires express consent.

Contact Us

For privacy questions, rights requests, or complaints, contact:

**SipSocial, Inc.** Email: **legal@sipsocial.com**

We will work with you in good faith to resolve concerns. California residents may also contact the California Attorney General’s office.

---

*This Privacy Policy applies to the Platform operated by SipSocial. Licensed Retailer privacy practices for fulfillment and regulatory records are described in Retailer-specific notices provided at checkout or on retailer domains.*