Privacy Policy

This Privacy Policy (“Policy”) explains how CritterTrust, LLC ("CritterTrust," "we," "us," or "our") may collect, use, process, disclose, retain and/or protect Personal Information about you when you use our website (crittertrust.com, crittertrust.app), our mobile application, and related services (collectively, the "Service").

CritterTrust, LLC is an Ohio limited liability company with its registered address at 1633 Graceland Drive, Fairborn, Ohio 45324, United States. If you have questions about this Policy or your Personal Information, contact us at privacy@crittertrust.com.

By using the Service, you agree to the collection and use of your Personal Information as described in this Policy. If you do not agree, please do not use the Service.

1. Who the Service is for

The Service is intended for adults 18 years of age or older. The Service is currently offered only to users located in the United States, and our pet sitting marketplace operates within specific US metropolitan areas.

We do not knowingly collect or process Personal Information from children under the age of 13. If a parent or legal guardian believes we have inadvertently collected information from a child under 13, please contact us at privacy@crittertrust.com and we will delete it.

If you are accessing the Service from outside the United States, you understand that your Personal Information will be transferred to, stored, and processed in the United States in accordance with this Policy. Our handling of your Personal Information is governed by US law. Sections 10 through 12 of this Policy describe additional rights for residents of California, other states and for residents of the European Economic Area, the United Kingdom, and Switzerland.

2. What Personal Information we collect or process and how we collect or process it

We collect or process various types of Personal Information in three (3) ways: information you provide directly, information collected automatically, and information received from third parties.

2.1 Personal Information you provide directly

When you join our waitlist on crittertrust.com, we collect your email address so we can notify you when the Service is available in your area.

When you fill out our Founding Sitter questionnaire hosted on Google Forms, we collect your full name, email address, phone number, city or service area, years of pet sitting experience, estimated monthly revenue range, services you offer, animal types you care for, which platforms you currently use and what frustrates you about them, your current invoicing method, and your interest in participating in our feedback community. This information is used to evaluate you for our Founding Sitter program and to improve our Service. See Section 5 for how we use this specific data.

When you create a sitter account, we collect your full name, email address, phone number, profile photo, business name (if any), public bio, service area, pricing information, and availability. To process background checks and payments, we also collect identifying information required by our third party verification and payment providers (see Section 3).

When you create a pet owner account (typically by booking a sitter through our app), we collect your first and last name, email address, phone number, home address, and information about your pets. Pet information may include species, breed, age, weight, medical conditions, medications, behavioral notes, feeding instructions, veterinarian contact information, and photos.

When you communicate with us or with other users through the Service, we collect the content of your messages.

When you make or receive a payment through the Service, our third party payment processor collects payment method information directly from you. We do not store your full credit card or bank account numbers on our systems. Payment method information is primarily stored and processed by our third-party providers, including our payment processors; however, we may store and process limited payment-related information such as the last four digits of a payment card, name of the financial institution, and payment service.

2.2 Personal Information collected automatically

Location data. When you are a sitter with an active visit, we collect GPS coordinates at visit check-in and check-out to verify the visit location. If you explicitly opt in to continuous location sharing during a visit, we collect GPS coordinates throughout the visit duration. You can disable location permissions for the app at any time through your device settings, though this may impact the experience of the Service, including preventing the verification of visits.

Device and usage information. We collect limited technical information about your device and how you use the Service, including device type, operating system version, app version, push notification tokens, and timestamps of key actions such as sign-ins, bookings, and visit completions. This information is used to operate the Service, diagnose errors, and prevent abuse.

Photos. When you upload photos to the Service (for example, profile photos, pet photos, or visit report card photos), we store them and make them available to the other party in the relevant sitter-owner relationship. Photos from visit report cards are only shared with the pet owner whose pets were cared for during that visit.

Cookies and similar technologies. Our website uses only essential cookies required to operate basic functionality such as form submission and session continuity. We do not use third-party advertising cookies, analytics cookies, or tracking pixels on our website. We honor Do Not Track: if your browser sends a DNT signal, we will not set any non-essential cookies during your session.

2.3 Personal Information received from third parties

Background check results. When a sitter initiates a background check, we receive a pass-or-fail status from our third party background check verification provider. We do not receive or store the underlying background check report, including criminal history details, identity documents, or address history. That information is held by our verification partner subject to their own privacy policy and their obligations under the federal Fair Credit Reporting Act.

Authentication providers. If you sign in using Apple or Google, we receive your name and email address from those providers to create your account. We do not receive your password, contact list, photos, or other information from those accounts.

Legal Claims, Disputes and Requests. We may collect Personal Information from third parties or persons, such as law enforcement agencies, government agencies or authorities, users and non-users of our Service, and any other person or party who may be involved in the matter.

3. Third parties who use, collect and/or process your Personal Information

We use the following third-party Service Providers to operate the Service.

We do not sell your Personal Information to any third party. We do not share your Personal Information with advertisers, data brokers, or marketing networks.

4. How we use your Personal Information

We may use your Personal Information we collect to:

• Provide, operate, and maintain the Service, including creating and managing your account, processing bookings, delivering messages, and generating visit report cards;

• Verify sitter identity and background so that pet owners can make informed decisions;

• Process payments, generate invoices, and remit payouts to sitters;

• Send you transactional communications, including booking confirmations, visit updates, report cards, invoices, payment receipts, magic sign-in links, and important account notices;

• Respond to your questions, feedback, and support requests;

• Improve the Service and develop new features, including analyzing usage patterns in aggregate;

• Detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service;

• Comply with our legal obligations, including tax, accounting, and regulatory requirements; and

• Enforce our rights and the rights of our users.

We do not use your Personal Information to make automated decisions that produce legal or similarly significant effects about you, other than routine fraud screening performed by our third party payment processor.

5. Founding Sitter program — special handling

If you complete our Founding Sitter questionnaire, we recognize that some of the Personal Information you provide — specifically your monthly revenue range, the platforms you currently use, and your feedback about those platforms — is commercially sensitive to you.

We handle this Personal Information with additional care:

• We will not share individually identifying Founding Sitter responses with any third party, including competing platforms.

• We will not publicly attribute quotes, feedback, or statistics to you individually without your explicit prior consent.

• We may share aggregated, de-identified insights from Founding Sitter responses (for example, "of our candidate pool, X% reported monthly earnings above $2,000") in product materials or public communications.

• Your responses are retained while you are an active Founding Sitter candidate or participant, and for a reasonable period afterward for product history and internal reference. You may request deletion of your questionnaire responses at any time by contacting privacy@crittertrust.com.

6. How we share your Personal Information

We share your Personal Information only in the following circumstances:

With the other party in a sitter-owner relationship. When a pet owner books a sitter, each party sees the Personal Information necessary to complete the service — names, contact information, the owner's address and pet profile, and the sitter's profile and verified status. Messages, report cards, and payment records are visible to both parties in the relationship.

With third-party service providers. As described in Section 3.

For legal reasons. We may disclose Personal Information if we reasonably believe disclosure is required by law, court order, subpoena, or governmental regulation, or to protect the rights, property, or safety of CritterTrust, our users, or the public.

In connection with a business transaction. If CritterTrust is involved in an actual or potential merger, acquisition, sale of assets, or bankruptcy, your information may be shared in the due diligence process and/or transferred as part of that transaction. We will notify you by email or prominent notice on the Service before your information becomes subject to a different privacy policy.

With your consent. We may share Personal Information for other purposes with your explicit consent.

We do not sell your Personal Information.

7. Data retention

We keep your Personal Information only as long as reasonably necessary for the purposes described in this Policy:

• Active account data is retained while your account is active.

• Account data after deletion. When you delete your account, we will delete or anonymize your Personal Information within fourteen (14) days, except as described below.

• Financial and tax records (including transaction records, invoices, payouts, and related information required for tax, accounting, or anti-fraud purposes) are retained for up to seven (7) years, as required by US tax law and sound financial recordkeeping.

• Aggregated, de-identified data may be retained indefinitely for analytics and product improvement. This data cannot be linked back to you.

• Backup copies of our database may persist in our secure backups for up to ninety (90) days after deletion before they roll off.

• Waitlist and Founding Sitter questionnaire data is retained while the Founding Sitter program is active and for a reasonable period after; you may request earlier deletion.

To request account deletion, contact privacy@crittertrust.com or use the deletion option in your account settings.

8. Security

We take reasonable measures to protect your Personal Information, including:

• Encryption of data in transit using industry-standard TLS;

• Encryption of data at rest on our database and storage providers;

• Role-based access controls and database-level row security policies that restrict access to your data;

• Authentication via passwords, magic-link email sign-in, and Apple/Google federated sign-in;

• Regular review of our third-party providers' security practices.

No method of transmission or storage is perfectly secure. While we work hard to protect your Personal Information, we cannot guarantee its absolute security. If we become aware of a data breach that affects your Personal Information, we will notify you and relevant authorities as required by applicable law.

9. Your choices

You have several choices regarding your Personal Information:

• Access and correction. You can view and update most of your profile information directly in the app. For information you cannot change in the app, contact privacy@crittertrust.com.

• Account deletion. You can delete your account through your account settings or by contacting us. See Section 7 for retention details.

• Location permissions. You can enable or disable the app's access to your device's location at any time through your device settings.

• Notifications. You can enable or disable push notifications through your device settings, and can manage email notification preferences in the app.

• Marketing communications. Unless you have opted in, we do not send marketing emails. If you receive a marketing email from us, you can unsubscribe using the link at the bottom of the email.

10. California privacy rights (CCPA / CPRA / CalOPPA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") gives you specific rights regarding your Personal Information. This section, together with the California Online Privacy Protection Act ("CalOPPA"), and disclosures throughout this Policy, describes those rights.

Categories of Personal Information we may collect and disclose

In the past twelve (12) months, we may have collected the following CCPA/CPRA categories of Personal Information about California residents and may have disclosed them to the following categories of recipients: identifiers (name, email, phone, address, IP address); customer records information (payment information, stored by our third party payment processor); commercial information (bookings, transactions); internet activity (limited device and usage information); geolocation data (GPS during visits); professional information (for sitters: business profile, experience); sensitive personal information (for sitters only: Social Security Number, collected only by our third party background check verification provider).

Notice at Collection.

See Section 2 of this Policy for the categories of Personal Information we may collect.

See Section 2 of this Policy for the sources from which we may collect Personal Information.

See Section 4 of this Policy for the purpose for which we may collect Personal Information.

See Section 3 and Section 6 of this Policy for the categories of recipients/third parties to whom we may disclose your Personal Information.

See Section 7 of this Policy for the length of time we intend to retain each category of Personal Information.

We do not knowingly sell or share Personal Information of children under the age of 16.

We do not sell or share your Personal Information

We do not sell your Personal Information, and we do not share your personal information for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA. We have not sold Personal Information in the preceding twelve (12) months.

Your rights as a California resident

Subject to certain limitations, you have the right to:

• Know what Personal Information we have collected about you, the sources, the purposes for collection, and the third parties with whom we share it;

• Access a copy of your Personal Information;

• Correct inaccurate Personal Information we hold about you;

• Delete your Personal Information, subject to certain exceptions (for example, financial records we are required to retain by law);

• Limit our use of sensitive Personal Information. We do not use sensitive Personal Information for purposes other than those permitted by CCPA/CPRA without explicit consent.

• Opt out of sale or sharing. Because we do not sell or share personal information, there is nothing to opt out of, but you retain this right.

• Non-discrimination. We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email privacy@crittertrust.com from the email address associated with your account, or contact us through the app. We will respond within forty-five (45) days. We may need to verify your identity before fulfilling certain requests; the verification method will be proportionate to the sensitivity of the request and the information involved.

You may authorize an agent to make requests on your behalf. We will require proof of the authorization and may require you to verify your identity directly.

CalOPPA compliance

This Privacy Policy is conspicuously posted on our website. We will notify users of material changes to this Policy by posting a notice on our website and, where appropriate, by email. We respond to Do Not Track browser signals as described in Section 2.2 of this Policy.

11. State Specific Privacy Rights

The following states have enacted comprehensive consumer privacy laws that provide specific rights to residents: Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. If you are a resident of one of these states, the provisions below apply to you in addition to the other sections of this Policy.

11.1 If you are a resident of a state listed above, you have the following rights with respect to your Personal Information:

-Right to Confirm and Access. You have the right to confirm whether or not we are processing your Personal Information and to access your Personal Information.

• Right to Correct. You have the right to request that we correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing.

-Right to Delete. You have the right to request that we delete Personal Information that we have collected from you, subject to certain exceptions described below.

• Right to Data Portability. You have the right to obtain a copy of your Personal Information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.

-Right to Opt Out of Sale or Targeted Advertising. You have the right to opt out of the sale of your Personal Information or the processing of your Personal Information for targeted advertising purposes. We do not sell your Personal Information and do not process your Personal Information for targeted advertising. If our practices change, we will update this Policy and provide you with the required opt-out mechanisms.

-Right to Opt Out of Profiling (Applicable in Colorado, Connecticut, Montana, Oregon, Texas, and Virginia). You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. We do not engage in profiling that produces such effects. If our practices change, we will update this Policy and provide you with the required opt-out mechanisms.

-Right to Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights.

-Minnesota Residents — Universal Opt-Out Mechanism. We recognize and process universal opt-out preference signals (such as the Global Privacy Control (GPC)) in a frictionless manner as required by Minnesota law. If your browser or device transmits an opt-out preference signal and we detect it, we will honor that signal as a valid request to opt out of the processing of your Personal Information for purposes of targeted advertising and the sale of Personal Information. Because we do not engage in targeted advertising or the sale of Personal Information, this opt-out preference signal will have no practical effect on our current processing activities.

-Minnesota and Nebraska Residents — Data Minimization. We limit the collection of Personal Information to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed, as required by Minnesota and Nebraska law. We collect only the categories of Personal Information described in Section 2 of this Privacy Policy and only for the purposes described in Section 4. We retain Personal Information only as long as necessary to fulfill the purposes for which it was collected, as described in Section 7 of this Privacy Policy.

-Tennessee Residents — Consent for Sensitive Data. Under Tennessee law, we must obtain your consent before processing sensitive data. For sitters, we obtain your consent to collect and process identification and background check information at the time you initiate the background verification process. For geolocation, we obtain your device-level permission and explicit opt-in consent for continuous location sharing. For message contents, your use of the messaging feature constitutes consent to our storage and processing of those messages to facilitate communication between you and the other party. You may withdraw your consent to our processing of sensitive data at any time by contacting us at privacy@crittertrust.com or through your account settings. Withdrawal of consent may limit your ability to use certain features of the Service.

11.2 To exercise any of the rights described in Section 11 above, you may submit a request in the following ways:

-Email. Send an email to privacy@crittertrust.com from the email address associated with your account.

-In-App Contact Form. Use the contact or support form available in the CritterTrust mobile application.

-Mail. Write to us at: CritterTrust, LLC Attn: Privacy 1633 Graceland Drive Fairborn, Ohio 45324 United States

-Information Required for Your Request. To process your request, please provide: your full name and the email address associated with your account; a description of the right you wish to exercise (confirm and access, correct, delete, opt out, data portability); and sufficient information to allow us to verify your identity and locate your Personal Information in our systems.

11.3 To respond to some rights requests, we may need to verify your request either by asking you to log in and authenticate your account or otherwise verify your identity by providing information about yourself or your account. Under some applicable laws, authorized agents can make a request on your behalf under certain circumstances, such as if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.

-Response deadline. We will respond to your verified request within forty-five (45) days of receipt. If we require more time (up to an additional forty-five (45) days), we will inform you of the reason and extension period in writing within the initial forty-five (45) day period.

-Format of response. We will deliver our response by mail or electronically, at your option. If provided electronically, the response will be in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another entity without hindrance.

-No fee. We do not charge a fee to process or respond to your verifiable consumer request unless it is manifestly unfounded, excessive, or repetitive. If we determine that the request warrants a fee, we will tell you why and provide a cost estimate before completing your request.

11.4 You may have the right to appeal our decision regarding a request related to these rights.

-Right to appeal. If we decline to take action on your request, you have the right to appeal our decision. We will inform you in our response of your right to appeal and provide instructions for submitting an appeal.

-How to submit an appeal. To appeal our decision, send an email to privacy@crittertrust.com within a reasonable time after receiving our response, stating the basis for your appeal.

-Appeal response deadline. We will respond to your appeal within sixty (60) days of receipt (or within forty-five (45) days for appeals from Oregon and Tennessee residents). If we require more time, we will inform you of the reason and extension period in writing.

-Further action. If your appeal is denied, we will provide you with information on how to contact your state Attorney General to submit a complaint.

11.5 If you have questions about your state privacy rights or wish to exercise your rights, please contact us:

• Email: privacy@crittertrust.com

-Mail: CritterTrust, LLC Attn: Privacy 1633 Graceland Drive Fairborn, Ohio 45324 United States

-In-App: Use the contact or support form in the CritterTrust mobile application

12. Rights for residents of the EEA, UK, and Switzerland (GDPR)

Although our Service is offered only in the United States, if you are accessing our website from the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation and the UK GDPR grant you certain rights. CritterTrust acts as the data controller for information processed through our website and Service.

Legal bases for processing

We process your Personal Information on the following legal bases:

• Contract. To provide the Service you have requested (for example, processing your booking, payments, and communications with your sitter or client).

• Legitimate interests. To operate, secure, and improve the Service; to prevent fraud; to communicate with you about your account; and to evaluate candidates for the Founding Sitter program.

• Consent. For specific optional features such as continuous location sharing during a visit, and for any future marketing communications.

• Legal obligation. To comply with tax, accounting, and other applicable laws.

Your rights

You have the right to:

• Access your Personal Information and receive a copy in a portable format;

• Correct inaccurate Personal Information;

• Request erasure of your personal information (the "right to be forgotten"), subject to limitations for data we are legally required to retain;

• Restrict or object to our processing of your Personal Information;

• Withdraw consent at any time, where processing is based on consent;

• Lodge a complaint with your local supervisory authority.

To exercise these rights, contact privacy@crittertrust.com. We will respond within 30 days.

International data transfers

By using the Service, you understand that your Personal Information will be transferred to and stored in the United States, which has different data protection laws than your country of residence. Where we transfer personal information from the EEA, UK, or Switzerland to the United States, we rely on Standard Contractual Clauses with our processors where applicable, and on your informed consent to use the Service.

13. Do Not Track

Our website honors Do Not Track (DNT) browser signals. If your browser sends a DNT signal, we will not set any non-essential cookies during your session. Because we do not use third-party advertising, analytics, or tracking cookies in the first place, this primarily affects essential cookies related to form submission, which may be limited.

14. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this Policy;

• Post a notice on our website and in the app where appropriate;

• For material changes that affect how we use information we already hold, notify you by email before the changes take effect.

Your continued use of the Service after the effective date of an updated Policy constitutes acceptance of the updated Policy. If you do not agree with the updated Policy, you should stop using the Service and may request deletion of your account.

15. Contact us

For questions, requests, or concerns about this Policy or our privacy practices:

Email: privacy@crittertrust.com

Mail:

CritterTrust, LLC

1633 Graceland Drive

Fairborn, Ohio 45324

United States

This Policy is provided for your information and is not legal advice. We recommend consulting qualified legal counsel for advice specific to your situation.

4922-1470-4315, v. 1