PRIVACY POLICY

1. SCOPE OF THIS POLICY

This Privacy Policy describes how EZ-AD Inc. ("EZ-AD," "we," "our," or "us") collects, uses, shares, and protects personal information when you:

• visit any EZ-AD websites (including ezadtv.com, saturntext.com, ezai.io, and their sub-domains);
• use the EZ-AD TV in-store digital-signage platform, our mobile applications, or any SaaS dashboards we provide;
• interact with the EZ-AD Digital Commerce platform ("LocaleCommerce"), including our e-commerce and Amazon marketplace fulfillment services, or the SaturnText SMS marketing tool; or
• communicate with us through support channels, email, social media, or events.

This Policy applies globally. Additional region-specific disclosures are embedded throughout this document and detailed in Section 8.

By continuing to use the Services, you acknowledge that you have read and understood this Policy.

2. INFORMATION WE COLLECT

We collect information that falls into the categories below:

Important: We do not deliberately collect biometric identifiers or images; our screens do not perform facial recognition. Sensitive data (including contact-list data, precise geolocation, and any health information) is processed only with your explicit consent and is not sold or shared for cross-context advertising.

3. HOW & WHY WE USE PERSONAL DATA

We process personal data for the purposes and legal bases outlined below:

4. RETENTION OF PERSONAL DATA

Unless a longer period is required by law, we retain data for the periods below and then securely delete or anonymize:

• Account & billing records – 7 years after account closure;
• Payment tokens – 7 years (for tax/audit);
• Usage analytics (Google Analytics, Hotjar) – 26 months;
• Support tickets & call recordings – 3 years;
• Advertising cookie IDs – as per cookie expiry listed in Section 5.

5. COOKIES & TRACKING TECHNOLOGIES

We use cookies, web beacons, pixel tags, HTML5 local storage, and legacy Flash cookies (where supported) for analytics and security.

5.1 Cookie Categories

• Essential – required for the site to function (e.g., session tokens).
• Functional – remember preferences such as language.
• Analytics – measure site performance (Google Analytics, Hotjar). Off by default in EEA/UK.
• Advertising – measure conversions & deliver personalized ads (Google Ads, Facebook Pixel). Off by default in EEA/UK. Opt-out = "Do Not Share" under CPRA.

5.2 Cookie Inventory

You can control cookies via our banner ("Accept all", "Decline all", "Adjust my preferences") or through your browser settings. See "Cookie Settings" link in the footer.

Opt-Out Confirmation: When you decline or opt out of advertising cookies, we will display a confirmation message. Your preference is stored and will be honored on future visits. You can change your preference at any time via the Cookie Settings link in our footer.

5.3 Universal Opt-Out Mechanism & Global Privacy Control

We recognize and honor Universal Opt-Out Mechanism (UOOM) and Global Privacy Control (GPC) signals. When your browser or device sends one of these signals, we will treat it as a request to opt out of the sharing of your personal information for cross-context behavioral advertising. You can enable GPC through participating browsers (such as Firefox, Brave, or DuckDuckGo) or browser extensions.

6. SHARING OF PERSONAL DATA

We do not sell personal information. We may "share" it for cross-context advertising as defined by CPRA (Advertising cookies above). We disclose data only to:

• Service Providers acting under written DPAs (Google Cloud – USA; Stripe – USA; Mailgun – USA/EU; Twilio – USA; Hotjar – EU; Meta Platforms – USA);
• Third-party integrations: if you choose to link an external account (e.g., YouTube, Facebook) to EZ-AD, we will share and receive information as authorized by you through the OAuth consent screen. You can disconnect any integration at any time by visiting the respective feature page.
• Business partners you authorize (e.g., your POS vendor, or a fulfilling vendor/distributor who ships your orders);
• Legal authorities when required;
• Successors in the event of a merger or acquisition (notice will be provided).

All transfers are governed by 2021 Standard Contractual Clauses where applicable.

7. INTERNATIONAL DATA TRANSFERS

Our primary servers are in the United States. When we transfer personal data from the EEA/UK to the U.S. or another third country, we rely on:

• Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914);
• Adequacy decisions, where available; or
• Your explicit consent (Art 49 GDPR) for specific transfers.

Amazon Information. The international-transfer mechanisms described in this Section apply to our general services only. Amazon Information is processed and stored exclusively within the United States and is not transferred outside the United States. See Section 15.7.

8. YOUR PRIVACY RIGHTS

8.1 EU / UK Residents (GDPR)

You have the right to request access, rectification, erasure, restriction, objection, and portability of your personal data, and to withdraw consent at any time. You can submit requests via our online form at https://ezadtv.com/forget-me (general services) or https://ezadtv.com/digitalcommerce/forget-me (Digital Commerce), through your dashboard (Settings → Account → "Download your Data – Request Data"), or by emailing [email protected]. For email marketing, use the "Unsubscribe" link in any marketing email; because EZ-AD TV signage licenses are held by independently owned retail stores, you may need to unsubscribe separately from each store. Transactional messages will still be sent. We acknowledge requests within 48 hours and provide a substantive response within 30 days.

8.2 California Residents (CCPA/CPRA)

You have the right to Know, Delete, Correct, Opt-Out of Sharing, and Non-Discrimination. Submit requests via https://ezadtv.com/forget-me (general services) or https://ezadtv.com/digitalcommerce/forget-me (Digital Commerce), your dashboard, or [email protected]. We recognize and honor UOOM and GPC signals as requests to opt out of sharing for cross-context behavioral advertising. We confirm receipt within 10 business days and fulfill verified requests within 45 days.

8.3 Oregon Residents

Oregon residents have rights similar to California residents under the Oregon Consumer Privacy Act, including the right to opt out of sales and targeted advertising. We recognize UOOM signals as valid opt-out requests; we do not sell geolocation data and ceased all such sales as of January 1, 2026; and for children under 16 we require verifiable parental consent before processing data for targeted advertising or sales. Submit requests using the methods in Section 8.2.

8.4 Connecticut Residents

Connecticut residents have comprehensive privacy rights under the Connecticut Data Privacy Act, including access, deletion, correction, data portability, and opt-out of sales and targeted advertising. As of January 1, 2026, we recognize UOOM signals for Connecticut residents. Submit requests using the methods in Section 8.2. We respond within 45 days and provide an appeal process.

8.5 Indiana, Kentucky, and Rhode Island Residents

Residents of these states have the right to confirm whether we process their personal data, access it, delete it, obtain a portable copy, and opt out of targeted advertising and sales. Submit requests via https://ezadtv.com/forget-me (general services) or https://ezadtv.com/digitalcommerce/forget-me (Digital Commerce) or [email protected]. We respond within 45 days, and you may appeal by contacting [email protected]. These laws took effect January 1, 2026.

8.6 Multi-State Privacy Rights Summary

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have specific privacy rights under their state laws, including rights to access, delete, correct, and opt out of sales/sharing of personal information. Use the contact methods above to exercise your rights.

9. SECURITY MEASURES

We implement industry-standard security measures to protect your personal data:

• TLS 1.3 encryption in transit; AES-256 at rest
• Role-based access control & MFA for staff
• Quarterly penetration testing & annual SOC 2 Type II audits
• Daily encrypted backups stored off-site

10. ACCOUNT SECURITY & ANTI-PHISHING REMINDER

Choose a strong, unique password for your EZ-AD account and keep it confidential. EZ-AD will never ask you to reveal your password, credit-card details, or other sensitive information by email, SMS, or phone. If you receive a message that appears to come from EZ-AD requesting such data, please treat it as phishing and delete it. If you believe your account credentials have been lost, stolen, or misused, contact us immediately at [email protected] or +1 888-580-5593

11. CHILDREN'S PRIVACY

Our Services are not directed to children under 16. We do not knowingly collect, sell, or share personal information of consumers under 16 without affirmative authorization. If you are under 16, you must have a parent or guardian create and manage your account.

For children under 16 in states with enhanced protections (including California, Connecticut, and Oregon), we require verifiable parental consent before processing data for targeted advertising or sales. If we learn we have collected data from a child under 16 without proper authorization, we will delete it promptly.

12. BREACH NOTIFICATION COMMITMENT

In the event of a personal-data breach likely to result in risk, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, consistent with GDPR Art 33-34 and applicable U.S. state laws.

13. CHANGES TO THIS POLICY

We may update this Policy. Material changes will be notified via banner or email 30 days before they take effect. The "Last Updated" date at the top of this document reflects the latest revision.

14. CONTACT US

Data Controller: EZ-AD TV, Inc.

Address: 101 West Big Beaver Ave, Floor 14, Troy, MI 48084

Email: [email protected]

Phone: +1 888-580-5593

15. AMAZON SELLING PARTNER API (SP-API) DATA

This Section describes how we handle information obtained through the Amazon Selling Partner API ("SP-API") when a client uses EZ-AD's Amazon marketplace integration and order-fulfillment service. It applies only to that service and supplements the disclosures above.

15.1 Information We Receive. When our client connects their Amazon Selling Partner (Seller Central) account, we receive, through the SP-API, the information necessary to list products and fulfill orders. This includes order information such as the buyer's name and shipping address, order quantity, pricing, and order and shipment identifiers, as well as catalog, listing, and inventory data. The buyer's shipping address is the only buyer personal information we process.

15.2 How We Use It. We use SP-API data solely to provide the integration service: to determine which products are eligible to be listed on Amazon, to create and manage listings, to manage inventory, to receive orders, to arrange fulfillment, and to return tracking and order-status information to Amazon. We do not use SP-API data for marketing, we do not aggregate it across clients, we do not use it to generate insights about Amazon's business, and we do not sell it.

15.3 Sharing for Fulfillment. To ship an order, we transmit the order details, including the buyer's shipping address, to the fulfilling vendor or distributor responsible for delivering the product. This is done solely to fulfill and deliver the order and is limited to the information necessary for that purpose.

15.4 Storage and Security. Amazon order information containing personal information is stored in encrypted form in a separate, non-public database. Personal information is encrypted using Google Cloud Key Management; if the key version used to encrypt the data is destroyed, the data is cryptographically erased and unrecoverable. Access is restricted to authorized personnel based on the principle of least privilege. Developer access is limited to read-only access, and all data queries are logged. These controls are in addition to the general security measures described in Section 9.

15.5 Retention. Amazon buyer personal information is retained only for as long as necessary to fulfill the applicable order. Unless a longer retention period is required by applicable law, tax, audit, or contractual obligations, buyer PII is permanently deleted or irreversibly anonymized within 30 days after order delivery in accordance with EZ-AD TV's Data Retention Policy. Where automated deletion is configured, deletion is performed according to the applicable retention schedule.

15.6 Buyer Rights. Amazon buyers who wish to exercise privacy rights in connection with an Amazon order should contact the seller through Amazon. Where we process buyer information on a client's behalf, we support the client in responding to such requests.

15.7 Cross-Border Transfers. Amazon Information is processed and stored exclusively within the United States. EZ-AD does not transfer Amazon Information outside the United States.

16. GLOSSARY

Personal Data: Information relating to an identified or identifiable individual.

Processing: Any operation performed on Personal Data.

Service Provider / Processor: Third party that processes Personal Data on our behalf.

Sell / Share: As defined in the California Privacy Rights Act.

Contract (Art 6(1)(b) GDPR): Processing necessary to deliver the products or services you request, or to take steps at your request prior to entering into a contract.

Legitimate Interest (Art 6(1)(f) GDPR): Processing based on our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Legal Obligation (Art 6(1)(c) GDPR): Processing required to comply with a legal or regulatory obligation, such as tax or accounting rules.

Consent (Art 6(1)(a) GDPR): Processing carried out only when you have given clear permission, which you may withdraw at any time.

Universal Opt-Out Mechanism (UOOM): A technology that enables consumers to automatically communicate their privacy preferences across multiple websites and services without opting out manually on each platform.

Global Privacy Control (GPC): A browser or device signal that communicates a user's request to opt out of data sales and targeted advertising.

Precise Geolocation: Location data that identifies a geographic area within a radius of 1,750 feet or less.