This California Privacy Notice supplements the Too Lost LLC Privacy Policy and applies only to residents of the State of California ("California residents" or "you"). It is provided pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CPRA"). Any capitalized terms not defined in this notice have the meanings given in the Privacy Policy or the CPRA or Terms of Use.

1. Categories of Personal Information Collected

Within the last twelve (12) months, Too Lost LLC ("Too Lost," "we," "us," or "our") has collected the following categories of personal information, where applicable to your interaction with the Services:

• Identifiers (e.g., name, email address, postal address if provided, account username, IP address, online identifiers, device identifiers, social security number, driver's license number, passport number, or other similar identifiers)
• Personal information categories under California law, including name, signature, social security number, address, telephone number, passport number, driver's license or state identification card number, employment, bank account number or other financial information (some personal information included in this category may overlap with other categories)
• Customer Records Information (e.g., contact details, account credentials, billing address, and payment-related information processed by third-party payment processors)
• Commercial Information (e.g., subscription, service, billing, and transaction history)
• Internet or Network Activity (e.g., browsing activity, interactions with the Platform, app or website usage, cookies, and tracking data)
• Geolocation Data (e.g., approximate location derived from IP address and, where enabled, more precise location information)
• Audio, Electronic, Visual, or Similar Information (e.g., customer support call recordings, messages, or other communications where applicable)
• Biometric Information (e.g., biometric identifiers or biometric information, where applicable, that may be collected and processed by third-party identity verification providers in connection with identity verification, security, fraud prevention, or related services provided to Too Lost)
• Inferences Drawn from Personal Information (e.g., preferences, interests, and other information used to personalize content, recommendations, or marketing)
• Protected Classification Characteristics under California or Federal Law (e.g., age or gender, but only where you choose to provide such information or where collected as required by law)
• Professional or Employment-Related Information (e.g., company name, job title, role, employer, business contact details, or other professional information you provide when interacting with us in a business or creator, artist, label, partner, or vendor capacity, where applicable)
• Sensitive Personal Information, such as account login credentials, social security number, driver's license, state identification card, or passport number, financial account information in connection with payment processing, precise geolocation where enabled, and, where applicable, certain biometric information collected and processed by third-party identity verification providers in connection with verification, security, or fraud-prevention services provided to Too Lost

We use and disclose Sensitive Personal Information only for purposes permitted by the CPRA and its implementing regulations, and we do not use or disclose Sensitive Personal Information for purposes that would give rise to a right to limit its use or disclosure except as otherwise permitted by law.

2. Sources of Personal Information

We may collect personal information directly from you; automatically from your devices, browsers, and your use of the Platform; through cookies and similar technologies; from service providers and contractors, including third-party identity verification providers acting in connection with services provided to Too Lost; from advertising and analytics partners; from payment processors; and from other third parties that interact with us in connection with the Services.

3. Purposes for Collection and Use

We may collect, use, retain, and disclose personal information for business and commercial purposes, including to provide and maintain the Services; administer accounts; process payments; verify identity; provide customer support; personalize content; conduct marketing and advertising; perform analytics and research; detect, prevent, and investigate fraud and other security incidents; debug and repair errors; comply with legal obligations; and enforce our agreements and policies.

4. Disclosure of Personal Information

We may disclose personal information to service providers and contractors, including third-party identity verification providers; advertising and marketing partners; analytics providers; business partners; professional advisors; government authorities as required by law; and successors in interest in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets.

In connection with identity verification, account security, fraud prevention, or related compliance and trust-and-safety functions, third-party identity verification providers that provide services to Too Lost may collect and process personal information such as identity-document information, photographs, video recordings, selfie images, device and network information, and other information reasonably necessary to assess authenticity, prevent fraud, verify identity, and support the services they provide to Too Lost. Where permitted by applicable law and depending on the verification method used, such providers may also collect and process biometric information. See the "Biometric Information" section of the Privacy Policy to learn more about how this information is collected, used, disclosed and stored by our third-party service providers in connection with identity verification, account security, fraud prevention, or related compliance and trust-and-safety functions.

5. Sale or Sharing of Personal Information

Too Lost does not sell personal information for monetary consideration in the ordinary sense of the word, but certain disclosures of personal information to third parties through cookies, pixels, SDKs, and similar tracking technologies may constitute a "sale" under California law if made for monetary or other valuable consideration, or the "sharing" of personal information if made for cross-context behavioral advertising.

Too Lost may disclose identifiers, internet or network activity, commercial information, geolocation data, and inferences to advertising and analytics partners for cross-context behavioral advertising and related analytics, which may constitute "sharing" or, in some circumstances, a "sale" under the CPRA when personal information is disclosed for monetary or other valuable consideration. California residents have the right to opt out of the sale or sharing of their personal information. To exercise this opt-out right, see Section 9 below ("Do Not Sell or Share My Personal Information / Opt-Out Rights").

6. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in our Privacy Policy and this notice, unless a longer retention period is required or permitted by law. Retention periods vary depending on the category of personal information and the purposes for which it was collected and used, including to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

7. California Privacy Rights

Subject to applicable restrictions and exemptions, California residents may have the right to request knowledge of and access to the personal information we have collected about them, including the categories, sources, purposes, and recipients of such information; to request deletion and correction of personal information; to request a copy of personal information in a portable format where required by law; to opt out of the sale or sharing of personal information; to limit the use or disclosure of Sensitive Personal Information where applicable; and to not be discriminated against for exercising their privacy rights. The rights described herein are not absolute and we reserve all of our rights available to us at law in this regard.

California's "Shine the Light" law permits California residents to annually request and obtain information about what personal information is disclosed to third parties for direct marketing purposes in the preceding calendar year. We do not distribute your personal information to outside parties without your consent for their direct marketing.

8. Exercising Your Rights

You may submit a privacy rights request by emailing [email protected] or through any request mechanisms we make available via the Platform, including, where applicable, cookie preference or privacy choice tools. We may need to verify your identity before processing your request and may request additional information for that purpose, including by using third-party service providers that assist with identity verification. Authorized agents may submit requests on your behalf, subject to verification of the agent's authority and your identity as required by law.

9. Do Not Sell or Share My Personal Information / Opt-Out Rights

California residents may opt out of the sale of personal information or sharing of personal information for cross-context behavioral advertising by using any "Do Not Sell or Share My Personal Information" link, cookie preference center, or other privacy choice mechanism we make available on the Platform, or by contacting [email protected]. Where required by law, we honor browser-based opt-out preference signals, including Global Privacy Control ("GPC"), as a valid request to opt out of the sale or sharing of personal information.

10. Children's Information

Our Services are not directed to children under 16 years of age, and we do not knowingly collect personal information from children under 16. We do not knowingly sell or share the personal information of consumers under 16 years of age.

11. Contact Information