HeyDoWhat Privacy Policy

Publication Date: September 9, 2026 Last Updated: September 9, 2026

Contents

1. About This Privacy Policy

HeyDoWhat LLC, a Wyoming limited liability company ("HeyDoWhat," "HDW," "we," "us," or "our"), provides a technology platform through which people may discover, purchase, book, join queues or waitlists for, and redeem products, services, events, experiences, and other offerings made available by independent merchants (the "Platform").

This Privacy Policy explains how HDW collects, uses, discloses, retains, and otherwise processes personal information in connection with the Platform. It also explains the privacy rights and choices that may be available to you.

This Privacy Policy covers processing for features that HDW currently makes available and for specifically described features that HDW may activate while this Privacy Policy remains current. A description of a planned or conditional feature does not mean that the feature is available, does not authorize HDW to collect information before the relevant feature or collection point is enabled, and does not replace any just-in-time notice, affirmative agreement, opt-in, or consent required by applicable law. Section 20.1 explains when activation of a described feature can occur without republishing this Privacy Policy and when a further update or notice is required.

This Privacy Policy applies to:

• visitors to the Platform;
• registered consumers and prospective consumers;
• merchants and their owners, personnel, and authorized representatives;
• people whom a merchant adds to a queue or waitlist as walk-in guests, even if they do not have an HDW account;
• guests or attendees whose information is provided by an account holder in connection with a booking, purchase, redemption, or queue entry;
• people who send HDW text messages, support inquiries, privacy requests, security reports, copyright notices, or other communications; and
• any other person whose personal information HDW processes in connection with the Platform.

This Privacy Policy does not govern information that an independent merchant collects or processes outside the Platform for the merchant's own purposes, information processed by a third-party website or service under that party's own privacy notice, or HDW's processing of employee or job-applicant information.

HDW generally determines the purposes and means of the processing described in this Privacy Policy. In some circumstances, another party—such as a merchant, payment processor, telecommunications carrier, or other independently operated service—determines its own purposes and means of processing and is responsible for its own privacy practices.

This Privacy Policy is a notice of HDW's data practices. It is not a request for consent and is not, by itself, a contract. The HeyDoWhat Terms of Service and any applicable supplemental terms govern use of the Platform. Where HDW relies on consent or affirmative agreement for a particular activity, HDW presents that request separately or at the relevant point of collection. Any applicable dispute-resolution terms govern only to the extent they validly bind the person and claim. This Privacy Policy does not itself impose arbitration or limit a nonwaivable privacy right or regulatory complaint.

2. Key Terms

Terms defined in this Section govern this Privacy Policy only. A definition in this Section does not alter the meaning of the same term in any other HDW agreement, policy, or supplemental term. Section 1 states the people and activities to which this Privacy Policy applies, and Section 1 is not limited by any definition in this Section.

2.1 "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identified or identifiable person or household. It includes equivalent terms such as "personal data" where applicable law uses those terms.

2.2 "Aggregate Information" means information relating to a group or category of people, transactions, merchants, or activities that is not reasonably linkable to a particular person or household.

2.3 "Deidentified Information" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular person or household. Whenever HDW represents information as Deidentified Information, the safeguards and restrictions in Section 10 apply.

2.4 "Platform" means the HeyDoWhat website, web application, Merchant Dashboard, and any other digital property, application, or service operated by HDW that links to or incorporates this Privacy Policy, including any mobile application HDW may make available.

2.5 "Services" means the products, features, content, tools, and services made available through the Platform.

2.6 "User" means an individual who accesses or uses the Platform as a consumer, including as a visitor, registered account holder, purchaser, queue participant, or redeemer of a Merchant Offering. As used in this Privacy Policy, "User" is scoped to individual consumers for data-protection purposes.

2.7 "Merchant" means an independent business, venue, host, organizer, instructor, operator, or other provider that offers or fulfills a product, service, event, experience, reservation, voucher, admission, or other offering through the Platform. HDW is not a Merchant and does not operate, control, or fulfill any Merchant Offering.

2.8 "Merchant Offering" means any product, service, event, experience, reservation, admission, voucher, class, tour, or other offering made available by a Merchant through the Platform.

2.9 "Merchant Dashboard" means the administrative interface through which a Merchant and its authorized personnel access and manage the Merchant's account, listings, queues, redemptions, and related Platform functions.

2.10 "Redemption Credential" means a QR code, barcode, alphanumeric or numeric code, confirmation code, digital ticket, token, confirmation link, or other credential issued or made available through the Platform to evidence, access, validate, or process a User's entitlement to receive a specific Merchant Offering.

2.11 "Wallet" means the closed-loop balance record maintained for a User's account within the Platform, comprising In-App Credits and Reward Points.

2.12 "In-App Credits" and "Reward Points" mean the respective Wallet categories identified in the Terms of Service and applicable supplemental or program terms. In this Privacy Policy, those terms are used only to identify associated Personal Information and records; the Terms of Service and applicable supplemental or program terms govern their legal character, issuance, use, ordering, transferability, expiration, forfeiture, refunds, cash-redemption rights, and other consumer rights.

2.13 "Service Provider" means a vendor or other party that processes information for HDW to perform a business, technical, professional, or operational function. Some recipients may act as independent businesses or controllers for some processing rather than solely as HDW's Service Providers.

2.14 "Processing" means any operation performed on Personal Information, whether automated or manual, including collection, recording, organization, storage, use, analysis, disclosure, transfer, restriction, deletion, or destruction.

2.15 "Sell," "Sale," "Share," and "Sharing" have the meanings assigned to them by the U.S. state privacy law applicable to the relevant person and processing activity. Depending on the law, a Sale may include a disclosure for monetary or other valuable consideration, and Sharing may include a disclosure for cross-context behavioral advertising.

Personal Information does not include Aggregate Information or Deidentified Information where applicable law excludes such information from its scope.

3. Personal Information We Collect and Its Sources

The table below describes the categories of Personal Information HDW has collected during the preceding twelve months, or since HDW began the relevant processing if that period is shorter, and expects to collect while this Privacy Policy remains current. Whether HDW collects a particular item depends on how you interact with the Platform and which features are available.

3.1 Information About Other People

If you provide information about another person, such as an attendee or guest, you must be authorized to do so and should provide only information reasonably necessary for the relevant booking, queue entry, or transaction. Merchants may provide HDW with a walk-in guest's name and party size to operate a queue. A walk-in guest is not required to have an HDW account for this limited processing.

3.2 Public Merchant and Review Information

A Merchant signup, draft workspace, submitted agreement package, approval decision, activation decision, and publication decision are separate stages. Creating or submitting a Merchant account does not itself make the Merchant, its locations, or its listings public. If and when HDW separately activates and publishes a Merchant, the Merchant profile, venue and listing information, listing images, offering details, prices, dates, availability, and other information designated for publication are intended for public display. If HDW makes a review available publicly, the rating, review text, and abbreviated reviewer display name may be visible to Platform visitors and may be copied or indexed outside HDW's control. Do not include information in a field designated for public display that you do not want made public.

3.3 Optional Fulfillment Notes

If HDW makes an optional fulfillment-note feature available for a selected Merchant Offering and you choose to use it, HDW collects the content you submit for that Booking. HDW may make the note available only to the applicable Merchant's authorized personnel, only for ordinary fulfillment, and only after the supported authenticated verification flow binds the exact Merchant and Booking. The note is not encoded in the QR code or other Redemption Credential. Merchant-facing access automatically ends at the earlier of (a) 11:59:59 p.m. in the Merchant location's local time on the calendar day of that verified scan or (b) cancellation, refund, void, reversal, or invalidation of the Booking, Redemption Credential, or Merchant access. After that cutoff, the note is not available through the ordinary Merchant interface. This Merchant display window does not shorten HDW's separate, restricted retention of the authoritative Booking record under Section 13.

Do not use a fulfillment note to provide health, allergy, medical, disability, accessibility, safety, emergency, government-identification, financial-account-credential, or other sensitive information. Contact the Merchant directly through an appropriate method before the Merchant Offering begins about an allergy, accessibility need, health or safety concern, or other information that may require a response; use emergency services for an emergency. An optional fulfillment note is not a medical-accommodation, emergency, or guaranteed communication system, and HDW does not represent that a Merchant will receive, monitor, or act on a note before fulfillment.

4. How We Use Personal Information

HDW uses Personal Information for the following purposes, as reasonably necessary and proportionate to the relevant activity:

4.1 Provide and Operate the Platform

HDW uses Personal Information to create and secure accounts; authenticate users; maintain profiles and preferences; present Merchant offerings; operate search, discovery, favorites, calendars, and account features; provide AI-assisted responses; process bookings and purchases; issue and validate redemption credentials; operate queues and waitlists; provide wallet, coupon, referral, promotion, and rewards functionality, including In-App Credits and Reward Points; and otherwise provide requested Platform features. If and when HDW enables individualized discovery or promoted-placement features described in Sections 5.2 and 11, HDW also uses eligible first-party activity to personalize and rank the applicable results and placements.

4.2 Process Transactions and Support Fulfillment

HDW uses transaction and payment-related information to create and administer bookings and orders; coordinate fulfillment with the relevant Merchant; authorize, capture, reconcile, refund, or dispute payments through payment providers; calculate amounts; maintain wallet and ledger records; administer cancellations, no-shows, expirations, and redemptions; prevent duplicate or unauthorized use; and resolve transaction or fulfillment disputes.

4.3 Operate Queues, Waitlists, and Messaging

HDW uses queue and messaging information to place and maintain parties in line; calculate and display positions and estimated waits; send requested queue, verification, security, booking, redemption, wallet, refund, and other operational messages; process replies and feature commands; record consent and revocation; honor suppression preferences; support Merchant queue operations; monitor message delivery; correct queue records; and enforce the Queue Terms and SMS / Text Messaging Terms.

4.4 Verify Phones and Administer Benefits

HDW uses mobile numbers, verification status, prior benefit claims, account and transaction information, and related fraud signals to verify control of a number; protect accounts; determine eligibility for phone-dependent features; prevent repeat, duplicate, transferred, or abusive claims to new-user, referral, coupon, promotion, or other limited benefits; administer those benefits; and maintain evidence necessary to resolve disputes or demonstrate compliance.

4.5 Communicate

HDW uses contact and communication information to send transactional, account, security, operational, policy, and service messages; respond to support, privacy, safety, security, and legal inquiries; administer surveys and promotions; and, where permitted, send marketing communications. Marketing text messages require a separate opt-in as described in Section 7. Marketing email may be stopped using the unsubscribe method in the message or by contacting HDW.

4.6 Protect the Platform and Enforce Rules

HDW uses Personal Information to authenticate access; detect, investigate, prevent, and respond to fraud, account compromise, payment abuse, queue manipulation, bots, no-show patterns, coupon or referral abuse, unauthorized redemption, violations of Platform terms, security incidents, harmful conduct, and unlawful activity; maintain audit and compliance evidence; protect people, property, rights, and the Platform; and request or provide human review where described in this Privacy Policy.

4.7 Measure, Develop, and Improve

HDW uses eligible Platform activity and outcomes to understand service performance; measure demand and fulfillment; troubleshoot errors; test and evaluate search, retrieval, ranking, prompts, recommendation logic, wait estimates, and business rules; compare feature or system versions; improve relevance, reliability, safety, accessibility, and user experience; develop new features; and conduct research and planning.

For these purposes, HDW uses structured, eligible signals such as listing impressions and selections, favorites, bookings, cancellations, refunds, redemptions, rating values, and queue outcomes. HDW excludes information that it knows or reasonably should know is sensitive. HDW does not use fulfillment notes for analytics, profiling, recommendation improvement, AI training, advertising, promoted placement, or commercial insights. HDW does not use AI prompts or responses, search text, support or SMS content, or free-form review text for recommendation improvement unless HDW first implements a separate legal, privacy, and technical review; appropriate notice and controls; and any consent required by law. This improvement activity does not require training an AI provider's general-purpose foundation model.

4.8 Create Aggregate and Deidentified Commercial Insights

Subject to the restrictions in Section 10, HDW may use eligible Platform activity and Merchant-performance information internally to create Aggregate Information and Deidentified Information and to develop market intelligence, research, benchmarks, trend and performance reports, standardized insights, tools, conclusions, and customized strategic or data-consulting deliverables. HDW may commercially offer only those resulting outputs—not the underlying Aggregate Information, Deidentified Information, or user-level data—to Merchants, brands, businesses, professional advisers, and other customers.

4.9 Comply With Law and Protect Legal Rights

HDW uses Personal Information to comply with applicable law, legal process, tax and accounting requirements, payment-network rules, telecommunications requirements, sanctions or compliance obligations applicable to HDW's activities, and lawful requests; administer copyright notices and counter-notices; establish, exercise, or defend legal claims; enforce agreements and policies; and cooperate with authorities where legally required or permitted.

4.10 Corporate and Administrative Purposes

HDW uses Personal Information for internal administration, governance, audits, accounting, financing, insurance, professional advice, corporate transactions, and business continuity.

5. AI-Assisted Features and Recommendation Development

5.1 Runtime AI Processing

When you use an AI-assisted feature, HDW processes your current request and may process a limited portion of the current-session conversation, relevant Platform listing information, and the generated response. HDW sends that information to AI model and infrastructure providers to produce the requested response. HDW may also use ordinary security, rate-limit, troubleshooting, and non-content usage metadata associated with the request. HDW's current runtime AI API provider is OpenAI.

HDW also uses functional provider categories because the particular AI model, model version, or infrastructure provider may change. Under OpenAI's current API data practices, API inputs and outputs are not used to train or improve OpenAI's models unless HDW affirmatively opts in. HDW does not opt in to that use. HDW configures the current Responses API integration with application-state storage disabled. OpenAI may nevertheless retain prompts, responses, and related metadata in abuse-monitoring logs for up to thirty days by default, and may retain or process information longer where required for security, abuse prevention, legal compliance, or other permitted provider purposes. HDW has not represented that its current OpenAI account has Zero Data Retention or Modified Abuse Monitoring approval.

HDW does not control a provider's internal operations and relies on applicable provider terms, selected settings, and law. HDW may change models or providers without republishing this Privacy Policy when the categories of information, purposes, recipient category, retention posture, and user protections remain materially consistent with this Section. Before HDW selects or configures a provider to use HDW API inputs or outputs to train or improve that provider's general-purpose models, or otherwise makes a materially different use or disclosure of AI interaction content, HDW will update the applicable notice before the change and obtain consent where applicable law requires it.

5.2 AI Text Retention and Individualized Personalization

HDW does not persist AI request or response text after transient processing in an HDW-controlled account history, database, analytics record, memory, embedding, application log, or error-monitoring system. HDW does not reuse prior AI conversations across sessions.

If and when HDW enables individualized discovery, recommendation, or promoted-placement features, HDW may build and maintain individualized profiles of a person's activity on the Platform and use them to personalize and rank results, recommendations, and promoted placements presented to that person. These profiles may be derived from the structured Platform activity described in Section 3, including listing impressions and selections, searches recorded as non-content events, favorites, bookings, cancellations, redemptions, queue outcomes, and ratings, together with account, preference, and location-preference information a person provides. These profiles are not derived from the free-text categories identified in Section 4.7, and Section 4.7 continues to govern any use of those categories.

When this processing is enabled, HDW uses only first-party activity occurring on the Platform for this purpose. HDW does not use a person's activity across nonaffiliated websites or applications to personalize recommendations or promoted placements.

If optional first-party analytics is enabled, HDW may retain limited non-content interaction information, such as that a message was sent, the message's character count, whether a fallback occurred, the number of results, and whether a result was selected. HDW's first-party analytics does not retain the text of the search or AI prompt.

HDW does not use AI request or response text to train or fine-tune an HDW model.

HDW may later offer persistent AI conversation history or develop HDW-controlled models using eligible Platform interaction data. Section 5.4 describes the separate activation rules for persistent history, saved preferences, and memory. Before HDW persists AI request or response text in an HDW-controlled system, or uses that text to train or fine-tune an HDW model, HDW will update the applicable notice before collection or use, apply the change only to text generated after the effective date of that notice, and obtain any consent applicable law requires. Health, allergy, medical, precise-location, minor-related, and other sensitive information will not be persisted or used for training without the separate legal and technical review and controls described in Section 5.4.

5.3 Structured Service and Recommendation Improvement

HDW may use eligible structured Platform activity and outcomes to develop, test, evaluate, and improve retrieval filters, ranking weights, prompts, evaluation sets, recommendation logic, wait estimates, and business rules. HDW excludes information that it knows or reasonably should know is sensitive and excludes the free-text categories identified in Section 4.7. HDW may later develop an HDW-controlled ranking or recommendation model from eligible structured outcome data, provided the use remains consistent with this Privacy Policy, applicable law, and the sensitive-data and commercial-insight restrictions stated here.

5.4 Optional Future Chat History, Saved Preferences, or Memory

If HDW later offers persistent chat history, saved instructions, non-sensitive saved preferences, or cross-session memory and you choose to enable the feature, HDW will present a just-in-time explanation of what will be saved, how it will be used, and the available controls before activation. HDW will not persist or reuse a transcript, saved preference, or memory across sessions until you affirmatively enable the feature. HDW will obtain any additional consent required by applicable law and will provide appropriate means to view, correct, delete, or disable saved information.

HDW will not treat this Section as authorization to retroactively create memory from conversations that HDW did not retain for that purpose. Health, allergy, medical, precise-location, minor-related, or other sensitive memory will not be enabled without a separate legal and technical review, any notice or consent required by law, and appropriate deletion and security controls.

5.5 AI Limitations

AI-generated responses may be inaccurate or incomplete. HDW validates listing identifiers before displaying recommended listings, but users should confirm current listing, availability, price, restriction, and transaction information through the authoritative Platform interface and applicable Merchant.

6. Sensitive Information and Free-Text Fields

HDW's AI, search, fulfillment-note, queue-reply, support, and other general free-text features are not designed to collect medical, allergy, health, biometric, government-identification, financial-account credential, precise-location, emergency, or similarly sensitive information. Do not submit such information through a general free-text field.

A warning does not guarantee that a person will comply. If a person disregards the warning and includes sensitive information in a fulfillment note, HDW may receive, store, and disclose that content to the applicable Merchant through the restricted fulfillment flow before HDW can identify it. HDW does not use fulfillment-note content for analytics, profiling, recommendation improvement, AI training, advertising, promoted placement, or commercial insights. The processing remains subject to the access, purpose, retention, deletion, and security limits in this Privacy Policy and the applicable Merchant agreement.

If you voluntarily include health or other sensitive information in a current AI request, the information is processed by the AI model and infrastructure provider to generate the current response. HDW does not persist that request or the resulting response text after transient processing in an HDW-controlled account history, database, analytics record, memory, embedding, application log, error-monitoring system, or individualized recommendation profile, and HDW does not disclose the request to a Merchant.

HDW may retain sensitive information that a person independently includes in a support message, inbound text message, privacy request, security report, legal notice, or other communication where retaining the communication is reasonably necessary to respond, maintain consent or suppression evidence, investigate an issue, protect safety or security, comply with law, or establish or defend legal rights. HDW does not use such incidental sensitive information for targeted advertising, recommendation improvement, or the commercial-insight activities described in Section 10.

Some Merchants offer fitness, wellness, spa, and similar health-related Merchant Offerings. HDW does not offer a persistent allergy or health-profile feature and does not build health or wellness profiles from a User's booking of such a Merchant Offering. In some jurisdictions, even transient receipt, processing, inference, or disclosure of health-related information may be regulated without persistent storage. Before HDW makes a feature available in circumstances in which a consumer-health law applies to that processing, HDW will either configure and limit the feature to avoid the covered processing or implement the separate consumer-health notice, consent, access, deletion, authorization, processor-contract, and security controls required by that law. Before intentionally collecting or retaining consumer health information for a saved health preference, profile, or recommendation purpose, HDW will complete that review and implement the required controls.

7. Phone Numbers, Text Messages, and Other Communications

7.1 Optional Phone at Ordinary Account Creation

A mobile number is optional for ordinary consumer account creation and browsing. If you choose to add a number after receiving the applicable collection-point disclosure, HDW uses it for the account, security, verification, and operational purposes described in that disclosure and in the SMS / Text Messaging Terms.

A verified mobile number is required for an account holder to join a Platform queue and to establish eligibility for certain new-user and referral benefits. A verified number may also be required for another phone-dependent security, coupon, promotion, or account function. HDW will identify the requirement in the relevant workflow.

7.2 Account and Operational Messages

Account & Operational Alerts may include verification and security codes, account messages, queue lifecycle updates, booking and redemption updates, refund or cancellation information, wallet or reward information, and other messages relating to an action you requested or a feature you use. These are separate from marketing text messages.

Before sending automated queue text messages, HDW presents the applicable operational-message disclosure and obtains any authorization or consent required by law. Queue messages are limited to the applicable queue session and related service administration. Message frequency varies based on your activity. Message and data rates may apply.

7.3 Marketing Text Messages

HDW does not enroll you in marketing text messages merely because you create an account, provide a number for an operational purpose, make a purchase, join a queue, acknowledge this Privacy Policy, or agree to contractual Platform terms. If HDW offers marketing text messages, enrollment requires a separate affirmative opt-in after a marketing-specific disclosure. Marketing-text consent is not a condition of purchase.

7.4 Revocation and Suppression

You may revoke text-message consent using the methods described in the SMS / Text Messaging Terms, including by replying STOP to an HDW text message or emailing support@heydowhat.com with the mobile number to be removed. Reply HELP to any HDW text message for assistance. Opting out of text messages does not, by itself, cancel a booking or remove you from a queue. The Platform and SMS / Text Messaging Terms explain any feature-specific consequences.

HDW may retain consent, opt-out, revocation, clarification, re-enrollment, delivery, and suppression records after an opt-out or account closure where reasonably necessary to honor the request, prevent future messages, demonstrate compliance, resolve disputes, prevent fraud or unauthorized use, or protect legal rights.

7.5 Messaging Providers and Carriers

HDW discloses mobile number, message content, routing and template information, provider identifiers, and consent, delivery, and compliance information to cloud communications providers, aggregators, telecommunications carriers, and related vendors as reasonably necessary to transmit and receive messages, process replies, administer consent and suppression, monitor delivery, protect the service, and comply with law.

HDW does not sell or share mobile numbers, SMS opt-in data, SMS consent records, or SMS message-originator data with third parties or affiliates for their own marketing or promotional purposes. Text-message originator opt-in data and consent records are excluded from every category of information sharing described in this Privacy Policy. HDW does not share that information with any third party for any purpose other than the message-transmission, consent-administration, suppression, delivery-monitoring, service-protection, and legal-compliance functions described in the preceding paragraph, or as required by law.

For complete HDW text-message program terms, including supported commands, frequency, revocation, re-enrollment, number-reassignment responsibilities, and delivery limitations, see the SMS / Text Messaging Terms.

8. Queue and Waitlist Information

8.1 Remote Queue Entries

When an account holder joins a participating Merchant's queue remotely, HDW processes the account and queue information described in Section 3, including the display name, verified mobile number, party size, Merchant and location, queue line, code, estimated wait, position, status, operational timestamps, cancellation or no-show history, rejoin and cure information, and integrity or suspension indicators.

8.2 Merchant-Entered Walk-Ins

A Merchant may add a walk-in guest to the same queue by providing a name and party size. HDW generates the queue code, status, position, and operational event history. HDW's walk-in workflow does not require an HDW account or phone number. The Merchant is the source of this information and is responsible for having authority to provide it.

8.3 Information Available to the Merchant

The relevant Merchant and its authorized personnel receive queue information reasonably necessary to operate the line, including the display name, party size, queue code, source, status, arrival state, operational timestamps, and, for a remote entry where available, the last four digits of the mobile number. Merchant access is limited by role and operational need, but the Merchant may independently process information it lawfully collects outside HDW's Platform under its own privacy practices.

8.4 Device-Side Location Comparison

If you grant location permission when joining a queue, your browser may obtain your device's coordinates and compare them on the device with the participating venue's coordinates to display a one-time distance or travel-time warning. The precise device coordinates used for this queue comparison are not transmitted to or stored by HDW. Declining location permission does not prevent you from joining the queue.

This limited device-side comparison does not prevent a browser, operating system, network provider, hosting provider, or security service from processing ordinary technical or network information under its own operation or applicable notice.

8.5 Queue Integrity and Review

HDW systems use queue status and event history to calculate estimated waits, identify cancellation, rejoin, cure, no-show, fraud, and abuse patterns, and apply the no-show and suspension rules published in the Queue Terms. An automated queue restriction affects queue participation and does not, by itself, determine eligibility for unrelated Platform transactions or legal rights.

If you believe a queue event, no-show, cure outcome, or restriction is inaccurate, you may request review by contacting support@heydowhat.com and providing enough information to locate the entry. HDW will review available Platform records and information supplied by the user and Merchant and correct the record where appropriate. Additional operational rules are in the Queue Terms.

9. How and With Whom We Disclose Personal Information

HDW discloses Personal Information only as described below, at your direction, or as otherwise permitted or required by law.

9.1 Merchants and Their Authorized Personnel

HDW discloses information to the applicable Merchant and authorized staff where reasonably necessary to manage or fulfill a booking, purchase, queue entry, check-in, redemption, refund, cancellation, dispute, or support matter. Depending on the activity, this may include purchaser or attendee name; party size; offering, date, session, and status; redemption credential and history; queue information described in Section 8; transaction and refund information; and optional transaction-related content you direct HDW to provide. An optional fulfillment note is available only through the restricted Merchant-and-Booking-bound flow and Merchant display window described in Section 3.3 and is not encoded in the Redemption Credential.

Merchants do not receive complete payment-card credentials from HDW. HDW does not disclose an AI-chat prompt, general account history, or unrelated Platform activity to a Merchant merely because the user views or purchases that Merchant's offering.

A Merchant acts as an independent business or controller to the extent it determines the purposes and means of its own lawful processing. Its role and responsibilities for particular information depend on the actual processing and applicable law; receipt through the Merchant Dashboard alone does not determine that role. The Merchant's obligations to HDW with respect to that information, including permitted purposes, restrictions on further use and disclosure, security, and cooperation with rights requests, are set out in the Merchant Partner Agreement. A Merchant's own use of information it has received is governed by that agreement, the Merchant's own privacy notice, and applicable law. Optional fulfillment notes are subject to narrower purpose, time-limited access, no-copy, no-export, and no-unrelated-retention restrictions under that agreement. The note itself is not a lawful independent Merchant record under HDW's agreement. Other information a Merchant lawfully maintains independently may remain in the Merchant's systems after HDW deletes its copy; Section 15.6 describes the effect on deletion requests.

9.2 Payment, Billing, and Financial-Operations Providers

HDW discloses transaction, account, Merchant, and payment-related information to payment processors, billing providers, fraud-prevention services, payment networks, financial institutions, and connected-account providers as reasonably necessary to process payments and refunds, administer subscriptions or payouts, prevent fraud, resolve disputes and chargebacks, and comply with payment or financial requirements. These providers may process certain information for their own compliance, security, and service purposes under their own privacy notices. HDW's current payment, payout, and connected-account provider is Stripe, Inc., which processes information as described in the Stripe Privacy Policy at https://stripe.com/privacy. HDW may change or add providers and will update this Privacy Policy accordingly.

9.3 AI Model and Infrastructure Providers

HDW discloses AI interaction content, limited current-session context, relevant listing information, and generated outputs to AI model and infrastructure providers as described in Section 5.

9.4 Hosting, Authentication, Storage, Communications, and Operational Providers

HDW discloses Personal Information to vendors that provide hosting, database, authentication, storage, content delivery, email, SMS and telecommunications, security, fraud prevention, customer support, analytics infrastructure, error monitoring, document management, and other technical or operational functions.

9.5 Professional Advisers

HDW may disclose Personal Information to attorneys, accountants, auditors, insurers, consultants, and other professional advisers where reasonably necessary for advice, compliance, claims, audits, financing, insurance, or business administration.

9.6 Legal, Safety, Security, and Enforcement Recipients

HDW may disclose Personal Information to courts, regulators, law-enforcement agencies, government authorities, affected parties, payment networks, carriers, or contracted incident-response, forensic, and security specialists subject to confidentiality and data-minimization obligations where HDW reasonably believes disclosure is necessary to comply with law or legal process; investigate or prevent fraud, abuse, security incidents, or unlawful conduct; protect people, property, rights, or the Platform; enforce agreements or policies; or establish, exercise, or defend legal claims.

9.7 Corporate Transactions

HDW may disclose or transfer Personal Information in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, corporate due diligence, or similar transaction, subject to appropriate confidentiality and applicable law. A transfer of Personal Information as an asset in such a transaction, where the recipient assumes control of all or part of HDW's business and continues to use the information in a manner consistent with this Privacy Policy, is not a Sale or Sharing under applicable law.

9.8 Public and User-Directed Disclosures

HDW discloses information you direct it to disclose, information you submit for public display, and information necessary to complete an interaction you initiate with a third-party link or service. A third party's later processing is governed by that party's privacy practices.

9.9 Third-Party Websites, Links, and Services

The Platform may contain links or references to websites, applications, or services operated by others, including Merchant websites, mapping and directions services, social media services, and payment interfaces. Including a link or reference is not an endorsement of the linked party or its practices.

This Privacy Policy does not govern a third party's independent collection or use of Personal Information. If you follow a link, use an embedded third-party feature, or provide information directly to a third party, that party's own privacy notice and terms apply to its independent processing. Review the applicable privacy notice before providing Personal Information to a third party. This does not remove HDW's responsibility for its own processing or disclosures, or its applicable duties concerning Service Providers.

Some Service Providers integrated into the Platform act as independent controllers for some of their own processing rather than solely as HDW's Service Providers. Where HDW is aware that a provider processes Personal Information as an independent controller in connection with the Platform, HDW identifies that provider in this Privacy Policy and directs you to that provider's privacy notice, as HDW does for its payment provider in Section 9.2.

Content you submit for public display, including reviews, ratings, and images, may be visible to Platform visitors and may be indexed or copied by search engines and other services outside HDW's control, as described in Section 3.2.

10. Aggregate and Deidentified Information; Commercial Insights

HDW may create, retain, and use Aggregate Information and Deidentified Information internally for research, analytics, forecasting, market intelligence, benchmarking, trend and performance reports, product development, standardized insights, tools, and customized strategic or data-consulting services. HDW may commercially offer only the resulting reports, benchmarks, tools, conclusions, and advice.

Under HDW's current commercial-insight design, the commercial product is the resulting insight—not a dataset. HDW currently does not sell, license, provide, expose, or permit a commercial-insight or consulting customer to query:

• directly identifiable Personal Information;
• pseudonymous user-level information;
• raw or row-level analytics events;
• raw or transaction-level booking, payment, redemption, queue, or Merchant-performance records;
• search text, AI prompts, AI conversation transcripts, fulfillment notes, support messages, or inbound SMS content;
• Aggregate Information or Deidentified Information as a dataset, row-level export, query tool, reconstruction tool, or customer-queryable data product; or
• any other identifiable, pseudonymous, or user-level dataset.

HDW excludes information that it knows or reasonably should know is health, allergy, medical, minor-related, precise device-location, private-communication, raw messaging, or account-level fraud or abuse information from the source data used for commercial-insight outputs and from the outputs themselves. Merchant-specific confidential information is used or disclosed only as authorized by the applicable Merchant agreement, applicable notice, or law.

Whenever HDW represents information as Deidentified Information or includes deidentified statistics in a commercial output, HDW maintains technical, organizational, and contractual measures designed to prevent the information from being used to identify a person or household. These measures include reasonable aggregation thresholds or other controls against singling out or reconstructing a person's activity, restrictions on raw and row-level exports or customer querying, and review of the finished output. HDW publicly commits to maintain and use that information in deidentified form and not to attempt reidentification except as permitted by law to test whether its deidentification safeguards are effective. Where HDW provides deidentified statistics to a recipient, HDW contractually requires the recipient to comply with the applicable legal requirements for deidentified information, maintain and use the statistics in deidentified form, and not attempt reidentification or combine them to identify a person or household.

Aggregate Information and Deidentified Information are not linked to an identifiable account and therefore ordinarily cannot be accessed, corrected, or deleted through an account-level privacy request. Personal Information used as source data remains subject to applicable privacy rights and retention rules.

11. Sale, Sharing, Targeted Advertising, and Promoted Placements

Under HDW's practices as of the Last Updated date, HDW does not Sell Personal Information, Share Personal Information for cross-context behavioral advertising, or use third-party advertising pixels or cookies to serve targeted advertising based on activity across unaffiliated services. HDW does not provide mobile information to third parties or affiliates for their own marketing or promotional purposes.

If and when HDW offers Merchants paid promoted placement, promoted placements will appear only in designated advertising surfaces and will be identified as promoted. If individualized placement is enabled, HDW may use the individualized activity profiles described in Section 5.2 to determine which promoted placements are presented to a person.

Under HDW's current promoted-placement design, a Merchant or other advertiser does not receive the underlying individualized activity profile, identifiable Platform activity, or row-level event data used to select a promoted placement. HDW may provide a promoting party aggregate or deidentified campaign reporting that satisfies Section 10.

Paid consideration does not influence HDW's AI-assisted recommendations or organic ranking. No payment, promotion, campaign, boost, placement fee, or other consideration from a Merchant affects the ranking, ordering, scoring, or selection of listings presented through HDW's AI recommendation and discovery ranking features.

Under HDW's current promoted-placement design, any promoted-placement personalization uses only first-party activity occurring on the Platform. Because that design does not rely on a person's activity over time across nonaffiliated websites or applications, it is not targeted advertising within the meaning of applicable state consumer privacy statutes, and HDW does not currently disclose Personal Information to a Merchant, advertising network, data broker, or other third party for that party's own advertising purposes.

HDW's creation and internal use of Aggregate Information and Deidentified Information, and its commercial offering of only the resulting outputs, under Section 10 is not a Sale or Sharing of Personal Information. HDW's use of first-party activity to operate or improve its own Platform is also distinct from disclosing Personal Information for cross-context behavioral advertising.

This Section describes HDW's practices as of the Last Updated date; it is not a promise that HDW's business or technology will never change. Before implementing a materially different advertising or data practice, including a practice that constitutes a Sale, Sharing, cross-context behavioral advertising, or a materially different disclosure to an advertiser, HDW will update the applicable notice before the change and provide any choice, opt-out mechanism, preference-signal treatment, or consent required by applicable law. Section 20.1 governs material changes and does not authorize retroactive use that applicable law prohibits.

12. Cookies, Browser Storage, Analytics Choices, and Global Privacy Control

HDW uses cookies, local storage, session storage, and similar first-party technologies for:

• authentication, security, session continuity, legal-document and consent state, and other functions necessary to provide the Platform;
• remembering a user's cookie choice and limited local feature state; and
• optional first-party analytics used to understand Platform performance and interaction patterns.

HDW's optional analytics uses a randomly generated browser identifier stored in local storage and a visit identifier stored in session storage. When a person later signs in, analytics events may be associated with the authenticated account. Optional analytics may include event name, page path, timestamp, device class, and limited non-content properties such as listing or location identifier, character count, source, category, and result count. It does not store search or AI-prompt text, or Internet Protocol address or user-agent information in the analytics event row.

HDW does not send optional analytics events when the cookie choice is unset or set to essential-only, or when the browser asserts Global Privacy Control ("GPC"). When GPC is detected, the Platform records an essential-only choice for that browser. HDW also processes GPC and other legally recognized opt-out preference signals as required by applicable law.

Some browsers offer a "Do Not Track" setting. No common industry or technical standard governs how that signal should be interpreted, and the Platform does not respond to it. HDW does honor Global Privacy Control and other opt-out preference signals that applicable law requires businesses to recognize, as described above. Under HDW's practices as of the Last Updated date, HDW does not permit a third party to collect Personal Information through the Platform about a person's activities over time and across unaffiliated websites or applications.

You may select "Essential only" or "Allow optional analytics" through the cookie banner. You may also clear local or session storage through your browser. Clearing required storage or blocking required technologies may sign you out or impair Platform functions. For additional information, see the Cookie Policy.

13. Retention

HDW retains Personal Information for no longer than reasonably necessary for the purposes described in this Privacy Policy, subject to applicable legal, accounting, tax, payment, telecommunications, security, fraud-prevention, dispute, and recordkeeping requirements. The applicable period depends on the category, sensitivity, context, and purpose of the information and the existence of a legal hold or active matter.

HDW applies the following criteria:

• Account, profile, and authentication information: while the account is active and afterward for a reasonable period needed to complete closure, prevent fraud or re-registration abuse, maintain security and legal-document evidence, resolve disputes, and comply with law.
• Bookings, orders, payments, refunds, redemptions, wallet, coupon, referral, promotion, and rewards records: for the periods needed to administer the transaction or balance; satisfy payment-network, chargeback, accounting, audit, tax, consumer-protection, unclaimed-property, and limitation-period requirements; prevent duplicate benefits and fraud; and resolve claims.
• Optional fulfillment notes: Merchant-facing access ends under the end-of-local-day or earlier cutoff in Section 3.3. HDW separately retains the encrypted note content as part of the restricted authoritative Booking record for seven years after the Booking's fulfillment, cancellation, expiration, refund completion, or other terminal disposition. During that period, HDW restricts note-content access to authorized personnel with a documented, case-specific support, dispute, chargeback, security, legal, or privacy-rights need and does not return the content to ordinary Merchant or Consumer interfaces. If a related support matter, claim, dispute, chargeback, investigation, enforcement matter, legal hold, or mandatory preservation duty remains open when that seven-year period ends, HDW retains only the affected record until final resolution and completion of the applicable preservation period. After the applicable period, HDW securely deletes or renders the note content irreversibly inaccessible. The non-content hash, submission and deletion records, access events, and related security, dispute, and legal-hold evidence follow the retention periods applicable to those records.
• Merchant, listing, staff, billing, and onboarding records: while the Merchant relationship or listing is active and afterward as needed for transaction support, payout or billing administration, audits, compliance, disputes, fraud prevention, and legal obligations.
• Queue and waitlist records: while reasonably necessary to operate and audit the service, calculate and improve estimates, resolve entry, cure, or no-show disputes, enforce the Queue Terms, protect queue integrity and security, and comply with law. When those purposes no longer require identifiable queue information, HDW deletes, aggregates, or deidentifies it, or restricts it from ordinary use where a recognized legal exception supports continued retention.
• SMS and communications records: consent, opt-in, opt-out, revocation, suppression, message, delivery, and related records are retained as needed to deliver requested messages, honor preferences and suppression, demonstrate compliance, resolve complaints, prevent unauthorized use, and protect legal rights.
• First-party analytics and browser identifiers: while reasonably useful for consented product measurement, attribution, security, and improvement, after which HDW deletes, aggregates, or deidentifies the records. Browser-stored identifiers remain on the device until cleared, replaced, or removed through the applicable browser or Platform control.
• AI interaction information: HDW does not persist AI request or response text after transient processing in an HDW-controlled account history, database, analytics record, memory, embedding, application log, or error-monitoring system. The current OpenAI integration disables application-state storage, but OpenAI may retain prompts, responses, and related metadata in default abuse-monitoring logs for up to thirty days and may retain or process information longer for permitted security, abuse-prevention, or legal-compliance purposes. HDW retains limited non-content analytics and security information under the criteria applicable to those categories.
• Reviews and public content: while published or otherwise useful for the purpose submitted, moderation, transaction integrity, and disputes. HDW may retain an abbreviated display-name snapshot or a suppressed review record after account closure where reasonably necessary to preserve transaction and moderation history, subject to applicable rights.
• Support, privacy, security, and legal communications: while necessary to respond, investigate, maintain an audit trail, comply with law, administer copyright or other legal processes, resolve a dispute, or establish, exercise, or defend legal claims.
• Security and technical logs: according to the risk, sensitivity, troubleshooting, investigation, system-integrity, and legal needs associated with the log.
• Derived information, inferences, and individualized activity profiles: while the associated account is active and the derived information remains reasonably useful for the service, security, integrity, personalization, and evaluation purposes described in Sections 4, 5, and 8, and afterward only as reasonably necessary to resolve a dispute, maintain fraud and queue-integrity evidence, or comply with law. HDW deletes, aggregates, or deidentifies derived information when those purposes no longer require it, and deletes or ceases to maintain an individualized activity profile following account closure, except where a recognized legal exception supports continued retention.
• Backups and legal holds: information may remain in backups until ordinary rotation or secure deletion and may be retained for the duration of a legal hold, investigation, litigation, regulatory matter, or other mandatory preservation obligation.

When HDW grants a deletion request, HDW deletes the information or converts it to Aggregate Information or Deidentified Information as appropriate and permitted by law. HDW restricts information from ordinary use only while a request is being verified or completed or when HDW retains the information under a recognized legal exception. Account closure or deletion does not require HDW to delete ledger, tax, financial, transaction, consent, suppression, security, fraud, dispute, public-content, or legal records that HDW is permitted or required to retain. HDW limits retained information to the purposes supporting continued retention.

14. Security and Incident Response

HDW maintains reasonable administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, acquisition, destruction, loss, alteration, use, or disclosure. Safeguards are selected in light of HDW's size and complexity, the nature and scope of its activities, the sensitivity of the information, and reasonably foreseeable risks.

HDW's current technical measures include encryption of Personal Information in transit using Transport Layer Security, encryption at rest provided by HDW's hosting and database infrastructure providers, and access controls applied to application data. Payment-card details are collected and processed through payment-provider-hosted payment fields; HDW does not receive, store, or transmit card numbers or card security codes. HDW's safeguards are reviewed and adjusted as the Platform, its providers, and reasonably foreseeable risks develop.

No method of transmission, storage, or security is completely secure. HDW cannot guarantee that Personal Information will never be accessed, acquired, lost, altered, or disclosed without authorization.

You are responsible for protecting your account credentials, using a unique password, maintaining control of your email address and mobile number, and promptly notifying HDW at support@heydowhat.com with the subject line SECURITY CONCERN if you suspect unauthorized account access or another security concern.

If HDW identifies a security incident involving Personal Information, HDW will investigate and take appropriate containment, remediation, documentation, and notification measures. HDW will notify affected people and governmental or regulatory authorities when and as required by applicable law.

15. Privacy Rights and Choices

15.1 Requests HDW Generally Makes Available

Subject to verification, applicable exceptions, technical feasibility, and disproportionate burden, you may ask HDW to:

• confirm whether HDW processes Personal Information about you;
• provide access to or a portable copy of Personal Information associated with you;
• correct inaccurate Personal Information;
• delete Personal Information associated with you;
• close your account;
• review and correct a queue no-show, suspension, or other consequential queue-integrity record; or
• explain the principal categories of information and processing associated with your account.

HDW may voluntarily honor a request even where a particular privacy statute does not apply. Doing so does not represent that the statute applies to HDW or to the request.

15.2 Rights Under Applicable U.S. State Law

Depending on your state of residence and whether the relevant law applies to HDW and the processing, you may have rights to:

• confirm processing and access Personal Information;
• correct inaccuracies;
• delete Personal Information;
• obtain a portable copy;
• opt out of certain Sales, Sharing, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects;
• limit, consent to, or withdraw consent from certain sensitive-data processing;
• use an authorized agent;
• appeal a denied request; and
• receive nondiscriminatory treatment for exercising a privacy right.

Under HDW's practices as of the Last Updated date, HDW does not Sell or Share Personal Information or process it for third-party targeted advertising as described in Section 11. HDW will honor additional statutory rights, methods, deadlines, appeal procedures, and authorized-agent rules where they apply.

15.3 Communication and Analytics Choices

• Marketing email: use the unsubscribe link in the message or contact support@heydowhat.com. This does not stop transactional, security, or account communications.
• Text messages: use the methods in Section 7 and the SMS / Text Messaging Terms. Text opt-out does not erase consent and suppression evidence that HDW is permitted to retain.
• Optional analytics: choose "Essential only," use a browser that sends GPC, or clear the applicable browser storage.
• Consent-dependent processing: where HDW relies on consent, you may withdraw consent through the applicable feature control or by contacting HDW. Withdrawal does not make prior processing unlawful and may prevent HDW from providing the feature that requires the information.

15.4 How to Submit a Request

Email privacy@heydowhat.com with the subject line PRIVACY REQUEST, or write to the postal address in Section 20. Describe the request and provide the email address, phone number, account information, transaction details, or other information reasonably necessary to locate the relevant records.

A walk-in queue guest who does not have an account may submit a request by identifying the Merchant location, approximate date and time, name used, party size, and queue code if known. HDW will not require an account solely to submit a request concerning a walk-in entry.

To request review of a queue record, use the subject line QUEUE RECORD REVIEW and provide the Merchant, location, date, and queue code if known.

15.5 Verification, Authorized Agents, and Appeals

HDW verifies identity where required or permitted for the particular request, at a level reasonably appropriate to the request and sensitivity of the information. Verification may include confirming control of the account email or mobile number, matching transaction or queue details, or requesting additional information reasonably necessary for that purpose. HDW does not require identity verification for an opt-out request or preference signal where applicable law prohibits it. HDW will not use verification information for unrelated purposes.

Where applicable law permits an authorized agent, HDW may request proof of the agent's authority and may verify the person's identity or instructions directly only to the extent permitted for that request. HDW acknowledges and responds to requests within the timeframes required by the applicable law, measured from the event that law specifies. Verification does not postpone a deadline that runs from receipt. HDW provides notice of any permitted extension and its reason. Where applicable law provides a right to appeal, submit the appeal to privacy@heydowhat.com with the subject line PRIVACY APPEAL. HDW will respond within the period required by applicable law and provide any further complaint information the law requires.

15.6 Exceptions

Privacy rights are subject to exceptions and limitations under applicable law. HDW may retain or decline to delete information where reasonably necessary and legally permitted to complete a transaction; provide a requested service; maintain financial, tax, ledger, consent, suppression, security, fraud, dispute, or legal records; protect against unlawful or abusive activity; exercise or defend legal claims; preserve freedom of expression or public content; comply with law; or maintain Aggregate Information or Deidentified Information.

Where HDW has disclosed Personal Information to a Merchant as described in Section 9.1, deletion by HDW does not delete a copy the Merchant independently retains. On a verified deletion request, HDW will delete or deidentify the information in HDW's systems and will forward the request to the applicable Merchant where required by applicable law or by the Merchant Partner Agreement. The Merchant is responsible for its own records and for its response.

HDW will not discriminate or retaliate against a person for exercising an applicable privacy right. Different functionality may result where information is reasonably necessary to provide a requested feature.

15.7 Automated Processing and Profiling

HDW uses automated processing for the following Platform functions:

• estimating queue position and wait times, as described in Section 8;
• determining no-show, cure, and queue-restriction outcomes, as described in Section 8;
• detecting fraud, abuse, and queue manipulation, as described in Section 4;
• determining eligibility for a promotion, reward, or benefit, including preventing duplicate claims, as described in Section 16; and
• if and when enabled, building individualized activity profiles used to personalize and rank discovery results, recommendations, and promoted placements, as described in Section 5.2.

HDW does not use automated processing to make decisions about credit, insurance, employment, housing, education, or a similar matter, and does not build health or wellness profiles as described in Section 6.

A no-show, queue-restriction, or benefit-eligibility outcome can affect your access to a Merchant offering. If you believe such an outcome is inaccurate, you may request human review under Section 8.5 for a queue record, or by submitting a request under Section 15.4 for any other outcome. HDW will review the underlying records and correct an outcome HDW determines to be inaccurate.

Where applicable law provides a right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, you may exercise that right under Section 15.4. Opting out may limit or prevent access to features that depend on the processing, including queue participation.

16. Promotions, Referrals, Rewards, and Financial Incentives

HDW may offer coupons, referral benefits, Reward Points, promotions, or other benefits associated with an account, verified mobile number, qualifying activity, or program participation. HDW processes account, contact, phone-verification, referral, transaction, eligibility, issuance, redemption, and fraud-prevention information to administer those programs and prevent duplicate or unauthorized claims.

In-App Credits and Reward Points are recorded in the Wallet as described in Section 2. The Terms of Service and any applicable supplemental or program terms—not this Privacy Policy—govern their legal characteristics, including how they are earned, applied, ordered, expired, forfeited, refunded, and redeemed.

Participation in an optional promotion, referral, or rewards program is governed by the disclosures and program terms presented for that program at or before the point of enrollment or issuance, not by this Privacy Policy. Where a program constitutes a financial incentive, or a price or service difference, regulated by applicable privacy law, HDW provides the program-specific notice that law requires — including a description of the material terms, a good-faith explanation of the value of the Personal Information involved and the method used to calculate it, the method of opting in, and instructions for withdrawing — with that program's terms at or before enrollment.

HDW does not use participation in a promotion or rewards program as authorization to Sell Personal Information or Share it for cross-context behavioral advertising.

17. U.S. State-Specific Disclosures

This Section supplements the rest of this Privacy Policy where a U.S. state privacy law applies.

Note on statutory applicability. U.S. state privacy laws differ in their coverage, thresholds, exemptions, and requirements. Whether a particular law applies depends on HDW's actual activities and the person and processing involved. HDW provides the disclosures and generally available requests described in this Privacy Policy and honors additional statutory rights where applicable. This does not represent that every statute applies to HDW or that HDW has elected to be bound by a statute that does not otherwise apply.

For California classification purposes, the categories described in Section 3 may include identifiers; information described in California Civil Code section 1798.80; commercial information; Internet or other electronic-network activity; audio, electronic, visual, or similar information, limited to images and other content submitted for publication or support; geolocation information, including venue or listing locations selected by a user and approximate location inferred from network information where collected; professional or employment-related information relating to Merchant representatives; inferences; and sensitive Personal Information to the limited extent HDW processes account credentials or health information that a person voluntarily includes in a current AI request or another communication. HDW uses such sensitive information only for the service, security, communication, legal, and other limited purposes described in this Privacy Policy and not to infer characteristics for targeted advertising or commercial insights. Sources, business and commercial purposes, and recipient categories are described in Sections 3, 4, and 9. Retention criteria are described in Section 13.

HDW's position concerning Sale, Sharing, targeted advertising, and mobile information is stated in Sections 7 and 11. HDW's rights-request process, including verification, authorized agents where applicable, appeals where applicable, and nondiscrimination, is stated in Section 15. This Privacy Policy and any collection-point disclosure presented for a particular feature provide notice of the relevant collection and use.

California's "Shine the Light" law permits certain residents to request information about disclosures of Personal Information to third parties for those parties' own direct-marketing purposes. HDW does not disclose Personal Information to third parties for their own direct-marketing purposes within the scope of that law.

Nevada residents may submit a verified request to opt out of a covered sale under Nevada law using the process in Section 15. HDW does not currently engage in such covered sales.

Residents of states with comprehensive consumer privacy statutes, including Virginia under the Virginia Consumer Data Protection Act, Colorado under the Colorado Privacy Act, Connecticut under the Connecticut Data Privacy Act, Utah under the Utah Consumer Privacy Act, and Texas under the Texas Data Privacy and Security Act, and residents of other states that have enacted or may enact comparable legislation, may exercise the rights described in Section 15 to the extent the applicable statute applies to HDW and to the relevant processing. HDW addresses these statutes collectively because their core consumer rights are substantially similar. HDW will honor any additional statutory right, method, response deadline, appeal procedure, universal opt-out mechanism, or authorized-agent rule that applies under a particular statute.

For New York residents, HDW maintains administrative, technical, and physical safeguards for private information consistent with the New York SHIELD Act, New York General Business Law section 899-bb, as described in Section 14. If a breach of the security of the system involving the private information of a New York resident occurs, HDW will notify affected residents and will notify the New York State Attorney General, the New York Department of State, and the New York State Division of State Police, in each case in the manner and within the time required by New York General Business Law section 899-aa. Private information under that statute includes medical information and health insurance information.

New York does not currently maintain a comprehensive consumer privacy statute conferring general rights of access, deletion, correction, portability, or opt-out. HDW monitors New York privacy legislation and will update this Section if additional statutory rights applicable to New York residents take effect.

Residents may contact their state attorney general or privacy regulator regarding rights provided by applicable law. Nothing in this Privacy Policy limits a nonwaivable right to make a regulatory complaint.

18. Adult Accounts and Information About Minors

HDW accounts and account-based Platform services are intended for people who are at least eighteen years old. HDW does not ask every visitor to submit a date of birth or government identification and does not represent that ordinary registration independently verifies age.

HDW does not knowingly collect Personal Information from children under thirteen within the meaning of the Children's Online Privacy Protection Act, and the Platform is not directed to children. HDW does not knowingly permit a person under eighteen to maintain an account. If HDW obtains actual knowledge that a particular account holder is under eighteen, HDW will conduct a reasonably prompt review and suspend or close the account, subject to any steps needed to complete or unwind an existing transaction, protect the account holder or another person, preserve evidence, comply with law, or administer a legally required refund or record. HDW will delete or restrict information as appropriate and may retain a limited record where reasonably necessary for safety, fraud prevention, transaction administration, legal compliance, or enforcement.

An adult account holder may include or manage a minor guest in a booking or party where the Merchant offering permits minors. The adult is responsible for managing the booking or queue entry and should provide only the minimum information reasonably necessary for the minor guest. A Merchant may impose independent age, supervision, waiver, or eligibility requirements.

HDW does not direct account-registration marketing or signup benefits to minors. A parent or legal guardian who believes a minor has created an account or that HDW has processed a minor's Personal Information inappropriately may contact privacy@heydowhat.com with the subject line MINOR ACCOUNT REPORT.

19. International Access and Processing

HDW is based in the United States and is initially focused on Merchant offerings and marketplace operations in New York, with additional U.S. markets only where HDW makes offerings available. HDW does not presently market or localize the Platform to people located in the European Economic Area, United Kingdom, or Switzerland.

The Platform may nevertheless be accessible from other jurisdictions. Personal Information may be processed in the United States and in jurisdictions where HDW's Service Providers operate. Those jurisdictions may have data-protection rules different from those of your location.

Whether a privacy law applies depends on HDW's actual activities and that law's territorial rules, including, where applicable, offering services to people in a jurisdiction or monitoring their behavior there. A United States focus or incidental access alone does not settle that question.

HDW will honor rights and implement safeguards required by law where the law applies to HDW's activities. Before intentionally targeting or localizing the Platform to additional international markets, HDW will reassess applicable privacy, representative, cross-border transfer, and related compliance obligations and update its notices and controls as necessary. Before commencing active marketing or sale of the Services to people located in the European Economic Area, the United Kingdom, or Switzerland, HDW will implement a compliance program addressing the applicable requirements, including appointment of any required representative, completion of any required data-protection impact assessment, and implementation of an appropriate cross-border transfer mechanism, and will update this Privacy Policy accordingly.

20. Changes and Contact Information

20.1 Changes to This Privacy Policy

HDW may update this Privacy Policy to reflect changes in law, technology, features, providers, or data practices. HDW will post the updated Privacy Policy and revise the "Last Updated" date. Prior versions of this Privacy Policy are available on request to privacy@heydowhat.com.

HDW may activate a feature already specifically described in this Privacy Policy without republishing the Policy when the feature's actual collection remains within the described categories of Personal Information, the processing remains within the described purposes, the disclosures remain within the described recipient categories, and the stated rights, controls, sensitive-information restrictions, and retention criteria continue to apply. HDW will still present any collection-point disclosure, feature terms, affirmative agreement, opt-in, or consent required for the feature. This paragraph is not blanket consent for an unlaunched feature or a materially different practice.

If a change materially expands the categories of Personal Information collected, the purposes for which information is processed, the categories of recipients, the use of sensitive information, persistent AI memory or training, Sale, Sharing, targeted advertising, or a decision producing legal or similarly significant effects, HDW will update the applicable notice before the change and provide the timing, delivery method, opt-out, and consent required by applicable law. HDW may use email, a conspicuous in-Platform notice, or a collection-point notice as appropriate to the change and legal requirement. Technical clarifications, corrections, provider or model substitutions within the same recipient category and materially consistent data posture, and feature activations satisfying the preceding paragraph may take effect on posting or at activation. HDW will obtain separate consent before applying a materially different use to previously collected information where applicable law requires consent. An acknowledgment of this Privacy Policy does not replace any consent required for health information, persistent memory, marketing text messages, or another consent-dependent activity.

20.2 Contact HDW

HDW designs this Privacy Policy to be reasonably accessible to people with disabilities, consistent with generally recognized accessibility standards. To request this Privacy Policy in an alternative format, contact support@heydowhat.com.

Direct privacy questions, requests, complaints, and security reports to:

HeyDoWhat LLC
Attn: Privacy
418 Broadway STE R
Albany, NY 12207
United States

Privacy questions, rights requests, and complaints: privacy@heydowhat.com
General support and security reports: support@heydowhat.com
Website: https://heydowhat.com

For copyright notices and counter-notices, use the instructions and designated contact in HDW's DMCA Policy.

20.3 Privacy Complaints

If you believe HDW has handled your Personal Information improperly, you may submit a complaint by email to privacy@heydowhat.com with the subject line PRIVACY COMPLAINT, or by mail to the address in Section 20.2. Describe the concern and provide enough information for HDW to locate the relevant records.

HDW acknowledges and reviews complaints it receives and will respond with the outcome of its review. A complaint is separate from a rights request under Section 15 and from an appeal under Section 15.5. Submitting a complaint does not extend, replace, or restart a deadline that applies to either.

Section 17 describes the additional option of contacting a state attorney general or privacy regulator. Nothing in this Section limits a nonwaivable right to make a regulatory complaint or to pursue a remedy available under applicable law.