HeyDoWhat Privacy Policy

Publication Date: October 26, 2026 Last Updated: October 26, 2026

Contents

1. About This Privacy Policy

HeyDoWhat LLC, a Wyoming limited liability company ("HeyDoWhat," "HDW," "we," "us," or "our"), operates the Platform, through which people discover, purchase, book, join queues or waitlists for, and redeem Merchant Offerings.

This Privacy Policy explains how HDW collects, uses, discloses, retains, and otherwise processes personal information in connection with the Platform. It also explains the privacy rights and choices that may be available to you.

This Privacy Policy applies to every person whose Personal Information HDW processes in connection with the Platform, whether or not they hold an account.

This Privacy Policy does not govern information that an independent merchant collects or processes outside the Platform for the merchant's own purposes, information processed by a third-party website or service under that party's own privacy notice, or HDW's processing of employee or job-applicant information.

This Privacy Policy is a notice of HDW's data practices. It is not a request for consent and is not, by itself, a contract. The HeyDoWhat Terms of Service and any applicable supplemental terms govern use of the Platform.

2. Key Terms

Terms defined in this Section govern this Privacy Policy only. Terms capitalized but not defined here have the meanings given in the Terms of Service or, for the Partner Program, the Partner Program Agreement.

2.1 "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identified or identifiable person or household. It includes equivalent terms such as "personal data" where applicable law uses those terms.

2.2 "Aggregate Information" means information relating to a group or category of people, transactions, merchants, or activities that is not reasonably linkable to a particular person or household.

2.3 "Deidentified Information" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular person or household.

2.4 "Platform" means the HeyDoWhat website, applications, Merchant-facing tools, and any other digital property or service operated by HDW that links to this Privacy Policy.

2.5 "User" means an individual who accesses or uses the Platform as a consumer, including as a visitor, registered account holder, purchaser, queue participant, or redeemer of a Merchant Offering.

2.6 "Merchant" means an independent business, venue, host, organizer, instructor, operator, or other provider that offers or fulfills a product, service, event, experience, reservation, voucher, admission, or other offering through the Platform.

2.7 "Merchant Offering" means any product, service, event, experience, reservation, admission, voucher, class, tour, or other offering made available by a Merchant through the Platform.

2.8 "Redemption Credential" means a code, ticket, or other credential issued through the Platform to evidence a User's entitlement to a Merchant Offering.

2.9 "Wallet" means the In-App Credit and Reward Point balances held in a User's account.

2.10 "In-App Credits" and "Reward Points" mean the respective Wallet categories identified in the Terms of Service and applicable supplemental or program terms.

2.11 "Service Provider" means a vendor or other party that processes information for HDW to perform a business, technical, professional, or operational function. Some recipients may act as independent businesses or controllers for some processing rather than solely as HDW's Service Providers.

2.12 "Sell," "Sale," "Share," and "Sharing" have the meanings assigned to them by the U.S. state privacy law applicable to the relevant person and processing activity. Depending on the law, a Sale may include a disclosure for monetary or other valuable consideration, and Sharing may include a disclosure for cross-context behavioral advertising.

Personal Information does not include Aggregate Information or Deidentified Information where applicable law excludes such information from its scope.

3. Personal Information We Collect and Its Sources

The table below describes the categories of Personal Information HDW has collected during the preceding twelve months, or since HDW began the relevant processing if that period is shorter, and expects to collect while this Privacy Policy remains current.

3.1 Information About Other People

If you provide information about another person, such as an attendee or guest, you must be authorized to do so and should provide only information reasonably necessary for the relevant booking, queue entry, transaction, or Partner Program referral and evidence review.

A Partner or Merchant supplying another person’s contact details, messages, or other evidence must have a lawful basis for disclosure, obtain any required permission, and provide any required notice.

3.2 Public Merchant and Review Information

Published Merchant profile, venue, listing, and offering information is public. If HDW makes a review available publicly, the rating, review text, and abbreviated reviewer display name may be visible to Platform visitors and may be copied or indexed outside HDW's control. Do not include information in a field designated for public display that you do not want made public.

3.3 Fulfillment Notes

If you add a fulfillment note to a Booking, HDW collects the content you submit. HDW makes the note available to the applicable Merchant's authorized personnel for fulfillment of that Booking. HDW does not represent that a Merchant will read or act on a note.

4. How We Use Personal Information

HDW uses Personal Information for the following purposes:

4.1 Provide and Operate the Platform

HDW uses Personal Information to create and secure accounts, present Merchant Offerings, provide search, discovery, and AI-assisted features, process bookings and purchases, issue and validate Redemption Credentials, operate queues and waitlists, administer the Wallet, coupons, referrals, promotions, and rewards, and provide other requested features. HDW may also use your Platform activity to personalize and rank results, recommendations, and promoted placements.

4.2 Process Transactions and Support Fulfillment

HDW uses transaction and payment-related information to administer purchases, payments, refunds, Wallet value and rewards; coordinate Merchant fulfillment; prevent duplicate or unauthorized use; and resolve transaction or fulfillment disputes.

4.3 Operate Queues, Waitlists, and Messaging

HDW uses queue and messaging information to place and maintain parties in line, estimate waits, send operational messages, process replies, record consent and opt-outs, and enforce the Queue Terms and SMS / Text Messaging Terms.

4.4 Verify Phones and Administer Benefits

HDW uses mobile numbers, verification status, and benefit-claim history to verify control of a number, protect accounts, determine eligibility for phone-dependent features, and prevent duplicate or abusive claims to new-user, referral, coupon, or promotional benefits.

4.5 Communicate

HDW uses contact and communication information to send transactional, account, security, operational, policy, and service messages; respond to support, privacy, safety, security, and legal inquiries; administer surveys and promotions; and, where permitted, send marketing communications.

4.6 Protect the Platform and Enforce Rules

HDW uses Personal Information to authenticate access; detect, investigate, prevent, and respond to fraud, abuse, security incidents, violations of Platform terms, and unlawful activity; maintain compliance evidence; and protect people, property, rights, and the Platform.

4.7 Measure, Develop, and Improve

HDW may use Platform activity and outcomes to understand and measure service performance, troubleshoot, test, train and improve features, search, recommendations, wait estimates and HDW's own models, develop new features, and conduct research.

4.8 Create Aggregate and Deidentified Commercial Insights

HDW uses Personal Information to create Aggregate Information and Deidentified Information as described in Section 10.

4.9 Comply With Law and Protect Legal Rights

HDW uses Personal Information to comply with applicable law, legal process, tax and accounting requirements, payment-network rules, telecommunications requirements, sanctions or compliance obligations applicable to HDW's activities, and lawful requests; administer copyright notices and counter-notices; establish, exercise, or defend legal claims; enforce agreements and policies; and cooperate with authorities where legally required or permitted.

4.10 Corporate and Administrative Purposes

HDW uses Personal Information for internal administration, governance, audits, accounting, financing, insurance, professional advice, corporate transactions, and business continuity.

4.11 Administer the Partner Program

HDW uses Partner Program information to administer enrollment, offers, referrals, attribution, corrections, and disputes; verify claims; prevent fraud; calculate and pay compensation; and meet tax and reporting requirements.

5. AI Features and Personalization

5.1 AI Processing

When you use an AI feature, HDW processes your request, related context, and the generated response, and discloses them to AI providers to generate the response.

5.2 AI Training and Personalization

HDW may use chat content, search text and review text to develop, train and improve HDW's own AI features and models, after filtering sensitive content and de-identifying the data, unless you turn off "Help improve HDW's AI" in the chat settings. This setting is on by default and covers all three sources; turning it off excludes all three from training. HDW stores chat content for this improvement purpose only while "Help improve HDW's AI" is on, after filtering sensitive content, for the retention period stated in Section 13 (default twelve months).

HDW may build and maintain individualized profiles of a person's Platform activity to personalize and rank results, recommendations and promoted placements. These profiles use your structured Platform activity, such as listings viewed and bookings, and the preferences you provide.

6. Sensitive Information

Free-text fields on the Platform are not designed for sensitive information, such as health or government-identification information. Do not submit such information through a general free-text field.

If you submit sensitive information through a free-text field, HDW may process and disclose it with that content to provide the feature you are using and for the other limited purposes described in this Privacy Policy.

HDW may retain sensitive information that a person includes in a support message, text message, privacy request, security report, legal notice, or other communication where retaining the communication is reasonably necessary to respond, maintain compliance evidence, protect safety or security, comply with law, or establish or defend legal rights.

7. Phone Numbers and Text Messages

7.1 Mobile Numbers

HDW uses a mobile number you provide for account, security, verification, and operational purposes.

A verified mobile number may be required to establish eligibility for certain new-user and referral benefits, and for another phone-dependent security, coupon, promotion, or account function. Phone-verification requirements are described in the applicable feature terms or workflow.

7.2 Account and Operational Messages

Account & Operational Alerts are text messages about an action you requested or a feature you use.

7.3 Marketing Text Messages

HDW sends marketing text messages only after a separate opt-in.

7.4 Revocation

You may revoke text-message consent as described in the SMS / Text Messaging Terms.

7.5 Messaging Providers and Carriers

HDW discloses mobile numbers, message content, and consent and delivery information to messaging providers, aggregators, and carriers to transmit messages, administer consent and suppression, monitor delivery, protect the service, and comply with law.

HDW does not sell or share mobile numbers, SMS opt-in data, SMS consent records, or SMS message-originator data with third parties or affiliates for their own marketing or promotional purposes. Text-message originator opt-in data and consent records are excluded from every category of information sharing described in this Privacy Policy. HDW does not share that information with any third party for any purpose other than the message-transmission, consent-administration, suppression, delivery-monitoring, service-protection, and legal-compliance functions described in the preceding paragraph, or as required by law.

The SMS / Text Messaging Terms govern HDW's text-message programs.

8. Queue and Waitlist Information

8.1 Walk-In Guests

A Merchant may add a walk-in guest to a queue by providing a name and party size. The Merchant is the source of this information and is responsible for having authority to provide it.

8.2 Information Available to the Merchant

The Merchant receives the queue information reasonably necessary to operate the line, such as your display name, party size, and status.

8.3 Location Information

HDW does not receive or store precise device coordinates. Declining location permission does not prevent you from joining a queue.

9. How and With Whom We Disclose Personal Information

9.1 Merchants and Their Authorized Personnel

HDW discloses information to the applicable Merchant and authorized staff where reasonably necessary to manage or fulfill a booking, purchase, queue entry, check-in, redemption, refund, cancellation, dispute, or support matter. This includes your name, party size, booking, redemption, queue, transaction, and refund information, and any fulfillment note you add.

A Merchant acts as an independent business or controller to the extent it determines the purposes and means of its own lawful processing. The Merchant Partner Agreement governs the Merchant's obligations to HDW for that information. Fulfillment notes are subject to additional use and retention restrictions under that agreement.

9.2 Payment, Billing, and Financial-Operations Providers

HDW discloses transaction, account, Merchant, and payment-related information to payment processors, billing providers, fraud-prevention services, payment networks, and financial institutions as reasonably necessary to process payments and refunds, administer billing and payouts, prevent fraud, resolve disputes and chargebacks, and comply with payment or financial requirements. These providers may process certain information for their own compliance, security, and service purposes under their own privacy notices. HDW's payment and payout provider is Stripe, Inc., which processes information as described in the Stripe Privacy Policy at https://stripe.com/privacy.

9.3 AI Model and Infrastructure Providers

HDW discloses AI interaction content, limited current-session context, relevant listing information, and generated outputs to AI model and infrastructure providers as described in Section 5.

9.4 Hosting, Authentication, Storage, Communications, and Operational Providers

HDW discloses Personal Information to vendors that provide hosting, database, authentication, storage, content delivery, email, SMS and telecommunications, security, fraud prevention, customer support, analytics infrastructure, error monitoring, document management, and other technical or operational functions.

9.5 Professional Advisers

HDW may disclose Personal Information to attorneys, accountants, auditors, insurers, consultants, and other professional advisers where reasonably necessary for advice, compliance, claims, audits, financing, insurance, or business administration.

9.6 Legal, Safety, Security, and Enforcement Recipients

HDW may disclose Personal Information to courts, regulators, law-enforcement agencies, government authorities, affected parties, payment networks, carriers, or contracted incident-response, forensic, and security specialists subject to applicable legal confidentiality and data-protection requirements where HDW reasonably believes disclosure is necessary to comply with law or legal process; investigate or prevent fraud, abuse, security incidents, or unlawful conduct; protect people, property, rights, or the Platform; enforce agreements or policies; or establish, exercise, or defend legal claims.

9.7 Corporate Transactions

HDW may disclose or transfer Personal Information in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, corporate due diligence, or similar transaction, subject to applicable legal confidentiality and data-protection requirements. A transfer of Personal Information as an asset in such a transaction, where the recipient assumes control of all or part of HDW's business and continues to use the information in a manner consistent with this Privacy Policy, is not a Sale or Sharing under applicable law.

9.8 Public and User-Directed Disclosures

HDW discloses information you direct it to disclose, information you submit for public display, and information necessary to complete an interaction you initiate with a third-party link or service.

9.9 Third-Party Websites, Links, and Services

The Platform may link to websites and services operated by others; their own privacy notices govern their processing.

9.10 Partner Program Disclosures

HDW may disclose Partner Program evidence to an affected Merchant, contact, or Partner to verify a claim or resolve a dispute.

10. Aggregate and Deidentified Information; Commercial Insights

HDW may create, retain, and use Aggregate Information and Deidentified Information internally for research, analytics, forecasting, market intelligence, benchmarking, trend and performance reports, product development, standardized insights, tools, and customized strategic or data-consulting services.

HDW does not sell your personal information. HDW may provide aggregated or de-identified insights that do not identify you. HDW does not attempt to re-identify them and requires recipients not to.

Whenever HDW represents information as Deidentified Information or includes deidentified statistics in a commercial output, HDW maintains technical, organizational, and contractual measures designed to prevent the information from being used to identify a person or household. HDW publicly commits to maintain and use that information in deidentified form and not to attempt reidentification except as permitted by law to test whether its deidentification safeguards are effective. Where HDW provides deidentified statistics to a recipient, HDW contractually requires the recipient to comply with the applicable legal requirements for deidentified information, maintain and use the statistics in deidentified form, and not attempt reidentification or combine them to identify a person or household.

Aggregate Information and Deidentified Information are not linked to an identifiable account and therefore ordinarily cannot be accessed, corrected, or deleted through an account-level privacy request.

11. Sale, Sharing, Targeted Advertising, and Promoted Placements

HDW does not Sell Personal Information, Share Personal Information for cross-context behavioral advertising, or use third-party advertising pixels or cookies to serve targeted advertising based on activity across unaffiliated services. During the preceding twelve months, HDW disclosed Personal Information in the categories in Section 3 for the business purposes and to the recipient categories described in Section 9, and did not Sell or Share Personal Information; HDW has no actual knowledge that it sells or shares the Personal Information of consumers under sixteen years of age.

HDW discloses that a paid placement is paid. HDW may use the individualized activity profiles described in Section 5.2 to determine which promoted placements are presented to a person.

A Merchant or other advertiser does not receive the activity profile or Personal Information used to select a promoted placement. HDW may provide a promoting party aggregate or deidentified campaign reporting that satisfies Section 10.

This personalization, if and when enabled, uses only your activity on the Platform and is not targeted advertising under applicable state privacy law.

HDW's creation and internal use of Aggregate Information and Deidentified Information, and its commercial offering of only the resulting outputs, under Section 10 is not a Sale or Sharing of Personal Information.

12. Cookies and Browser Storage

HDW uses cookies, local storage, session storage, and similar first-party technologies for:

• authentication, security, session continuity, legal-document and consent state, and other functions necessary to provide the Platform;
• remembering a user's cookie choice and limited local feature state; and
• optional first-party analytics used to understand Platform performance and interaction patterns.

HDW's optional analytics uses pseudonymous browser and visit identifiers stored in your browser.

The Platform does not respond to browser "Do Not Track" signals. HDW does not permit a third party to collect Personal Information through the Platform about a person's activities over time and across unaffiliated websites or applications.

Clearing required storage or blocking required technologies may sign you out or impair Platform functions. The Cookie Policy describes HDW's cookies and browser storage; your analytics choices are described in Section 15.3.

13. Retention

HDW retains Personal Information for no longer than reasonably necessary for the purposes described in this Privacy Policy, subject to applicable legal, accounting, tax, payment, telecommunications, security, fraud-prevention, dispute, and recordkeeping requirements. The applicable period depends on the category, sensitivity, context, and purpose of the information and the existence of a legal hold or active matter.

HDW deletes or de-identifies retained information when the purposes and preservation periods stated for its category end, subject to lawful exceptions and preservation duties. HDW applies the following criteria:

• Account, profile, and authentication information: while the account is active and afterward for a reasonable period needed to complete closure, prevent fraud or re-registration abuse, maintain security and legal-document evidence, resolve disputes, and comply with law.
• Bookings, orders, payments, refunds, redemptions, wallet, coupon, referral, promotion, and rewards records: for the periods needed to administer the transaction or balance; satisfy payment-network, chargeback, accounting, audit, tax, consumer-protection, unclaimed-property, and limitation-period requirements; prevent duplicate benefits and fraud; and resolve claims.
• Fulfillment notes: while needed to fulfill the Booking and resolve any related dispute, and as law requires.
• Merchant, listing, staff, billing, and onboarding records: while the Merchant relationship or listing is active and afterward as needed for transaction support, payout or billing administration, audits, compliance, disputes, fraud prevention, and legal obligations.
• Partner Program records: HDW retains covered freelance contracts for at least six years as required by New York General Business Law §1412(3), and other Partner records for applicable contractual, legal and documented recordkeeping purposes.
• Queue and waitlist records: while reasonably necessary to operate and audit the service, calculate and improve estimates, resolve entry, cure, or no-show disputes, enforce the Queue Terms, protect queue integrity and security, and comply with law.
• SMS and communications records: consent, opt-in, opt-out, revocation, suppression, message, delivery, and related records are retained as needed to deliver requested messages, honor preferences and suppression, demonstrate compliance, resolve complaints, prevent unauthorized use, and protect legal rights.
• First-party analytics and browser identifiers: while reasonably useful for permitted product measurement, attribution, security, and improvement, after which HDW deletes, aggregates, or deidentifies the records.
• AI interaction information: chat content and search text retained for improvement under Section 5.2 are filtered for sensitive content before storage and kept for twelve months by default, then deleted or de-identified; review text is filtered before any training use. All of it is subject to the setting, de-identification safeguards and applicable deletion and preservation duties. Limited non-content analytics and security information follows the criteria for those categories.
• Reviews and public content: while published or otherwise useful for the purpose submitted, moderation, transaction integrity, and disputes. HDW may retain published reviews and related moderation records after account closure.
• Support, privacy, security, and legal communications: while necessary to respond, investigate, maintain an audit trail, comply with law, administer copyright or other legal processes, resolve a dispute, or establish, exercise, or defend legal claims.
• Security and technical logs: according to the risk, sensitivity, troubleshooting, investigation, system-integrity, and legal needs associated with the log.
• Derived information, inferences, and individualized activity profiles: while the associated account is active and the derived information remains reasonably useful for the service, security, integrity, personalization, and evaluation purposes described in Sections 4, 5, and 8, and afterward only as reasonably necessary to resolve a dispute, maintain fraud and queue-integrity evidence, or comply with law.
• Backups and legal holds: information may remain in backups until ordinary rotation or secure deletion and may be retained for the duration of a legal hold, investigation, litigation, regulatory matter, or other mandatory preservation obligation.

Account closure or deletion does not require HDW to delete Wallet, tax, financial, transaction, consent, suppression, security, fraud, dispute, public-content, or legal records that HDW is permitted or required to retain.

14. Security

HDW maintains administrative, technical and physical safeguards reasonably designed to protect Personal Information. HDW does not store full payment-card numbers.

No method of transmission, storage, or security is completely secure. HDW cannot guarantee that Personal Information will never be accessed, acquired, lost, altered, or disclosed without authorization.

You are responsible for your account credentials and for the email address and mobile number on your account, and for promptly notifying HDW at support@heydowhat.com if you suspect unauthorized access to your account.

HDW notifies affected people and governmental or regulatory authorities of a security incident when and as required by applicable law.

15. Privacy Rights and Choices

15.1 Requests and Account Closure

To the extent applicable law grants them, you may request confirmation, access or a portable copy. You may request correction or deletion to the extent provided by applicable law. Requests are subject to the verification requirements, exceptions and limits applicable law allows, including where a request is technically infeasible or would impose a disproportionate burden.

You may close your account at any time in your account settings or by request under Section 15.4.

HDW may voluntarily honor a request even where a particular privacy statute does not apply. Doing so does not represent that the statute applies to HDW or to the request.

15.2 Rights Under Applicable U.S. State Law

Depending on your state of residence and whether the relevant law applies to HDW and the processing, you may have rights to:

• know the categories of Personal Information HDW collects about you, its sources, the purposes for collecting it, the categories of third parties to which HDW discloses it, and the specific pieces of Personal Information HDW holds about you;
• correct inaccuracies;
• delete Personal Information;
• obtain a portable copy;
• opt out of certain Sales, Sharing, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects;
• limit, consent to, or withdraw consent from certain sensitive-data processing;
• use an authorized agent;
• appeal a denied request; and
• receive nondiscriminatory treatment for exercising a privacy right.

15.3 Communication and Analytics Choices

• Marketing email: use the unsubscribe link in the message or contact support@heydowhat.com. This does not stop transactional, security, or account communications.
• Text messages: use the methods in the SMS / Text Messaging Terms.
• Optional analytics: you may turn optional analytics off in your privacy settings; HDW also honors the Global Privacy Control signal as an opt-out.
• Consent-dependent processing: where HDW relies on consent, you may withdraw consent through the applicable feature control or by contacting HDW. Withdrawal does not make prior processing unlawful and may prevent HDW from providing the feature that requires the information.

15.4 How to Submit a Request

Email privacy@heydowhat.com with the subject line PRIVACY REQUEST, or write to the postal address in Section 20.1. Provide the information reasonably necessary to locate your records. A walk-in guest may submit a request without an account.

15.5 Verification, Authorized Agents, and Appeals

HDW verifies identity where required or permitted for the particular request, at a level reasonably appropriate to the request and sensitivity of the information. Verification may include confirming control of the account email or mobile number, matching transaction or queue details, or requesting additional information reasonably necessary for that purpose.

Where applicable law permits an authorized agent, HDW may request proof of the agent's authority and may verify the person's identity or instructions directly only to the extent permitted for that request. HDW responds to a request within the period applicable law requires, such as 45 days from receipt under California law, and may extend that period as applicable law permits with notice of the extension and its reason. Where applicable law provides a right to appeal, submit the appeal to privacy@heydowhat.com with the subject line PRIVACY APPEAL.

15.6 Exceptions

Privacy rights are subject to exceptions and limitations under applicable law. HDW may retain or decline to delete information where reasonably necessary and legally permitted to complete a transaction; provide a requested service; maintain financial, tax, Wallet, consent, suppression, security, fraud, dispute, or legal records; protect against unlawful or abusive activity; exercise or defend legal claims; preserve freedom of expression or public content; comply with law; or maintain Aggregate Information or Deidentified Information.

Where HDW has disclosed Personal Information to a Merchant as described in Section 9.1, deletion by HDW does not delete a copy the Merchant independently retains. HDW forwards deletion requests to Merchants where applicable law requires. The Merchant is responsible for its own records and for its response.

HDW does not discriminate or retaliate against a person for exercising an applicable privacy right. Different functionality may result where information is reasonably necessary to provide a requested feature.

15.7 Automated Processing and Profiling

HDW uses automated processing for the following Platform functions:

• estimating queue position and wait times, as described in Section 4.3;
• determining no-show, cure, and queue-restriction outcomes under the Queue Terms;
• detecting fraud, abuse, and queue manipulation, as described in Section 4;
• determining eligibility for a promotion, reward, or benefit, including preventing duplicate claims, as described in Section 16; and
• if and when enabled, building individualized activity profiles used to personalize and rank results, recommendations, and promoted placements, as described in Section 5.2.

HDW does not use automated processing to make decisions about credit, insurance, employment, housing, or education.

A no-show, queue-restriction, or benefit-eligibility outcome can affect your access to a Merchant offering. An automated queue restriction affects queue participation and does not, by itself, determine eligibility for unrelated Platform transactions or legal rights. You may ask HDW to review such an outcome under Section 15.4. HDW may review and correct outcomes and provides any review, correction or appeal required by applicable law.

Where applicable law provides a right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, you may exercise that right under Section 15.4. Opting out may limit or prevent access to features that depend on the processing, including queue participation.

16. Promotions, Referrals, Rewards, and Financial Incentives

HDW may offer coupons, referral benefits, Reward Points, promotions, or other benefits associated with an account, verified mobile number, qualifying activity, or program participation. HDW processes account, contact, phone-verification, referral, transaction, eligibility, issuance, redemption, and fraud-prevention information to administer those programs and prevent duplicate or unauthorized claims.

Participation in an optional promotion, referral, or rewards program is governed by the disclosures and program terms presented for that program at or before the point of enrollment or issuance, not by this Privacy Policy. Where a program is a financial incentive or a price or service difference under applicable privacy law, HDW provides the required notice of financial incentive with that program's terms.

17. U.S. State-Specific Disclosures

This Section supplements the rest of this Privacy Policy where a U.S. state privacy law applies.

Rights under a state privacy law apply only where that law applies to HDW and the processing; nothing in this Privacy Policy is an election to be bound by a statute that does not apply.

For California purposes, the categories in Section 3 include identifiers; information described in California Civil Code section 1798.80; commercial information; Internet or other electronic-network activity; audio, electronic, visual, or similar information; geolocation information, including venue or listing locations selected by a user and approximate location inferred from network information; professional or employment-related information; inferences; and sensitive Personal Information limited to account credentials, tax or verification information collected through a designated secure process, and health information a person volunteers in a request or communication. HDW uses such sensitive information only for the service, security, communication, legal, and other limited purposes described in this Privacy Policy and not to infer characteristics for targeted advertising or commercial insights. Sources, business and commercial purposes, and recipient categories are described in Sections 3, 4, and 9. Retention criteria are described in Section 13.

HDW's position concerning Sale, Sharing, targeted advertising, and mobile information is stated in Sections 7 and 11. HDW's rights-request process, including verification, authorized agents where applicable, appeals where applicable, and nondiscrimination, is stated in Section 15.

California's "Shine the Light" law permits certain residents to request information about disclosures of Personal Information to third parties for those parties' own direct-marketing purposes. HDW does not disclose Personal Information to third parties for their own direct-marketing purposes within the scope of that law.

Nevada residents may submit a verified request to opt out of a covered sale under Nevada law using the process in Section 15. HDW does not engage in such covered sales.

Residents of states with comprehensive consumer privacy statutes, including Virginia under the Virginia Consumer Data Protection Act, Colorado under the Colorado Privacy Act, Connecticut under the Connecticut Data Privacy Act, Utah under the Utah Consumer Privacy Act, and Texas under the Texas Data Privacy and Security Act, and residents of other states that have enacted or may enact comparable legislation, may exercise the rights described in Section 15 to the extent the applicable statute applies to HDW and to the relevant processing.

Residents may contact their state attorney general or privacy regulator regarding rights provided by applicable law.

18. Adult Accounts and Information About Minors

HDW accounts and account-based Platform services are intended for people who are at least eighteen years old.

The Platform is not directed to children under thirteen. HDW deletes, restricts or retains minors’ information as required or permitted by applicable law, including COPPA where applicable. HDW does not knowingly permit a person under eighteen to maintain an account and may suspend or close an account it learns belongs to a person under eighteen.

An adult who includes a minor guest in a booking or queue entry is responsible for that entry and should provide only the information reasonably necessary for the minor guest.

A parent or legal guardian who believes a minor has created an account or that HDW has processed a minor's Personal Information inappropriately may contact privacy@heydowhat.com with the subject line MINOR ACCOUNT REPORT.

19. International Processing

HDW is based in the United States. HDW does not direct the Platform to people in the European Economic Area, the United Kingdom, or Switzerland.

Personal Information may be processed in the United States and in jurisdictions where HDW's Service Providers operate. Those jurisdictions may have data-protection rules different from those of your location.

20. Contact Information and Changes

20.1 Contact HDW

To request this Privacy Policy in an alternative format, contact support@heydowhat.com.

Direct privacy questions, requests, complaints, and security reports to:

HeyDoWhat LLC
Attn: Privacy
418 Broadway STE R
Albany, NY 12207
United States

Privacy questions, rights requests, and complaints: privacy@heydowhat.com
General support and security reports: support@heydowhat.com
Website: https://heydowhat.com

For copyright notices and counter-notices, use the instructions and designated contact in HDW's DMCA Policy.

20.2 Privacy Complaints

If you believe HDW has handled your Personal Information improperly, you may submit a complaint by email to privacy@heydowhat.com with the subject line PRIVACY COMPLAINT, or by mail to the address in Section 20.1. A complaint is not a rights request under Section 15 or an appeal under Section 15.5. Submitting a complaint does not extend, replace, or restart a deadline that applies to either. Nothing in this Section limits a nonwaivable right to make a regulatory complaint or to pursue a remedy available under applicable law.

20.3 Changes to This Privacy Policy

HDW may update this Privacy Policy. HDW posts the updated Privacy Policy with its effective date and gives reasonable advance notice before a material change takes effect, except that a change required by applicable law or made to address security, fraud or legal risk takes effect when posted. HDW obtains any consent applicable law requires before applying a materially different use to previously collected Personal Information.