We collect the following categories of information.

A. Information You Provide to Us.

• Responses. Whatever you submit when you complete a Poll, including answers, selections, free-text input, and any files or recordings you choose to upload.
• Account information. Information you provide when you create or maintain an Account, which may include an email address, password (stored as a salted hash), display name, single-sign-on identifier, passkey identifier, World ID nullifier, or other authentication identifier, depending on the authentication method you use.
• Demographic and profile information. Information you provide to help us route relevant Polls to you, such as age range, country, language, and other characteristics. You decide what to share, although some Polls may be unavailable if you choose not to provide certain information.
• Payment-routing information. The wallet address, bank account, payment-app handle, or other destination to which we send Rewards.
• Tax documentation. If we ask for it (for example, IRS Form W-9 or W-8BEN), the information you provide on that form.
• Communications. Any messages, feedback, or support requests you send to us, and our responses.

B. Information from Verification Providers.

When you complete a Verification, we receive only the minimum information necessary for us to confirm that you have completed the Verification at the level we require. The specific data we receive depends on the Verification method. Where we use World ID, we receive only a cryptographic nullifier and your verification level (and not your biometric data); the specifics are described in our Privacy Supplement for the World App. Where we use other Verification methods (such as third-party KYC), we receive what that provider transmits to us, which may include name, government-ID details, date of birth, address, and verification status.

C. Information Collected Automatically.

• Device and technical information. Device type, operating system, app version, browser type and version, locale, language settings, time zone, screen size, and similar technical information.
• Usage information. Pages or screens you view in the Service, Polls started, Polls completed, time spent, and similar interactions.
• Diagnostic and security information. Logs, error reports, IP address, approximate location derived from IP, and similar information necessary to operate, secure, and improve the Service.
• Cookies, SDKs, and similar technologies. On websites we operate, we and our service providers may use cookies, web beacons, pixels, and similar technologies. In mobile applications and mini-applications, we and our service providers may use SDKs, local storage, and analogous on-device storage. The specific technologies in use on a particular surface are described in the cookie or tracking-technology disclosure for that surface.

D. Information from Third Parties.

• Payment networks and stablecoin issuers. Public on-chain transaction data associated with any wallet address you provide, and information from stablecoin issuers (such as Circle Internet Financial, where we pay USDC) or other payment-rail providers as needed to process Rewards.
• Service providers. Information our service providers (cloud hosting, analytics, fraud prevention, customer support, tax-information reporting, identity-verification, and similar providers) make available to us in connection with the services they provide to us.

We use the information described above for the following purposes.

• Operate the Service. Authenticate you, present Polls, accept and process Responses, calculate and pay Rewards, and operate other Service features.
• Sybil resistance and fraud prevention. Use Verification identifiers (including, where applicable, World ID nullifiers), behavioral signals, device fingerprints, and similar information to enforce one-Account-per-person, detect bots, AI-generated Responses, multi-accounting, collusion, and other forms of abuse, and to determine whether to accept or reject a Response or pay or claw back a Reward.
• Quality assurance. Evaluate Responses for completeness, plausibility, and quality.
• Aggregate insights, datasets, and reports. Aggregate, anonymize, de-identify, and analyze Responses to produce datasets, dashboards, benchmarks, and reports. We may use these insights ourselves and may sell, license, publish, or otherwise share them with clients, partners, researchers, and the public, in identifiable, de-identified, or aggregate form, as further described in Section 3.
• Research and product development. Conduct internal research, evaluate new features, and improve the Service and our other products. This may include training, fine-tuning, and evaluating machine-learning models.
• Investment, trading, and market-analysis activities. We may use aggregated, de-identified, and anonymized information derived from Responses to inform our own investment, trading, hedging, and market-analysis activities, including positions in financial, commodity, and prediction markets. Where we engage in such activities, we will not provide individualized investment advice to you, and our activities are not a recommendation to you.
• Communicate with you. Send Service-related notices, respond to your inquiries, and (where you opt in or applicable law allows) send other communications about the Service.
• Compliance and legal. Comply with applicable law, including tax-information reporting and sanctions screening; respond to lawful requests from authorities; and exercise or defend legal claims.
• Security. Protect the Service, our Users, and our business from security threats, abuse, and unlawful activity.

We share information in the following circumstances.

• Service providers. With cloud-hosting, analytics, fraud-prevention, security, customer-support, tax-information-reporting, identity-verification, and similar service providers acting on our behalf and under contractual obligations to protect your information.
• Payment infrastructure. With stablecoin issuers, blockchain networks, and other payment infrastructure necessary to deliver Rewards. Information transmitted to a public blockchain (including any wallet address you provide and the amount of any payment) may be permanently and publicly viewable on that blockchain. Specific blockchain considerations are described in our Privacy Supplement for digital-asset Rewards.
• Aggregated and de-identified information. With clients, partners, researchers, and the public, in aggregated, anonymized, or de-identified form. We may publish, sell, or license such information for any lawful purpose. We undertake commercially reasonable measures so that aggregated or de-identified information cannot reasonably be used to re-identify you, and we contractually prohibit recipients from attempting re-identification, but we cannot guarantee that re-identification will never be possible.
• Identifiable Response-level data. Where a Poll is conducted on behalf of a third-party client and we tell you, before you start that Poll, that your Response will be shared with that client in identifiable or pseudonymous form, we may share that Response on those terms. We will obtain any consent required by applicable law before doing so.
• Legal and safety. With courts, regulators, law-enforcement authorities, and other parties when we reasonably believe that disclosure is required by applicable law or legal process, or is necessary to investigate fraud or other abuse, protect the rights, property, or safety of any person, or enforce our agreements.
• Corporate transactions. With acquirers, investors, and advisors in connection with a financing, merger, sale of assets, reorganization, or similar transaction, and with successors and assigns of our business.
• With your direction. Where you direct us to share specific information.

We do not sell personal information in exchange for monetary consideration in the way that term is commonly understood. However, we do commercialize aggregated and de-identified data derived from Responses, and depending on how applicable laws define “sale” or “sharing” (including under the California Consumer Privacy Act, as amended), some of those activities may be considered a “sale” or “sharing” for legal purposes. See Section 6 for U.S. state-specific rights.

If you are located in the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with similar legal-basis requirements, we process your personal information on the following legal bases:

• Performance of a contract. To provide the Service to you under our Terms of Service.
• Legitimate interests. To prevent fraud and abuse, to operate and secure the Service, to develop and improve our products, and to commercialize aggregated insights, where these interests are not overridden by your fundamental rights.
• Legal obligation. To comply with applicable law (including tax and sanctions law).
• Consent. Where required by law, on the basis of your consent, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.

We are based in the United States. Information we collect may be transferred to, stored in, and processed in the United States and in any other country in which we or our service providers operate. Where required, we use appropriate safeguards (such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms) to protect personal information that is transferred outside its country of origin.

Depending on where you live and applicable law, you may have some or all of the following rights:

• Access. Request access to the personal information we hold about you.
• Correction. Request correction of inaccurate or incomplete personal information.
• Deletion. Request deletion of your personal information, subject to legal exceptions (for example, information we are required to keep for tax, accounting, fraud-prevention, or legal-claim purposes; aggregated or de-identified data; and Responses already incorporated into datasets we have shared with third parties).
• Portability. Request a copy of personal information you have provided to us in a structured, commonly used format.
• Objection / restriction. Object to or request that we restrict certain processing.
• Withdrawal of consent. Withdraw consent where we process your personal information based on consent.
• Opt out of “sale” or “sharing” (U.S. states).If applicable law treats our commercialization of aggregated insights as a “sale ” or “sharing”, you may opt out as described in Section 6.B.
• Non-discrimination. Exercise any of these rights without retaliation. We will not deny you Service for exercising privacy rights, although some Polls may be unavailable if you ask us not to process certain information necessary for that Poll.

A. How to exercise your rights. You may submit requests by emailing contact@voxdotpop.com from the email address associated with your account or by following any in-Service mechanism we provide. We will verify your identity using a method appropriate to the request. We will respond within the timeframe required by applicable law.

B. U.S. state-specific rights (California, Colorado, Connecticut, Texas, Virginia, and similar states). If you are a resident of a U.S. state with a comprehensive privacy law, you may have additional rights, including the right to opt out of the “sale” or “ sharing” of personal information and the right to opt out of targeted advertising. We do not engage in cross-context behavioral advertising. To opt out of any commercialization of aggregated insights derived from your Responses, email us at contact@voxdotpop.com with the subject line “Opt Out”. You may also designate an authorized agent to make a request on your behalf, subject to verification.

C. EEA, UK, and Swiss residents.You have the right to lodge a complaint with your local data-protection authority. The supervisory authority for our processing in the United Kingdom is the Information Commissioner’s Office (ico.org.uk).

We retain personal information for as long as necessary to provide the Service, to comply with our legal obligations (including tax and sanctions-screening obligations), to resolve disputes, and to enforce our agreements. Specifically:

• Account and Verification identifiers (including World ID nullifiers, where applicable): retained for the lifetime of your Account and for a reasonable period afterward to enforce one-Account-per-person rules and to detect re-registration by previously banned Users.
• Responses: retained as part of our datasets, including in aggregated and de-identified form, on an indefinite basis, subject to your deletion rights described in Section 6.
• Payment and tax records: retained for the period required by applicable financial-recordkeeping and tax law (typically at least seven years in the United States).
• Logs and security data: retained for the period needed for security, fraud-prevention, and incident-response purposes, typically not more than 24 months.

When personal information is no longer needed, we delete or de-identify it, except where retention is required by applicable law.

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for safeguarding your authentication credentials, devices, and any payment-routing destination you designate.

The Service is not directed to anyone under the age of 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us at contact@voxdotpop.com and we will delete the information.

The Service may interoperate with or contain links to third-party services, including identity-verification providers, World, blockchain networks, stablecoin issuers, mobile-app stores, and other parties. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Review the privacy policies of any third-party service before using it. Where applicable, our Privacy Supplement for the relevant surface describes how we receive information from these providers.

We may update this Policy from time to time. If we make a material change, we will notify you through the Service, by email (if you have provided one), or by another reasonable method, before the change takes effect. The “Last revised” date at the top of this Policy reflects when it was most recently changed.

If you have questions about this Policy or our privacy practices, contact us at:

DOTSNEWCO Inc.
Attn: Privacy — DOTSNEWCO Inc.
5049 Edwards Ranch Rd.
Ft. Worth, Texas 76109
Email: notices@voxdotpop.com