F3 PRIVATE CLIENT PRIVACY POLICY

Version 0.2 | [Effective Date]

DRAFT FOR REVIEW BY QUALIFIED UNITED STATES COUNSEL (AND, FOR NON-US CLIENTS, LOCAL COUNSEL)

This Privacy Policy explains how [F3 LEGAL NAME], INC., a Delaware corporation ("F3", "we", "us" or "our"), collects, uses, discloses and protects personal information about you when you visit our website, create an account, or use the F3 private-client intelligence subscription (the "Service"). It forms part of, and should be read with, our Private Client Terms of Service (the "Terms"). Capitalised terms not defined here have the meaning given in the Terms.

By using the Service, you acknowledge this Privacy Policy. Where we rely on your consent (for example, for certain cookies or marketing), we will obtain it as described below.

Summary

• We collect the information needed to run a paid, logged-in subscription: your account and contact details, limited billing information (card payments are handled by our payment processor, not stored by us), your communications with us, and usage and device data.
• We use it to provide and secure the Service, take payment, communicate with you, comply with law, and improve the Service using aggregated or de-identified data.
• We do not sell your personal information for money, and we do not currently share it for cross-context behavioural advertising. If that ever changes, we will update this Policy and give you a way to opt out.
• We use cookies and similar technologies, which may include analytics and advertising technologies; you can control these as described below.
• You have privacy rights depending on where you live (including under US state laws such as California's CCPA/CPRA, and under the EU/UK GDPR). Contact us at [privacy email] to exercise them.

1. Who we are and the scope of this Policy

1.1 F3 is the controller responsible for your personal information under this Policy. Our contact details are in Section 16.

1.2 This Policy applies to personal information we process about clients, prospective clients, and website visitors in connection with the Service. It does not apply to any third party's website, product or service (including any sportsbook or payment provider), which have their own privacy policies.

2. The personal information we collect

We collect the following categories of personal information:

2.1 Account and identity data: your name, email address, and the country you tell us you live in. Your password and any second factor are held by our identity provider, not by us — we store only an identifier that links your account to it.

2.2 Eligibility data: the fact that you have made the eligibility representations in the Terms (including that you meet the financial-eligibility criteria). We do not collect or store your actual net worth, income or asset figures — only your attestation.

2.3 Billing and transaction data: your subscription plan, billing history, and limited payment information. Card payments are processed by our third-party payment processor (currently intended to be Stripe); we do not receive or store your full card number. We receive limited details such as a payment token, card type, expiry, the last four digits, and billing contact and country.

2.4 Communications and support data: messages, requests and correspondence you send us, and our records of communications with you (including service, renewal, security and, where applicable, marketing messages).

2.5 Usage, device and log data: information generated when you use the Service, such as IP address, device and browser type, operating system, pages and features viewed, dates and times of access, referring pages, approximate (coarse) location derived from IP, and diagnostic and performance data. Some of this is collected using cookies and similar technologies (Section 6).

2.6 Information you choose to provide: anything else you submit to us, for example in support requests or surveys.

We do not seek to collect special-category or sensitive personal information beyond what is described here. Your login credentials are treated as "sensitive personal information" under some US state laws and are used only to provide and secure the Service.

3. How we collect it

We collect personal information: (a) directly from you (registration, subscription, communications); (b) automatically as you use the Service (cookies, log data); and (c) from service providers, such as our payment processor, and fraud and security tools.

4. How and why we use your information

We use personal information for the following purposes:

• Provide the Service: create and administer your account, authenticate you, deliver the Intelligence Outputs and features, and provide support.
• Payments and billing: process subscription fees, auto-renewals and refunds through our payment processor, and maintain billing records.
• Eligibility, security and fraud prevention: record the eligibility confirmations you give us, apply country restrictions based on the country you tell us you live in and the country your connection resolves to, detect and prevent fraud, abuse, credential-sharing and unauthorised use, and protect the Service.
• Communications: send you service and transactional messages (billing, renewals, security, changes to the Terms or this Policy) and respond to you. These are part of the Service.
• Marketing: where permitted, send you marketing or promotional communications about F3 (see Section 7). You can opt out at any time.
• Improve and develop the Service: analyse usage and create aggregated or de-identified data to operate, secure, understand and improve the Service and our models (see Section 9).
• Legal and compliance: comply with legal obligations, keep records required by law (including auto-renewal consent records), enforce the Terms, and establish, exercise or defend legal claims.

4.1 Legal bases (EU/UK clients). Where the EU or UK GDPR applies, we rely on: performance of our contract with you (to provide the Service and take payment); our legitimate interests (to secure, improve and market the Service, and prevent fraud), balanced against your rights; your consent (for certain cookies and marketing, which you may withdraw); and compliance with legal obligations.

5. When we disclose personal information

We do not sell your personal information (Section 8). We disclose it only as follows:

• Service providers / processors: vendors who process personal information on our behalf under contract, including our payment processor (currently intended to be Stripe), hosting and cloud infrastructure [hosting provider], email and communications tools [email provider], and security and fraud tools. They may use it only to provide services to us.
• Legal and safety: regulators, law-enforcement, courts or other authorities where required by law or legal process, or to protect the rights, safety or property of F3, our clients or others.
• Corporate transactions: an actual or prospective buyer, investor or successor in connection with a merger, acquisition, financing, reorganisation or sale of assets, subject to appropriate confidentiality.
• With your direction or consent: where you ask us to, or otherwise consent.

6. Cookies and tracking technologies

6.1 We and our providers use cookies, pixels, tags, SDKs, local storage and similar technologies ("cookies"). These may include:

• Strictly necessary cookies that are required to run the site, log you in and keep the Service secure;
• Functional cookies that remember your preferences;
• Analytics cookies that help us understand how the Service is used and improve it; and
• Advertising / targeting cookies that may be used to measure and deliver marketing and, if we choose to use them, to support advertising, including on third-party platforms.

6.2 We reserve the right to use any of these categories. Some are not active by default and may be enabled in the future. Where required by law (for example, for EU/UK visitors, and for non-essential cookies), we will request your consent through a cookie banner or preference tool before setting non-essential cookies, and you can change your choices at any time. You can also control cookies through your browser settings. Some features may not work properly if you disable certain cookies.

6.3 Depending on your browser and region, we will honour recognised opt-out preference signals (such as Global Privacy Control) where legally required.

7. Marketing communications

7.1 We may send you marketing communications about the Service. Where required by law, we will only do so with your consent, and you may withdraw that consent or opt out at any time by using the unsubscribe link in the message or contacting us at [privacy email].

7.2 Opting out of marketing does not stop service or transactional messages, which are necessary to provide the Service.

8. Do we sell or "share" your personal information?

8.1 We do not sell your personal information for monetary consideration, and we do not currently "share" your personal information for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA) and similar US state laws.

8.2 We reserve the right to use analytics and advertising technologies in the future (Section 6). If we ever sell or share personal information for cross-context behavioural advertising, we will update this Policy and provide a clear "Do Not Sell or Share My Personal Information" opt-out and honour applicable opt-out preference signals. You may contact us at [privacy email] at any time to opt out of any such sale or sharing.

8.3 We do not knowingly sell or share the personal information of anyone under 16.

9. Aggregated and de-identified data

We may create and use aggregated, anonymised or de-identified data (which does not identify you) for any lawful purpose, including analytics, security, benchmarking and improving the Service and our models. Where we hold de-identified data, we will maintain it as de-identified and not attempt to re-identify it except as permitted by law.

10. How long we keep your information

We keep personal information for as long as your account is active and as long as needed to provide the Service, and afterwards as necessary to comply with our legal obligations (including retaining auto-renewal consent records for the periods required by law), resolve disputes, prevent fraud and enforce our agreements. Consent and billing records are kept as evidence of what was agreed and are not deleted on request; where we can delete or de-identify other information we will.

11. International data transfers

We are based in the United States and process personal information there. If you are located outside the United States (including in the EU or UK), your personal information will be transferred to and processed in the United States and other countries whose data-protection laws may differ from yours. Where required, we use appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and take steps to ensure your information remains protected. Contact us for more information.

12. Your privacy rights

Your rights depend on where you live. To exercise any right, contact us at [privacy email]. We will verify your request and respond within the time required by law. You may use an authorised agent where the law allows. We will not discriminate against you for exercising your rights.

12.1 US state privacy rights (including California). Depending on your state, you may have the right to: know and access the personal information we hold about you and how we use and disclose it; request correction; request deletion; opt out of any sale or sharing for cross-context behavioural advertising (Section 8) and of certain profiling; and limit the use of sensitive personal information. California residents may also request the specific pieces and categories of personal information collected. If we deny a request, you may appeal by contacting us at [privacy email].

12.2 EU/UK rights. If the EU or UK GDPR applies to you, you have the right to: access your personal information; have it corrected or erased; restrict or object to processing; data portability; and withdraw consent at any time (without affecting prior processing). You also have the right to lodge a complaint with your local data-protection supervisory authority.

13. Children

The Service is intended only for adults aged 25 or over. It is not directed to children, and we do not knowingly collect personal information from anyone under the applicable minimum age. If you believe a minor has provided us with personal information, contact us at [privacy email] and we will delete it.

14. Security

We use reasonable administrative, technical and organisational measures designed to protect personal information, including encryption in transit, access controls and support for multi-factor authentication. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential (see the Terms).

15. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or through the Service and update the "Effective Date" above. Your continued use of the Service after the change takes effect means you acknowledge the updated Policy.

16. Contact us

If you have questions or requests about this Policy or your personal information, contact us at:

[F3 LEGAL NAME], INC. [address] Email: [privacy email]

If you are in the EU or UK and we are required to appoint a representative, our representative's contact details are: [EU/UK representative — to be completed].

This Privacy Policy is a draft prepared for review by qualified United States counsel (and local counsel for the treatment of non-US clients) before it is published or used. It must be kept accurate against the personal information actually collected, the tools actually deployed, and the sub-processors actually engaged.