PRIVACY NOTICE

Last Updated: June 21, 2026

1. SCOPE AND OVERVIEW

This Privacy Notice explains how Blonde Waterfall LLC ("Company," "we," "our,"
or "us") collects, uses, discloses, retains, and protects information that
identifies, relates to, or could reasonably be linked with an identifiable
individual ("Personal Data"). This Notice applies to our websites,
applications, marketing activities, and all services we provide (collectively,
the "Services").

We maintain privacy practices designed to align with generally recognized
privacy principles and applicable data protection laws in the United States
and, where applicable, the European Union.

2. CATEGORIES OF PERSONAL DATA WE COLLECT

We collect the following categories of Personal Data depending on how you
interact with us:

2.1 Identifiers and Contact Information

• Name

• Email address

• Business contact details

• Online identifiers (e.g., IP address, cookie identifiers)

2.2 Commercial and Account Information

• Transaction, payment, and billing details

• Services purchased or requested

• Account credentials (where applicable)

• Purchase history and subscription details

2.3 Internet and Device Information

• Browser type, operating system, device identifiers

• Website activity, interactions, and navigation data

• Log files, timestamps, and referring URLs

2.4 Content You Provide

• Media files, photos, videos, and related creative content

• Property listing or project information

• Communications submitted through forms, chat, or email

2.5 Derived and Analytics Information

• Preferences, engagement patterns, and marketing insights derived from usage
  data

2.6 Social Media and Connected Account Information

Connecting a social media account is optional and is not required to use our
core Services. If you choose to connect a social media account so that we can
publish or schedule content on your behalf, the connection is established
through that platform's own authorization process, and the platform handles
your login and authentication. We do not receive or store your social media
account password. Through this connection we may receive:

• Account and profile identifiers (e.g., username, account or page ID, profile
  details)

• Authorization tokens that allow us to publish, schedule, or manage content on
  your behalf

Your use of any connected platform remains governed by that platform's own
privacy policy and terms. You may disconnect a social media account at any time
through your account settings or directly through the platform.

2.7 Summary of Data Use and Disclosure

Category of Information Business Purpose Categories of Recipients
Identifiers Account management, communication Service providers, CRM platforms
Transaction Information Payment processing, order fulfillment Payment processors
Usage Data Analytics, performance improvement Analytics providers
User Content Service delivery, content creation Service providers

3. HOW WE COLLECT INFORMATION

We collect information:

• Directly from you when you submit forms, create accounts, place orders, or
  communicate with us;

• Automatically through cookies, analytics tools, and similar technologies;

• From service providers and integrations that support our operations.

• From business partners and service providers acting on our instructions

• From social media platforms you choose to connect, where you authorize us to
  access account information or publish content on your behalf.

4. HOW WE USE INFORMATION

We process Personal Data for the following lawful and legitimate business
purposes:

• Providing, delivering, and operating Services

• Managing accounts, billing, and customer relationships

• Communicating regarding services, updates, and responses

• Marketing, advertising, and promotional activities (subject to opt-out
  rights, where applicable)

• Improving and optimizing Service performance and user experience

• Security, fraud prevention, and risk management

• Legal, regulatory, and contractual compliance

We do not process Personal Data in ways that are materially incompatible with
the purposes described above without providing additional notice or obtaining
legally required authorization.

5. LEGAL BASES FOR PROCESSING

Where required by applicable law, we rely on one or more of the following legal
bases in collecting Personal Data:

• Performance of a contract

• Legitimate business interests (balanced against individual rights)

• Compliance with legal obligations

• Consent (where required or obtained)

6. HOW WE DISCLOSE INFORMATION

We may disclose Personal Data to the following categories of recipients:

• Service Providers and Processors (e.g., payment processors such as Stripe,
  CRM platforms such as HubSpot, marketing tools such as Smartlead, hosting and
  infrastructure providers) operating under contractual confidentiality and
  data protection obligations

• Content-Generation and Automated Processing Providers (third-party tools used
  to process, edit, enhance, and generate media from the listing photos and
  property media you upload)

• Marketing and analytics partners (e.g., Google Analytics and similar
  providers)

• Professional Advisors (legal, accounting, insurance)

• Business Partners where necessary to provide Services

• Government Authorities when legally required

We may share or make available certain information for advertising, analytics,
or marketing purposes. Depending on applicable law, certain disclosures for
advertising or analytics purposes may be subject to opt-out or similar consumer
choice requirements.

We do not disclose Personal Data for cross-context behavioral advertising or
similar activities without offering you legally required choice mechanisms.

7. TRACKING TECHNOLOGIES AND ANALYTICS

We use cookies, pixels, analytics tools, and similar technologies to collect
information about how users interact with our website and Services, including
page views, clicks, navigation patterns, and interactions with content.

We may use cookies and related technologies to:

• Operate and secure our websites

• Analyze usage trends

• Support marketing and analytics functions

These technologies may be used to understand user activity across different
websites, services, or platforms. You can manage cookie preferences through
browser settings and available tools on our website. Where we receive legally
recognized opt-out preference signals, we treat such signals as valid requests
for applicable processing activities.

Depending on your jurisdiction, you may have the right to opt out of certain
data sharing or targeted advertising activities. Please see our Cookie Notice
for more information about the types of cookies we use or click "Cookie
Preferences" (link located in the footer of our Website) to set your
preferences and opt-out of the sale or sharing (for targeted advertising) of
your data.

8. ADVERTISING AND MARKETING PRACTICES

When you visit our website, we may enable third parties to use cookies and
other trackers to show you ads on third-party websites that are more relevant
to you. Under some data protection laws, our disclosure of this information to
third parties through cookies and other trackers for targeted advertising may
be considered a "sale" or "share" of personal information. Please see our
Cookie Notice for additional information and available choices.

Blonde Waterfall does not have actual knowledge that it "sells" or "shares" the
Personal Data of individuals under 16 years of age.

9. YOUR RIGHTS AND CHOICES

Subject to applicable law, individuals may have the right to:

• Access Personal Data

• Correct inaccurate information

• Delete Personal Data

• Object to or restrict certain processing

• Opt out of marketing or targeted activities

• Appeal decisions related to data requests

Requests may be submitted using the contact information below. For your
protection, we will verify requests where required and respond within legally
mandated timeframes.

If you are located in the European Union, the United Kingdom, or another
jurisdiction that provides this right, you also have the right to lodge a
complaint with your local data protection supervisory authority. We encourage
you to contact us first at the email address below so that we can address your
concerns directly.

10. USE OF TECHNOLOGY AND AUTOMATION

We may use automated or technology-assisted tools to support our Services,
including content optimization, analytics, and operational efficiency. Outputs
generated or enhanced through such tools may contain limitations or variations.
We do not use automated decision-making that produces legal or similarly
significant effects on individuals without appropriate safeguards.

To deliver our Services, listing photos and property media you upload are
processed using third-party service providers, including automated
content-generation tools. These providers may receive, store, and process your
uploaded media outside of our systems. Some of these providers may use
submitted content to operate, develop, and improve their own services and
models, including for training purposes, in accordance with their respective
terms. Headshots you provide are not submitted to these third-party
content-generation tools. By submitting content to our Services, you
acknowledge that it may be processed by such third-party providers for these
purposes.

11. DATA RETENTION

We retain Personal Data only for as long as necessary to fulfill the purposes
described above, unless a longer retention period is required or permitted by
law.

Media you upload (including headshots and property media) is retained for
thirty (30) days following cancellation of your account, after which it is
deleted. If you would like your uploaded media deleted immediately, you may
submit a request at blondewaterfall.com/data-deletion.

12. SECURITY SAFEGUARDS

We maintain reasonable, administrative, technical, and organizational
safeguards designed to protect Personal Data, including:

• Encryption and access controls

• Employee training

• Monitoring, system updates, and incident response procedures

No system is completely secure, and we cannot guarantee absolute security of
your data.

13. INTERNATIONAL DATA TRANSFERS

If Personal Data is transferred outside the country of collection, we implement
appropriate safeguards consistent with applicable data protection requirements,
including contractual protections where appropriate.

14. CHILDREN'S DATA

Our Services are not directed to children, and we do not knowingly collect
Personal Data from children without appropriate authorization. If we become
aware that such data has been collected, we will take steps to delete it.

15. THIRD-PARTY SERVICES

Our Services may contain links to third-party websites or services. We are not
responsible for the privacy practices of those third parties.

16. CHANGES TO THIS NOTICE

We may update this Privacy Policy from time to time. Changes will be effective
when posted, and continued use of the Services constitutes acceptance of the
updated Policy.

17. CONTACT INFORMATION

For questions or to exercise your rights, contact us at:

Email: backend@blondewaterfall.com