PRIVACY POLICY

This Privacy Policy ("Policy") governs the collection, use, storage, and disclosure of personal information by WALLS Entertainment Group Inc. ("Company," "we," "our," or "us") in connection with our talent management services, proprietary platforms, websites, applications, application programming interfaces (APIs), marketplace and payment services, social analytics and content analysis tools, communications and listening systems, and all related services (collectively, the "Services"). This Policy applies to all users of our Services, including talent, creators, agents, brands, marketplace customers, and visitors to our websites.

"Personal Information" means any information relating to an identified or identifiable natural person. "Processing" means any operation or set of operations performed on personal information, whether or not by automated means. "Platform Data" means information we obtain from third-party platforms (including social media and communication services) via APIs, OAuth, webhooks, or other authorized integrations. We process personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the Personal Information Protection and Electronic Documents Act (PIPEDA).

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. We reserve the right to modify this Policy at any time; material changes will be effective upon posting. Your continued use of the Services after such posting constitutes acceptance of the modified Policy. We encourage you to review this Policy periodically.

We collect information that you provide directly, that we obtain through your use of our Services and connected platforms, and that we receive from third-party sources where permitted by law or with your consent.

Identity and contact information includes full name, preferred name, email addresses (personal and business), phone numbers, postal addresses, emergency contact information, and where required for compliance or payouts, government-issued identification details. Account and authentication data includes credentials, security questions, multi-factor authentication data, login history, session data, and API keys or access tokens that we issue or store in connection with your use of our APIs and integrations.

Financial and transaction information includes payment and payout details processed through our authorized payment providers (including Stripe and Wise), transaction records, revenue data, tax-related information as required by law, and for our marketplace and Stripe Connect flows: Stripe connected account identifiers, customer identifiers, checkout and payment intent metadata, application fees, refund and dispute data, and order and product purchase history. We do not store full payment card numbers; card data is handled directly by our payment processors in accordance with their policies and applicable card industry standards.

Platform and social analytics data includes social media account identifiers, OAuth and API tokens for YouTube, TikTok, Instagram, Facebook (Meta), and similar platforms; content performance metrics; audience demographics and behavior data; engagement statistics (likes, comments, views, shares); growth metrics; monetization metrics; and brand collaboration history. We also collect data from automated jobs and webhooks that sync or scrape platform content and metrics where you have connected accounts or where we have been engaged to provide analytics services.

Communication and content data includes email content, metadata, and threading when you connect Gmail or other email services; calendar events and availability when you connect Google Calendar or similar services; and where you use our phone or voicemail features, call metadata, voicemail recordings, and automated transcriptions of voicemail messages. We use this to deliver communications features, sync and send email, manage calendars, and forward or notify you of voicemails (including by sending transcript and recording details to designated email addresses).

Content analysis and DNALabs-related data includes topic and keyword performance by profile, post-level keywords and engagement metrics, and aggregated analytics that help determine what types of content perform best for talent. This processing is performed only where you or the relevant talent have consented to or enabled DNALabs or equivalent content-analysis features in profile or account settings.

Newsletter and marketing data includes email addresses, subscription source, optional metadata (e.g., source of signup), and where applicable linkage to marketplace customer records so we can manage newsletter signups for creator marketplaces and honor preferences. Contact and lead data includes information submitted through our website contact forms (e.g., first name, last name, email, message, contact type) and any marketing consent you give; we may also enrich lead or contact data using third-party data providers (e.g., Apollo) where relevant to our business development and with appropriate legal basis.

We collect technical and usage data such as IP address, device and browser information, and cookies and similar technologies in accordance with our cookie and consent choices. Where you have consented to analytics, we may use services such as Google Analytics to collect usage data to improve our Services.

We collect personal information through direct interactions when you register, complete forms, connect accounts, communicate with us, or use features that require you to provide or authorize access to data. We also collect through automated means: platform APIs and OAuth flows (e.g., YouTube, TikTok, Meta/Instagram, Gmail, Google Calendar), cookies and similar technologies, analytics scripts (where consent is given), webhooks from payment and communication providers (e.g., Stripe, Twilio), and background jobs that sync or aggregate platform and analytics data.

Third-party sources include social and professional platforms where you grant us access, payment and identity verification providers, data enrichment providers (e.g., for lead or company data), and publicly available or permitted data where relevant to our Services and lawful.

We process your personal information where necessary for the performance of a contract with you (e.g., delivering talent or marketplace services, processing payments and payouts, providing connected platform features), where necessary for our legitimate interests (e.g., improving Services, analytics, security, fraud prevention, business development) in a manner that does not override your rights, where required by law (e.g., tax, legal process, regulatory obligations), and where we have your consent (e.g., optional analytics, marketing, or special categories of data, and where required for features such as DNALabs content analysis or certain third-party integrations).

Purposes include: providing and operating our talent management, creator, and marketplace platforms; facilitating Stripe Connect and direct-charge payments, marketplace checkout, orders, and transaction history; managing newsletter signups and marketing preferences; syncing and displaying social analytics and content performance; running content analysis and DNALabs-style insights (with consent where required); operating email, calendar, and voicemail/transcription features; issuing and validating API keys and scoped access; enriching leads and contacts for business development; handling contact and support requests; ensuring security and preventing fraud; and complying with legal and regulatory requirements.

Our Services use Stripe for payment processing and Stripe Connect so that creators and talent can receive payments through their own connected Stripe accounts. When you use marketplace checkout, subscribe to a creator newsletter, or receive payouts, we and Stripe process data necessary to complete transactions, comply with Stripe's terms and applicable financial regulations, and provide you with order and transaction history.

We receive and store Stripe-related data such as connected account IDs, customer IDs, checkout session and payment intent identifiers, amounts, currency, application fees, refund and dispute events, and metadata (which may include external user IDs for linking orders to your account). This data is used to fulfill orders, support refunds and disputes, display transaction and order history in the talent or creator app, and operate our marketplace and platform fee model. Stripe also collects and processes payment method and identity information in accordance with Stripe's privacy policy and applicable card and financial regulations; we do not store full card numbers. By using our payment and marketplace features, you acknowledge that your payment and transaction data will be processed by Stripe and by us as described in this Policy and in Stripe's terms and privacy notices.

We access social media and content platform data via official APIs and authorized integrations (e.g., YouTube, TikTok, Meta/Instagram) to provide analytics, growth metrics, and content performance insights. This may include account information, posts, engagement metrics, audience demographics, and other data made available by the platforms under their respective terms and your authorization. You control which accounts and platforms are connected; we process platform data only in accordance with your connections and our agreements with the platforms.

Our DNALabs and content-analysis features use your connected platform data to analyze topic and keyword performance, aggregate engagement by content type, and produce insights about what content performs best for a given profile. These features are enabled only where you or the relevant talent have consented or opted in (e.g., via profile or account settings). We may store derived data such as topic groups, keyword associations, and aggregated performance metrics to power these insights and reporting. You may disable or disconnect these features at any time through the applicable settings.

When you connect Gmail or other email services, we store and use access and refresh tokens to sync messages, send and schedule email, and provide email-based features. Email content, metadata, and thread information are processed on our systems and may be stored or cached as necessary to operate these features. When you connect Google Calendar or similar services, we process calendar events and availability to support scheduling and calendar-based features.

Our phone and voicemail features use third-party telephony providers (e.g., Twilio). When callers leave voicemails, we may receive and process call metadata (e.g., caller number, call identifier), voicemail recordings, and automated transcriptions of the voicemail content. We use this information to deliver the voicemail to you (e.g., by email with transcript and recording link) and to operate our business communications. By using or being reachable through these systems, you acknowledge that voicemail content may be recorded and transcribed and processed as described herein.

We offer APIs and access keys so that authorized applications (e.g., creator or talent apps) can access platform features such as marketplace checkout, newsletter signup, and product listing on your behalf. API keys are hashed and stored with associated user and scope information; we use them to authenticate requests and enforce permissions. Data sent to or from our APIs (e.g., checkout parameters, newsletter email, external user IDs) is processed as described in this Policy for the relevant feature (payments, newsletter, etc.).

We integrate with third-party services including Stripe, Wise, Apollo, Twilio, Google (Gmail, Calendar), Meta, YouTube, TikTok, and others. Each integration may involve the transfer and processing of personal data as necessary to provide the related feature. Such processing is subject to this Policy and, where applicable, the third party's terms and privacy policy. We require service providers to protect personal data under contractual obligations consistent with applicable law.

We use cookies and similar technologies for necessary operation of the Services, preferences, analytics, and marketing. Where required by law, we obtain your consent before using non-essential cookies or analytics. Our cookie consent mechanism allows you to accept all, reject non-essential, or customize preferences (e.g., analytics on or off, marketing on or off). Your choices are stored and honored for subsequent visits. Essential cookies are used regardless of consent to ensure security, authentication, and core functionality.

Where you consent to analytics, we may use services such as Google Analytics to collect usage data (e.g., pages visited, referral sources) to improve our site and services. You may withdraw consent or update preferences at any time through our cookie settings or your browser controls.

We share personal information with service providers that process data on our behalf (e.g., cloud hosting, payment processing, email and telephony, analytics, CRM and enrichment). We ensure such providers are bound by contracts that require appropriate security and use of data only for the purposes we specify. We may share with platform partners (e.g., social networks, Stripe) to the extent necessary to operate connected features you have authorized. We may disclose personal information to legal and regulatory authorities when required by law, to enforce our terms, to protect rights and safety, or in connection with a corporate transaction (e.g., merger or sale), subject to applicable law.

We do not sell your personal information in the sense of a sale for monetary consideration under the CCPA. We may share hashed or de-identified data for analytics or product improvement where this does not identify you.

We implement technical and organizational measures to protect personal information, including encryption in transit and at rest where appropriate, access controls, secure credential and token storage, and regular review of our security practices. In the event of a security incident that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant regulators as required by applicable law (e.g., within timeframes specified under GDPR or local regulations).

We retain your information for as long as necessary to provide the Services, fulfill the purposes described in this Policy, and comply with legal, tax, and regulatory obligations. When data is no longer needed, we securely delete or anonymize it in accordance with our retention and deletion procedures.

Your personal information may be transferred to and processed in countries other than your country of residence. Where we transfer data from the EEA, UK, or other restricted jurisdictions, we rely on adequacy decisions, Standard Contractual Clauses, or other approved transfer mechanisms to ensure an adequate level of protection. You may request details of the safeguards we use for specific transfers by contacting us.

Depending on your location, you may have the right to access, correct, delete, or port your personal information, to restrict or object to certain processing, to withdraw consent where processing is consent-based, and to lodge a complaint with a supervisory authority. California residents may have additional rights under the CCPA (e.g., right to know, delete, correct, limit use of sensitive personal information, and non-discrimination). To exercise these rights, contact us at the address below. We will respond within the timeframes required by applicable law and may need to verify your identity before processing your request.

Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it. Where we provide services to minors in the context of talent representation, we may collect limited information as necessary, with appropriate parental or guardian consent where required by law.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The effective date at the top of this Policy indicates when it was last revised. Material changes will be communicated by posting the updated Policy and, where appropriate, by email or other prominent notice. Your continued use of the Services after the effective date of changes constitutes acceptance of the updated Policy.