Privacy Policy

Effective Date: October 13, 2026 | Last Updated: October 15, 2026

Version 2.2 (DRAFT)

1. INTRODUCTION

Qingo LLC (“Qingo,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you interact with our smart vending equipment (“Equipment” or “Machines”) and related services (collectively, the “Services”), or visit our website at www.qingo.com.

Please read this Privacy Policy carefully. By using our Services, you acknowledge that you have read and understood the practices described in this policy. If you do not agree with this policy, please do not use our Services.

If you are a business customer, operator, or retailer deploying our equipment at your locations, a separate Data Processing Agreement (DPA) is available upon request to address your specific compliance and data protection requirements. Please contact us at ryan@qingo.com to request a DPA.

For residents of Quebec (Canada): In accordance with Law 25 (the Act respecting the protection of personal information in the private sector), this Privacy Policy is drafted in clear and simple language. A French translation of this Privacy Policy can be provided upon request by contacting us at ryan@qingo.com.

2. WHO WE ARE

Qingo LLC is a smart vending solutions provider headquartered at 355 S. GRAND AVE. SUITE 2450, LOS ANGELES, CA 90071. We operate automated vending equipment that uses cameras to record video of product inventory and verify dispensing. Qingo acts as a data controller for the personal data we process as described in this policy.

For questions about this Privacy Policy or our data practices, contact our Data Protection Officer (DPO):

• Email: ryan@qingo.com

• Address: 355 S. GRAND AVE. SUITE 2450, LOS ANGELES, CA 90071

3. INFORMATION WE COLLECT

We collect only the data necessary to operate our Services. Below is a complete and exhaustive list of the categories of information we collect:

3.1 Transaction Data

• Transaction timestamp and unique transaction identifier

• Product or service purchased

• Transaction amount

• Payment method type (e.g., credit card, mobile payment)

• Last four digits of the payment card (for receipt and refund reference only)

3.2 Payment Card Information

Payment card data is processed within a PCI-DSS compliant payment environment: card data is tokenized directly at the payment terminal, and card authorization is routed via the terminal vendor’s payment platform to certified card acquirers. Qingo does not collect, receive, or store full payment card numbers (PANs). Your payment card data is tokenized directly at the payment terminal before any transmission to our systems.

3.3 Visual Data (Video Recordings)

Our machines contain cameras that record video of the interior of the vending machine only — specifically, video of products and the dispensing area. The camera is mounted at the top of the machine and records from a top-down angle, following the product’s path from the interior product compartment to the collection area; it does not face, and is not designed to record, the front of the machine or any person. This video is used to verify product dispensing, monitor inventory, resolve transaction disputes (e.g., if a product fails to dispense), and train and improve automated goods-recognition models. These recordings contain no identifiable individual, and no analysis of any person is performed on them.

Important: Our cameras are designed and configured not to:

• Record video of your face, body, or any other part of you as a person

• Record video of the surrounding environment, other people, or passersby

• Use facial recognition technology of any kind

• Collect any biometric data (fingerprints, voice, iris, gait, etc.)

• Record audio — no microphones are installed in our equipment

All video recordings are limited exclusively to the interior product compartment and dispensing mechanism of the vending machine. Incidental capture that may occur when a hand or arm of restocking or service personnel enters the collection area during an authorized door-open session is not used for any identification purpose.

Visual Data is captured only during an authorized door-open session, beginning when the Equipment confirms the authorized door-open event and ending when the corresponding door-close event is recorded. Because Visual Data is captured only during authorized door-open service sessions, individuals purchasing products in the ordinary course are not video-recorded.

Video recordings are retained for a maximum of 90 days and are automatically and permanently deleted thereafter, except for video recordings associated with unresolved or pending payment transactions (e.g., chargebacks, payment disputes, or uncollected payments), which are retained beyond the 90-day period until the underlying payment matter is fully resolved, after which they are promptly and permanently deleted.

3.4 Network Connection Data

• Connection timestamps

• Signal strength and data transfer status

• Used solely for network diagnostics and troubleshooting

• Retained for a maximum of 30 days

3.5 Website Data

When you visit www.qingo.com, we may automatically collect standard technical information, such as:

• IP address (not logged in full by our analytics tools; processed in aggregated form)

• Browser type and version

• Pages visited and time spent on each page

• Referring website or source

3.6 Website Inquiry Data

When you submit our website contact or inquiry form (for example, sales, support, demo, or partnership requests), we collect the following information that you provide:

• Full name

• Email address

• Phone number

• Company name

• Country / region

• Inquiry category (for example, distributor, operator, or other)

• The content of your message

We use this information solely to respond to your inquiry and to follow up on your request. Submitting the form is voluntary; the form is not used for automated decision-making or profiling.

3.7 What We Do NOT Collect

To be absolutely clear, Qingo is designed not to collect, store, or process any of the following categories of data:

• Facial recognition data or facial images of any person

• Biometric data (fingerprints, voiceprints, iris, gait, or similar)

• Audio recordings

• Location data of individuals (GPS or similar)

• Behavioral or profiling data

• Special categories of personal data (sensitive data)

• Data concerning children (we do not knowingly collect any)

4. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

• Transaction Processing — to complete your purchase and provide receipts.

• Inventory Management — video recordings of the product compartment verify dispensing accuracy and monitor stock levels.

• Dispute Resolution — transaction records and video recordings help resolve disputes (e.g., product not dispensed).

• Service Improvement — aggregated, anonymized data helps us improve machine reliability and user experience.

• Model Training (Goods Recognition) — video recordings of the interior product compartment and dispensing mechanism may be used to train and improve our automated goods-recognition models. These recordings contain no identifiable individual, and no analysis of any person is performed. Alibaba Cloud infrastructure in mainland China temporarily stores and automatically processes interior-compartment video cache supporting goods-recognition model training; see Section 9 (International Data Transfers).

• Responding to Inquiries — to respond to and follow up on sales, support, demo, and partnership requests submitted through our website contact form.

• Legal Compliance — to comply with applicable laws, regulations, and legal processes.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.

5. LEGAL BASIS FOR PROCESSING

Our processing of your personal data is based on the following legal grounds, as applicable under the laws of the jurisdictions in which we operate:

• Contractual Necessity — processing transaction data to fulfill your purchase and provide our Services.

• Legitimate Business Interests — processing visual data (video recordings of the product compartment) for inventory management, dispensing verification, dispute resolution, and goods-recognition model training. We have assessed these interests against your privacy rights and determined they are proportionate and necessary.

• Legal Obligations — retaining certain records as required by applicable tax, accounting, and consumer protection laws.

• Consent — where required by applicable law, we will obtain your consent before processing your personal data. You may withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

• Responding to Inquiries — processing website inquiry data (name, contact details, company, and message content) to respond to and follow up on your request, based on your voluntary submission of the form and our legitimate interest in responding.

For residents of Quebec (Canada): Under Quebec’s Law 25, processing of personal information requires a serious and legitimate purpose. We ensure that our processing activities meet this standard and that consent, where required, is obtained in a clear, specific, and granular manner. For processing activities involving minors under 14 years of age, consent must be given by the person having parental authority.

6. HOW WE SHARE YOUR INFORMATION

We do not sell your personal data, and we do not share your personal data for cross-context behavioral advertising.

For purposes of the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and similar state laws, Qingo does not sell or share personal information as defined by CCPA/CPRA. Qingo has not sold or shared personal data in the preceding 12 months and has no plans to do so.

CCPA/CPRA “Do Not Sell or Share” Statement: Because Qingo does not sell or share personal information as defined by CCPA/CPRA, a “Do Not Sell or Share My Personal Information” opt-out link is not required. Qingo honors Global Privacy Control (GPC) signals as a universal opt-out preference mechanism, as described in Section 10.2. If Qingo introduces advertising or analytics tracking technologies that constitute a sale or sharing of personal information under CCPA/CPRA in the future, Qingo will update this Privacy Policy and deploy a “Do Not Sell or Share My Personal Information” opt-out mechanism before any such processing begins.

We may share your information with trusted third-party service providers who help us operate our Services. All service providers are contractually bound to protect your data and use it only as instructed by us:

6.1 Service Providers (Sub-processors)

Our key service providers include:

• Stripe — processes subscription service fee payments charged by Qingo to its business customers. Stripe is a US-based payment processor and operates under PCI-DSS Level 1 compliance.

• Card Acquirers (Canada and the United States) — Nuvei (Canada) and Universal Processing (UP) (United States) provide card acquiring services for consumer purchases made at Qingo Equipment in their respective markets, processing card authorization and settlement of funds to our business customer’s merchant account. Nuvei is a Canada-based acquirer and Universal Processing is a US-based acquirer; both operate under PCI-DSS compliance.

• Other Card Acquirers (markets outside Canada and the United States) — in markets outside Canada and the United States, card acquiring for consumer purchases made at Qingo Equipment is provided by the PCI-DSS certified card acquirers integrated with the Payment Terminal Platform Providers listed below for the applicable market. Our business customer contracts directly with the card acquirer for its market and holds the merchant account; the acquirer(s) applicable to each deployment market are identified at account setup, and notice of any change to the acquirer(s) for the applicable market will be provided to the affected business customer at or before the change. All such acquirers operate under PCI-DSS compliance.

• Payment Terminal Platform Providers (PAX, Nayax, WizarPOS, Castles) — provide the payment terminals integrated into the Equipment together with their payment platform services. Card data is tokenized at the PCI-DSS compliant terminal at the point of interaction, and the vendors’ platforms route the tokenized authorization requests and associated transaction data between the Equipment and the card acquirers for each market in which the Equipment is deployed (including Nuvei and Universal Processing), enabling Qingo to reach acquirers worldwide through a unified terminal integration. These platforms process only tokenized payment data. The platform services used by Qingo operate entirely outside mainland China; no payment data or transaction data is transferred to, stored in, or accessible from any mainland China region. All four vendors supply PCI PTS certified payment terminals; Nayax operates a PCI-DSS Level 1 certified payment platform, and PAX operates the PCI-DSS certified PAXSTORE platform.

• Tencent Cloud — hosts our backend production cloud infrastructure for the Services (including transaction data storage and processing) in the Virginia, United States region. Data is encrypted at rest (AES-256) and in transit (TLS 1.2/1.3).

• Alibaba Cloud — provides (a) IoT connectivity services for our Equipment, comprising device long-lived connections and the reporting and delivery of device commands, hosted in the Virginia, United States region; these services carry only device connection and command data, and no transaction metadata, payment data, video recordings, or other content relating to identifiable individuals is transmitted or stored through them; (b) original storage of order video (Visual Data of the interior product compartment and dispensing mechanism captured to verify dispenses), hosted in the Virginia, United States region; and (c) infrastructure in mainland China solely for temporary storage and automated processing of interior-compartment video cache supporting goods-recognition model training. The mainland China infrastructure does not store transaction metadata, device logs, payment data, or other business data. Cached video is automatically deleted no later than 90 days after collection. Data is encrypted at rest (AES-256) and in transit (TLS 1.2/1.3).

• Telecommunications Providers — provide cellular connectivity (4G/LTE) for our equipment. All data transmitted over cellular networks is encrypted.

All service providers are contractually bound to protect your data and process it only according to our documented instructions. An up-to-date list of our sub-processors is available upon request at ryan@qingo.com.

6.2 Legal and Safety Disclosures

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Qingo, our customers, or the public.

6.3 Business Transfers

If Qingo is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

7. HOW WE PROTECT YOUR DATA

We implement appropriate technical and organizational measures to protect your personal data:

7.1 Encryption

• All data in transit is encrypted using TLS 1.2 / TLS 1.3.

• Payment data is encrypted and tokenized at the point of interaction (PCI-DSS compliant).

• Data at rest in our cloud infrastructure is encrypted using AES-256.

• Data temporarily cached on devices is encrypted (AES-128 minimum).

• API communications use mutual TLS (mTLS) with OAuth 2.0 authentication.

7.2 Access Control

• Role-based access control (RBAC) with principle of least privilege.

• Multi-factor authentication (MFA) required for all administrative access.

• Access logs are maintained and regularly reviewed.

7.3 Network and Physical Security

• Our vending equipment uses dedicated SIM-based cellular connections (4G/LTE).

• Equipment does not connect to facility-owned networks, Wi-Fi, or LAN infrastructure.

• Equipment includes tamper-evident seals and sensors.

• Firmware uses secure boot with cryptographic signature verification.

• Regular penetration testing and vulnerability scanning.

• Intrusion detection and prevention systems (IDS/IPS).

7.4 Organizational Measures

• All personnel with data access undergo background checks.

• Annual mandatory security and privacy training for all employees.

• Documented incident response plan with defined escalation procedures.

• Regular internal audits and third-party security assessments.

7.5 Data Breach Notification

In the event of a personal data breach, Qingo will:

• Promptly investigate and contain the breach upon discovery.

• Notify affected business customers without undue delay and, in any event, no later than seventy-two (72) hours after becoming aware of a personal data breach affecting their data.

• Where required by applicable law, notify affected individuals and relevant data protection authorities directly.

• Provide affected parties with a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach.

8. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following table summarizes our data retention schedule by data category:

8.1 Data Retention Period Table

Data Category	Retention Period	Deletion Trigger	Legal Basis for Retention
Account Information (business customer accounts)	Duration of business relationship + 36 months after termination	Automatic deletion 36 months after contract termination	Contract performance and legal/tax compliance
Transaction Data (timestamp, product, amount, method, last 4 digits)	36 months (3 years)	Automatic deletion after 36 months	Accounting, tax compliance, and dispute resolution
Device Telemetry Data (network diagnostics, connection logs)	30 days	Automatic deletion after 30 days	Network diagnostics and troubleshooting
Payment Data (tokenized payment tokens)	36 months (aligned with Transaction Data); tokens supporting recurring subscription billing: duration of the subscription plus 13 months	Automatic deletion after 36 months; retention verified at least once every three (3) months per PCI-DSS Requirement 3.2.1	PCI-DSS compliance
Visual Data (interior video recordings)	90 days	Automatic deletion after 90 days; extended only for unresolved disputes until resolution, then permanently deleted	Dispute resolution and inventory management
Communication Records (customer support inquiries)	24 months	Automatic deletion after 24 months	Customer service and legal compliance
Website Inquiry Data (contact form submissions)	24 months	Automatic deletion after 24 months	Customer service, sales follow-up, and business development
Website Data (IP, browser info, pages visited)	12 months	Automatic deletion after 12 months	Analytics and service improvement (aggregated/anonymized)

Upon expiration of the applicable retention period, data is securely and permanently deleted using industry-standard secure deletion methods.

We periodically audit our data deletion processes to verify compliance with our retention commitments and can provide deletion attestation to business customers upon request.

9. INTERNATIONAL DATA TRANSFERS

Qingo’s production data processing infrastructure and data storage are located in the Virginia, United States region. For network performance, we may operate lightweight edge gateway nodes in certain regions (including the European Economic Area) that route encrypted traffic to our primary US infrastructure. These edge nodes do not store, cache, or process your personal data — they serve strictly as network entry points. The limited mainland China video-cache processing and remote access described below are exceptions to this production-environment description.

Access from Outside the United States and Mainland China Video Cache. Authorized personnel of Qingo LLC located in China may remotely access personal data for the limited purposes of systems operation, monitoring, quality assurance, and support. That access is provided on a remote-view-only basis through controlled access channels; no local copy is retained, and any temporary session data is discarded when the session ends. The controlled access channels through which this access is provided are hosted in the United States. In addition, Alibaba Cloud infrastructure in mainland China is used solely for temporary storage and automated processing of interior-compartment video cache supporting goods-recognition model training. It does not store transaction metadata, device logs, payment data, or other business data; cached video is automatically deleted no later than 90 days after collection. Both the remote access and the transfer of video cache to servers in China constitute transfers of personal data outside the United States and outside Canada. Qingo remains accountable for personal data processed in this manner.

If you are located outside the United States (including in Canada or the EEA), your personal data will be transferred to and processed in the United States.

Cross-Border Transfer Statement (EEA Residents): Data may be transferred to countries outside the EEA. Qingo relies on Standard Contractual Clauses (SCCs) as its transfer mechanism for EEA data. Qingo has not self-certified under the EU-US Data Privacy Framework (DPF) and does not rely on the DPF as a transfer mechanism. Qingo commits to incorporating SCC Module 2 (Controller to Processor) into its Data Processing Agreements with EEA business customers and conducts Transfer Impact Assessments prior to EEA deployment to ensure appropriate safeguards are in place.

We protect your data during transfer and storage using industry-standard security measures, including TLS encryption for data in transit and AES-256 encryption for data at rest. For more details, please refer to Section 7 (How We Protect Your Data).

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), Qingo remains accountable for personal information transferred to third parties for processing outside of Canada. We use contractual measures (including data processing agreements with standard contractual clauses) with our sub-processors to ensure a comparable level of protection for personal information transferred outside of Canada.

For residents of Quebec (Canada): In accordance with Quebec’s Law 25, we conduct privacy impact assessments (PIAs) before transferring personal information outside of Quebec. These assessments evaluate the adequacy of protections in the recipient jurisdiction and the contractual measures in place. By using our Services, you acknowledge that your data will be transferred to and processed in the United States. You may withdraw this consent in accordance with Section 10 (Your Privacy Rights).

10. YOUR PRIVACY RIGHTS

Depending on your jurisdiction, you may have the following rights regarding your personal data:

10.1 General Rights

Regardless of your jurisdiction, you may contact us to:

• Request access to the personal data we hold about you.

• Request correction of inaccurate or incomplete data.

• Request deletion of your personal data, subject to our legal and operational retention requirements.

• Withdraw consent where processing is based on consent.

• Appeal our decision regarding your privacy rights request. If we deny your request, we will provide a written explanation and instructions on how to appeal the decision. Your appeal will be reviewed by a qualified individual not involved in the original decision.

10.2 US State Privacy Law Rights

Qingo operates in all 50 US states. Depending on your state of residence, you may have additional rights under applicable state privacy laws. In addition to the General Rights listed in Section 10.1, these may include:

California Residents — CCPA / CPRA:

• Right to Know — request disclosure of categories and specific pieces of personal data collected.

• Right to Delete — request deletion of personal data we have collected.

• Right to Correct — request correction of inaccurate personal data.

• Right to Opt Out of Sale/Sharing — Qingo does not sell or share personal information as defined by CCPA/CPRA. No opt-out mechanism is required because no sale or sharing occurs.

• Right to Limit Use of Sensitive Personal Information — though we do not collect sensitive personal information as defined under CPRA.

• Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA/CPRA rights.

Other US State Privacy Laws:

In addition to California, the following states have enacted comprehensive consumer privacy laws: Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Delaware (DPDPA), New Jersey (NJDPA), Tennessee (TIPA), Indiana (ICDPA), Iowa (ICDPA), Kentucky (KCDPA), Nebraska (NDPA), New Hampshire (NHPA), Maryland (MODPA), Minnesota (MCDPA), and Rhode Island (RIDTPA).

Under these laws, you generally have rights to access, correct, delete, and obtain a portable copy of your personal data. You also have the right to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. Where required, we honor universal opt-out preference signals, including the Global Privacy Control (GPC).

We respond to verified consumer requests in accordance with the timeframe required by your state’s law. If we deny your request, you may appeal our decision as described in Section 10.1. If your appeal is denied, you may submit a complaint to your state’s Attorney General or designated privacy enforcement authority.

10.3 Quebec Law 25 Rights (Quebec, Canada)

If you are a Quebec resident, you have the following additional rights under Quebec’s Law 25 (Act respecting the protection of personal information in the private sector, CQLR c. P-39.1):

• Right to Data Portability — request your personal information in a structured, commonly used technological format (e.g., JSON, CSV).

• Right to De-indexation — request that we cease disseminating your personal information or de-index any hyperlink that allows access to it, where dissemination causes you serious harm or contravenes applicable law.

• Right to Information on Automated Decisions — be informed when a decision affecting you is based exclusively on automated processing, including profiling. You have the right to be informed of the personal information used, the reasons and principal factors leading to the decision, and your right to have the decision reviewed by a natural person.

• Consent for Minors Under 14 — processing of personal information concerning a minor under 14 years of age requires consent from the person having parental authority.

• Enhanced Consent — consent must be clear, specific, and given for each purpose. It must be requested in clear and simple language, separately from any other information provided to you.

To exercise your Quebec Law 25 rights, please contact us at ryan@qingo.com. We will respond within 30 days of receiving your request. You may also lodge a complaint with the Commission d’accès à l’information du Québec (CAI) at www.cai.gouv.qc.ca.

10.4 PIPEDA / Provincial Rights (Canada)

If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including:

• Right to Access — request access to your personal information held by Qingo.

• Right to Challenge Accuracy — challenge the accuracy and completeness of your personal information and have it amended as appropriate.

• Right to Withdraw Consent — withdraw your consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.

10.5 GDPR Rights (EEA / EU)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access (Art. 15) — request confirmation of whether we process your personal data and obtain a copy.

• Right to Rectification (Art. 16) — request correction of inaccurate or incomplete personal data.

• Right to Erasure / “Right to be Forgotten” (Art. 17) — request deletion of your personal data where there is no overriding legitimate ground for continued processing.

• Right to Restriction of Processing (Art. 18) — request that we limit processing of your personal data in certain circumstances.

• Right to Data Portability (Art. 20) — request a copy of your personal data in a structured, commonly used, and machine-readable format, and the right to transmit that data to another controller where technically feasible.

• Right to Object (Art. 21) — object to processing based on legitimate interests or direct marketing at any time.

• Right to Withdraw Consent (Art. 7) — where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

• Right Not to be Subject to Automated Decision-Making (Art. 22) — the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

To exercise your GDPR rights, please contact us at ryan@qingo.com. We will respond within one (1) month of receiving your request (extendable by two further months for complex or numerous requests, in which case we will inform you of the extension within one month of receipt). If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement (see Section 14 for contact details).

10.6 Exercising Your Rights

To exercise any of these rights, please contact us at:

• Email: ryan@qingo.com

• Mail: 355 S. GRAND AVE. SUITE 2450, LOS ANGELES, CA 90071

We will respond to your request within the timeframe required by applicable law (typically 30 days, extendable for complex requests). We may need to verify your identity before processing your request. You may designate an authorized agent to submit requests on your behalf.

11. CHILDREN’S PRIVACY

Our Services are not directed to children. We do not knowingly collect personal data from children under the applicable age of digital consent in their jurisdiction. The relevant ages vary by jurisdiction: for example, 16 years of age under California’s CCPA/CPRA, 13 years under the federal Children’s Online Privacy Protection Act (COPPA), and 14 years under Quebec’s Law 25.

We do not have actual knowledge that we collect, use, or disclose personal data of children under any of these thresholds. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at ryan@qingo.com and we will take prompt steps to verify and delete such information.

For residents of Quebec: Under Law 25, processing of personal information concerning a minor under 14 years of age requires consent from the person having parental authority. If we become aware that we have inadvertently collected such information without proper consent, we will delete it promptly.

12. COOKIES AND TRACKING TECHNOLOGIES

Our website at www.qingo.com uses the following types of cookies and similar technologies:

• Essential Cookies — required for the website to function properly (e.g., session management, security preferences). These cannot be disabled as they are necessary for the core functionality of the website.

• Analytics Cookies — we use Google Analytics (GA4), loaded via Google Tag Manager and the Google Site Kit plugin, to understand how visitors interact with our website in aggregate. Google Analytics processes usage data (such as pages visited, session duration, and approximate region) and is configured not to log individual IP addresses. Analytics cookies are set when you visit our website; you can disable or delete them at any time through your browser settings, and we honor Global Privacy Control (GPC) signals where required by applicable law.

We do not currently use:

• Tracking cookies for advertising or cross-site behavioral tracking.

• Facebook Pixel, Meta Pixel, or similar social media tracking pixels.

• Third-party advertising networks or retargeting cookies.

Future tracking technologies: If we introduce advertising or cross-context behavioral tracking technologies in the future (including social media pixels such as the Meta Pixel), we will update this Privacy Policy and treat the change as a material change under Section 13 before deployment, and, where required by applicable law, we will obtain your opt-in consent or provide an opt-out mechanism (including honoring Global Privacy Control signals) before any such tracking begins.

You can control cookies through your browser settings. Please note that disabling essential cookies may affect the functionality of our website.

For residents of Quebec (Canada): In accordance with Quebec’s Law 25, we request your consent for non-essential cookies (including analytics cookies); you may refuse or withdraw consent at any time through your browser settings or by contacting us at ryan@qingo.com.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other operational reasons. We distinguish between two types of changes:

13.1 Material Changes

Material changes are those that significantly affect how we collect, use, share, or retain your personal data, or that materially alter your privacy rights. When we make material changes, we will:

• Provide advance notice by email to registered users at least 30 days before the changes take effect.

• Post the updated policy on our website with a new “Last Updated” date and a prominent notice of the changes on our homepage.

• Where required by law, obtain your consent to material changes before they take effect.

13.2 Non-Material Changes

Non-material changes are minor updates such as clarifications, formatting changes, or administrative updates that do not affect your privacy rights or how we process your data. For non-material changes, we will:

• Post the updated policy on our website with a new “Last Updated” date.

• No separate notice is required for non-material changes.

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after changes are posted constitutes your acceptance of the updated policy, except where your explicit consent is required by applicable law.

14. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Data Protection Officer (DPO)

• Email: ryan@qingo.com

• Address: 355 S. GRAND AVE. SUITE 2450, LOS ANGELES, CA 90071

Security Team

• Email: ryan@qingo.com

• Response Time: Within seven (7) days for security-related inquiries.

Regulatory Complaints

If you believe your privacy rights have been violated, you have the right to lodge a complaint with the appropriate data protection authority in your jurisdiction. Key authorities include:

• California (USA): California Privacy Protection Agency (cppa.ca.gov)

• Canada (Federal): Office of the Privacy Commissioner of Canada (priv.gc.ca)

• Quebec (Canada): Commission d’accès à l’information du Québec (cai.gouv.qc.ca)

• British Columbia (Canada): Office of the Information and Privacy Commissioner for BC (oipc.bc.ca)

• Alberta (Canada): Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca)

• EEA / EU: The supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement. You may also contact the European Data Protection Board (EDPB) at edpb.europa.eu.

For other US states, you may contact your state’s Attorney General or designated privacy enforcement authority. We encourage you to contact us first at ryan@qingo.com so we may address your concerns directly.