Privacy Policy

cr8s, LLC (collectively referred to hereinafter as "cr8s", "us", "we", or "our") is committed to protecting Your privacy online. We are also committed to providing You with the very best experience we can on our website at cr8s.com and cr8s mobile (our "Sites") and all related sites and other web-based services that enable website visitor access on our behalf, including players, widgets, tools and other services provided by cr8s (collectively, the "Services"). This Privacy Policy explains the types of Personal Data we collect from website visitors and other people with whom we communicate and interact in the course of providing the Services. This Privacy Policy also describes how we use Your Personal Data, the purpose for sharing it, and the recipients of Personal Data along with Your rights and choices associated with that data.

By using cr8s, You are consenting to the practices described in this Privacy Policy.

This Privacy Policy explains the following:

• Definitions
• Roles
• Collection of Personal Data
• Use of Personal Data
• Sharing Personal Data
• Security and Retention
• Transfer of Data
• Your Rights and Choices
• Notice for California Residents
• Cookie Policy and Interest-based Advertising
• Links to Other Websites
• Jurisdictional Data Protection
• Changes to This Privacy Policy
• Contact Us

If You are a California resident, You can learn about Your additional consumer privacy rights under the California Consumer Privacy Act by reviewing our California-based users information in sections IX and XII.

This Privacy Policy applies to any Site and Service that links to this Privacy Policy. This Policy does not apply to third-party websites, products, or services, even if they link to our Site or Services. We recommend You review the privacy practices of those third parties before connecting Your cr8s account or sharing any personal data. We also encourage You to read this Privacy Policy, along with our Terms of Use, to understand how Your personal data will be treated as You make full use of our Services. Unless otherwise defined in this Privacy Policy, capitalized terms used in this Privacy Policy have the same meanings as in our Terms of Use.

By using the Services, You agree to the collection and use of information in accordance with this Privacy Policy. We ask that You do not use the Services if You do not agree to any of the provisions in this Privacy Policy. You may also email us at privacy@cr8s.com should You have any further questions or require additional information after reading this document.

I. Definitions

Personal Data

"Personal Data" means any information that relates to an identified or identifiable natural person.

Processing

"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Profiling

"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

Usage Data

"Usage Data" is data collected automatically either generated by the use of the Services or from the Services infrastructure itself (for example, the duration of a page visit).

Cookies

"Cookies" are text files placed on Your computer to collect standard Internet log information and visitor behavior information.

Data Controller

"Data Controller" means the natural or legal person, public authority, agency, or other body which alone or jointly with others, determines the purposes for which and the manner in which any personal data are, or are to be, processed. For the purpose of this Privacy Policy, cr8s is a Data Controller of Your data.

Data Processor (or Service Providers)

"Data Processor (or Service Provider)" means the natural or legal person (other than an employee of the Data Controller) who processes the data on behalf of the Data Controller. We may use the services of various Service Providers in order to process Your data more effectively.

Data Subject

"Data Subject" is any living individual who is the subject of Personal Data.

User

The "User" is the individual using our Services. The User corresponds to the Data Subject, who is the subject of Personal Data.

Consent

"Consent" of the Data Subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies.

II. Roles

A. Data Controller

A Data Controller is the legal entity that determines the means and the purposes of any processing activities that it carries out. cr8s is the Data Controller of Your Personal Data.

B. Data Processor

A Data Processor is the legal entity that carries out the processing activities on behalf of the Data Controller.

C. Data Protection Representative

cr8s has appointed Data Protection Representatives ("DPR") in connection with this Privacy Policy. The DPRs ensure that cr8s remains compliant with the GDPR and the UK GDPR and any other applicable Data Privacy Laws.

If You reside in the European Union, You may contact our DPR via the following: dpr@cr8s.com.

III. Collection of Personal Data

We collect several different types of Personal Data, for various purposes to provide and improve our Services to You.

Other than the online contact information required to obtain parental consent, we do not knowingly collect or sell any Personal Information from Users under the age of 13. If You are a User under the age of 13, please do not send any Personal Information to us. If we learn we have collected Personal Information from a User under the age of 13, we will delete that information as quickly as possible. If You believe that a User under the age of 13 may have provided us Personal Information in violation of this Privacy Policy, please contact us at privacy@cr8s.com.

Personal Data we collect will be apparent by the context of the page, and may include, but is not limited to the following:

Account information

• Your first and last name, email address, and Your password

Public Profile information

• Information to Your profile on cr8s, which may be made public, including Your username, profile photo, audio/visual content you upload, comments you post, and playlists you make

Technical Data

• Technical data (Device Signature), including but not limited to information about the date, time and Your activity, Your IP address and domain name, Your software and hardware attributes as well as Your general geographic location (e.g. city, state, country)
• Machine-readable data, metadata and device and network information

Compliance Data

• Evidence and records of legal basis (including consents), for example in cases where we are required or have elected to obtain a consent or a written release or another legal basis prior to processing certain Personal Data

Financial and/or Transactional Data

• External account details
• Source of funds and related documentation
• Details about payments to and from You
• Other details of any transactions You enter into using the Services

Communications

• When You communicate with us or other Users through the Sites and Services or otherwise communicate with us by email, we collect information about the communication and any other information You provide in Your response.
• In addition to the uses described below, we may use Your Personal Data to contact You with newsletters, marketing or promotional materials and other information that may be of interest to You. You may opt out of receiving any, or all, of these communications from us by following the unsubscribe link or instructions provided in any email we send or by contacting us.

Profile Data

• Your username and password
• Your identification number as our user
• information on whether You have cr8s account and the email associated with Your accounts
• requests by You for products or services
• Your interests, preferences and feedback
• other information generated by You when You communicate with us, for example when You address a request to our customer support

Usage Data

We may also collect information that Your browser sends whenever You visit our Services or when You access the Services by or through a mobile device ("Usage Data").

This Usage Data may include information such as:

• Your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Services that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
• Information such as the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

Location Data

• We may use and store information about Your location if You give us permission to do so ("Location Data"). We use this data to provide features of our Services, to improve and customize our Services.
• You can enable or disable location services when You use our Services at any time, through Your device settings.

Tracking Cookies Data

• When You visit our websites, we may collect information from You automatically, such as the activity on our Services, through cookies or similar tracking technologies.
• Cookies are sent to Your browser from a website and stored on Your device. Tracking technologies also used are beacons, tags, and scripts to collect and track information and to improve and analyze our Services. We may also allow our business partners to use cookies and similar tracking technologies on the Services or work with third parties to track Your behavior on our behalf. You can instruct Your browser to refuse all cookies or to indicate when a cookie is being sent. However, if You do not accept cookies, You may not be able to use some portions of our Services. Please review our Privacy Policy for information relating to our use of cookies and similar tracking technologies.

Service Providers

• We may receive Personal Data about You from our Service Providers and business partners, such as those that conduct payment processing, analytics, advertising, hosting, marketing, customer and technical support, and other services. Please review the remainder of this Privacy Policy to learn more about how and why we use this information.

Information from third-party sources

• We may collect Personal Data from third-party sources, including things that other third parties may post publicly about You or otherwise provide to us.
• If You register for a cr8s account through a third-party application, we may collect certain information about You.

IV. Use of Personal Data

Our primary goal in collecting Personal Information is to provide You, the user, with a customized experience on our website. We use the collected data for various purposes including:

• To provide and maintain our Sites and Services, including to take steps to enter into a contract for sale or services, bill You for services and process payments and fulfill transactions;
• To enable and allow You to participate in interactive features of our Sites and Services and provide You with a personalized service, content and ads;
• To create custom audiences on social media sites;
• To provide You with better products and services and improve and grow our business, including to perform research and development, understand our customer base and purchasing trends and understand the effectiveness of our marketing;
• To operate and maintain safe, secure and reliable Sites and Services;
• To provide customer support, including to contact You in response to an inquiry that You sent, and send administrative messages, technical notices, updates, alerts and other information;
• To provide You with news, special offers and general information about other goods, services and events which we, and/or our sellers offer that are similar to those that You have already purchased or enquired about unless You have opted not to receive such information;
• To track the progress and number of entries in our promotions and contests;
• To perform accounting, audits and other internal functions; and
• To comply with a request or order from courts, law enforcement or other government authorities.

cr8s may also use Personal Information for other business purposes, including the following: (i) perform accounting, audits and other internal functions; (ii) compliance with our legal obligations or to assert or defend a legal claim; (iii) general business administration; (iv) processing employment applications; and (v) systems and data security.

In addition, if we feel that a user abuses the cr8s.com site in any way, we reserve the right to use and share certain information with third parties. Abuses include (but are not limited to) possible copyright infringement, possible trademark infringement, possible libel and slander, and possible fraudulent or illegal activity.

We use Sensitive Personal Information to perform services for our business, provide goods or services as requested by individuals, and ensure security and integrity, process and fulfill orders, maintain and service accounts, provide customer service, verify customer information, and to process payments and to perform activities relating to quality and safety control or product improvement.

V. Sharing of Personal Data

cr8s does not rent, or trade Your Personal Information with unaffiliated third parties. We share Your Personal Data with the entities listed below.

Business Partners

When one or more of our business partners co-sponsor a service, promotion and/or contest, we may share some or all of the information collected in connection with such service, promotion or contest with the co-sponsor(s). If You do not want Your information to be shared, You will be able to choose not to allow the transfer by not using or signing up for that particular service, promotion or contest.

Service Providers

We may employ third party companies and individuals to facilitate our Services ("Service Providers"), to provide the Services on our behalf, to perform Service-related services or to assist us in analyzing how our Services are used. For example, when You make a purchase through our online store, or sign up to receive promotional items from us, we may share some of Your Personal Information with third parties helping us to complete Your transaction or send You the items You signed up to receive. When we share Your information with such third parties, we will work to ensure that only the information necessary to complete Your transaction is disclosed. This Privacy Policy does not apply to such third parties. These third parties have access to Your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Public Profile

Any information in Your profile will be accessible by other Users of the Sites and Services. If You listen to any music recordings uploaded by another User, the fact that You have listened to those recordings will be shared with that User. Similarly, if You comment on a user's profile, all Users will be able to see Your comment.

Social Media

If You share our content through social media, for example by liking our content or following us on YouTube, YouTube will record that You have done so and may set a cookie for this purpose.

As is the case for all cookies, we cannot access those set by social networks. Additional information about our use of YouTube is described in section X below.

Combined and Aggregated Data

We may analyze aggregated, de-identified data and share these analytics, including to marketing agencies, media agencies and analytics providers. We may also combine information from the Services with other information we obtain. Additionally, information collected about You from a particular browser or device may be linked to information collected from another computer or device that may relate to You.

Vercel Analytics

We use Vercel Analytics to collect information about the use of our Service in order to analyze and improve its performance. For this purpose, anonymized data about page views, time spent on the site and user interactions are collected. This analysis is carried out without the use of third-party cookies and without collecting personal data that would make it possible to identify or recognize individual users - in particular no IP addresses, e-mail addresses or session histories over several days or websites. Vercel's privacy policy can be found at: https://vercel.com/legal/privacy-policy.

Business Transaction

If You make a purchase and/or make a download, we may share certain information about You with the Seller of the applicable product or service. This information may include Your first and last name, username, account type, public user profile information, contact information (such as email address and telephone number), billing address, and details related to Your transaction, including product type, product title, and license name.

This information is shared so that Sellers may: (i) fulfill and support Your purchase; (ii) maintain internal records related to their transactions; and (iii) communicate with You regarding Your purchase, including providing support, offering related or similar products, or responding to Your inquiries, where permitted by applicable law.

Sellers are permitted to use this information solely for their internal business purposes related to transactions conducted through the cr8s platform and may not disclose such information to third parties or use it for purposes unrelated to those transactions. Any unauthorized use of this information may lead to actions, including termination, against the Seller's account in accordance with the cr8s Terms of Use and may lead to legal action under applicable data protection laws.

Additionally, if cr8s LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, Your Personal Data may be transferred as part of that transaction. We will provide notice before Your Personal Data is transferred and becomes subject to a different privacy policy.

Disclosure for Law Enforcement

Under certain circumstances, cr8s LLC may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Legal Requirements

cr8s LLC may disclose Your Personal Data in the good faith belief that such action is necessary to:

• To comply with a legal obligation;
• To protect and defend the rights or property of cr8s LLC;
• To prevent or investigate possible wrongdoing in connection with the Services;
• To protect the personal safety of users of the Services or the public;
• To protect against legal liability.

VI. Security and Retention

We maintain appropriate technical, administrative and physical safeguards to help protect the security of Your Personal Data against unauthorized access, use or disclosure. The security of Your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. Our employees, contractors, and administrators are governed by strict internal confidentiality policies. Personnel are required to use 2FA, and are only granted access to the specific data necessary to perform their job functions.

We will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary for our legitimate and essential business purposes, to comply with our legal obligations (for example, if we are required to retain Your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our Services, or we are legally obligated to retain this data for longer time periods.

VII. Transfer of Data

Your information, including Personal Data, may be transferred to - and maintained on - computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ from those in Your jurisdiction.

If You are located outside the United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to the United States and other countries and process it there.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

cr8s will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other Personal Information.

VIII. Your Rights and Choices

cr8s LLC aims to take reasonable steps to allow You to correct, amend, delete, or limit the use of Your Personal Data.

Whenever made possible, You can update Your Personal Data directly within Your account settings section. If You are unable to change Your Personal Data, please contact us to make the required changes.

If You wish to be informed what Personal Data we hold about You and if You want it to be removed from our systems, please contact us.

Information for Individuals Located in the EU and Switzerland

We rely on the following legal bases to process Your information: (1) as necessary to perform any contract between You and us to provide the Services; (2) as necessary for our legitimate interests in providing the Services where those interests do not override Your fundamental rights and freedoms related to data protection; and (3) with Your consent.

Users that reside in the European Economic Area (EEA) and Switzerland have the right to lodge a complaint about our data collection and processing actions with the appropriate supervisory authority.

In certain circumstances, residents of the EEA or Switzerland are entitled to the following data protection rights:

• Right to access. You have the right to request cr8s for copies of your Personal Data.
• Right to rectification. You have the right to request that cr8s correct any information You believe is inaccurate. You also have the right to request cr8s to complete the information You believe is incomplete.
• Right to erasure. You have the right to request that cr8s erase Your Personal Data, under certain conditions.
• Right to restrict processing. You have the right to request that cr8s restrict the processing of Your Personal Data, under certain conditions.
• Right to object to processing. You have the right to object to cr8s' processing of Your Personal Data, under certain conditions.
• Right to data portability. You have the right to request that cr8s transfer the data that we have collected to another organization, or directly to You, under certain conditions.

If You would like to exercise any of these rights, please contact us by emailing us at privacy@cr8s.com.

IX. Notice for California Residents

If your account with us is associated with a California billing address, we will not disclose Your Personal Data we collect about you except to the extent permitted under California law. For instance, we may disclose Your Personal Data as necessary to process transactions or provide products and services you request, at your instruction, as required for institution risk control, and to safeguard against fraud, identity theft, and unauthorized transactions.

X. Cookie Policy and Interest-based Advertising

When You visit our websites, we may collect information from You automatically through cookies or similar technologies. We also rely on partners to provide many features of our Sites and Services using data about Your use of the Sites and Services. We use cookies for the following purposes:

• Site Operations. To Enable features that are necessary for providing You the services on our Sites, such as keeping You signed in, tracking content views, and remembering Your preferences.
• Analytics. To allow us to understand how our Sites and Services are being used, track site performance and make improvements.
• Social Media. To enable the sharing of content from our Sites through certain social networking and other sites. At this time, we have a YouTube channel. The YouTube channel is administered by YouTube, which we do not operate. To learn more about how YouTube manages and protects your information, please see Google's Privacy Policy, which can be viewed at: https://policies.google.com/privacy. You may optionally connect your YouTube account and channel(s) in order to publish videos directly from the Services to YouTube. We use YouTube API Services in order to operate this feature. To learn more about how Google manages and protects your information, please see Google's Privacy Policy linked above. In order to provide this feature, we access and store certain user information from YouTube (hereby referred to as "YouTube Data"), including your channel name(s), channel ID, channel thumbnail URL, and uploaded video URL. YouTube Data is stored on Google Cloud infrastructure. We do not share your YouTube Data with any other third parties, and restrict internal access to this data to key employees who maintain our technical operations. You may disconnect your YouTube channel(s) at any time from the "Publish to YouTube" section of our application. When you do so, we permanently delete all of your YouTube Data. Additionally, you may revoke our access to your YouTube Data via your Google security settings page.

You can modify Your browser settings to decline or accept cookies. However, in a few cases, some of our Site features may not function as designed.

Please note that opting-out of advertising networks does not mean that You will not receive advertisements while using other websites.

"Do Not Track" Signals

We do not support Do Not Track functionality. Do Not Track is a preference You can set in Your web browser to inform websites that You do not want to be tracked.

You can enable or disable Do Not Track by visiting the Preferences or Settings page of Your web browser

Payments

We may provide paid products and/or services within the Services. In that case, we use third-party services for payment processing (e.g. payment processors).

We will not store or collect Your payment card details. That information is provided directly to our third-party payment processors whose use of Your Personal Information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

The payment processors we work with are:

• PayPal — Their Privacy Policy can be viewed at https://www.paypal.com/us/legalhub/paypal/privacy-full.
• Stripe — Their Privacy Policy can be viewed at https://www.stripe.com/privacy.

XI. Links to Other Websites

Our Services may contain links to other websites that are not operated by us. If You click on a third-party link, You will be directed to that third party's website. We strongly advise You to review the Privacy Policy of every site You visit.

For example, Our Services contain links to discogs.com, which we do not operate. Their privacy policy can be viewed at: https://support.discogs.com/hc/en-us/articles/360009334513-Privacy-Policy.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party websites or services.

XII. Jurisdictional Data Protection

This Data Protection section applies to all users of any services owned or controlled by cr8s.

Each party shall, at its own expense, ensure that it complies with and assists cr8s LLC to comply with the requirements of all legislation and regulatory requirements in force from time to time relating to the use of personal data, including (without limitation) (i) any data protection legislation from time to time in force in the UK including the Data Protection Act 1998 or 2018 and any successor legislation (ii) for so long as and to the extent that the law of the EU has legal effect in the UK, the General Data Protection Regulation ((EU) 2016/679) ("GDPR") and any other directly applicable EU regulation relating to privacy; and (iii) and any applicable U.S Data Protection Laws, not limited to the California Consumer Privacy Act (CCPA). This clause is in addition to, and does not reduce, remove or replace, a party's obligations arising from such requirements. Parties confirm that they will not rent or sell customer lists, contact details or other data without the customers' express prior approval.

Furthermore, under Article 5 of GDPR both parties will comply with the following principles to ensure any personal data will be: a) Processed for limited purposes and not in any way incompatible with those purposes, b) Adequate, relevant and will not be excessive, c) Accurate; not kept for longer than necessary, d) Processed in accordance with the individual rights of any data subject, and e) Secure; not transferred to countries or other parties without adequate data protection.

California Residents: Your California Privacy Rights

Under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 ("CCPA"), California residents have certain rights around cr8s collection, use, and sharing of their Personal Information. cr8s does not sell Your Personal Information and will not do so in the future without providing You with notice and an opportunity to opt-out of such sale as required by law. Similarly, we do not offer financial incentives associated with our collection, use, or disclosure of Your Personal Information. As of May 1, 2026, You have the right to opt-out of sharing Your Personal Information with third parties for the purposes of targeted behavioral advertising, which You can do by interacting with Our cookie banner available on the Service and selecting Your preferences. cr8s collects various categories of Personal Information when You use the Service, including identifiers, commercial information, internet or other electronic network or device activity information, geolocation data, and professional information. A more detailed description of the information cr8s collects and how we use it is provided above in the sections entitled "Collection of Personal Data" and "Use of Personal Data". The section entitled, "Sharing Personal Data" categories of third parties with whom we share Personal Information, and what information may be shared under different circumstances. If You are a resident of California, You have the right to request to know what Personal Information has been collected about You, and to access that information. You also have the right to request deletion of Your Personal Information, though exceptions under the CCPA may allow cr8s to retain and use certain Personal Information notwithstanding Your deletion request. As of May 1, 2026, You have the right to request correction of inaccurate Personal Information and to request to limit disclosure or use of Your sensitive Personal Information. Please note, however, that any right to request correction is limited by the legal rights of cr8s and its users relating to content on cr8s platform, including without limitation legally protected rights related to freedom of speech, freedom of the press, or freedom to information. You can submit a data rights request by email to privacy@cr8s.com. Information on the number of requests cr8s has received in California is available upon request to privacy@cr8s.com. We will not discriminate against You for exercising Your rights under the CCPA. An agent may submit a request on Your behalf, but You must verify that Your agent is authorized to do so. cr8s does not knowingly sell or share the Personal Information of consumers under 16 years of age. Separate from the CCPA, California's Shine the Light law gives California residents the right to ask companies what Personal Information they share with third parties for those third parties' direct marketing purposes. We do not disclose Your Personal Information to third parties for the purpose of directly marketing their goods or services to You unless You agree to such disclosure. cr8s does not sell and has not, within at least the last 12 months, sold Personal Data, including Sensitive Personal Data that is subject to the CCPA's sale limitation. If You have any questions regarding this policy, or would like to change Your preferences, You may contact us at privacy@cr8s.com.

Nevada Residents: Your Nevada Privacy Rights

Nevada law (SB 220) requires website operators to provide a way for Nevada consumers to opt-out of the sale of certain information that the website operator may collect about them. cr8s does not sell Your Personal Information to third parties as defined in Nevada law, and will not do so in the future without providing You with notice and an opportunity to opt-out of such sale as required by law. If You have any questions regarding our data privacy practices or our compliance with Nevada data privacy law please reach out to privacy@cr8s.com. You can submit a data rights request by emailing privacy@cr8s.com.

Virginia Residents: Your Virginia Privacy Rights

Under Virginia's Consumer Data Protection Act ("CDPA"), which goes into effect January 1, 2023, Virginia residents have certain rights around cr8s collection, use, and sharing of their personal data. cr8s does not sell Your personal data and will not do so in the future without providing You with notice and an opportunity to opt-out of such sale as required by law. Similarly, cr8s does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. cr8s may engage in "targeted advertising" as that term is defined in the CDPA. As of May 1, 2026, You have the right to opt-out of targeted advertising by interacting with Our cookie banner available on the Service and selecting Your preferences. cr8s collects various categories of personal data when You use the Service, including identifiers, commercial information, internet or other electronic network or device activity information, geolocation data, and professional information. A more detailed description of the information cr8s collects and how we use it is provided in the sections entitled, "Collection of Personal Data" and "Use of Personal Data." The section entitled "Sharing Personal Data" categories of third parties with whom we share Personal Information. If You are a resident of Virginia, starting May 1, 2026 You have the right to (1) request to know what personal data has been collected about You, and to access that information; (2) request to correct inaccuracies in Your personal data; (3) request deletion of Your personal data, though exceptions under the CDPA and other laws may allow cr8s to retain and use certain personal data notwithstanding Your deletion request; and (4) obtain a copy of Your personal data. You can learn more about how to submit a data rights request, or appeal denial of a request, by emailing privacy@cr8s.com.

Connecticut Residents: Your Connecticut Privacy Rights

Under Connecticut's Data Privacy Act ("CTDPA"), which goes into effect July 1, 2023, Connecticut residents have certain rights around cr8s collection, use, and sharing of their personal data. cr8s does not sell Your personal data and will not do so in the future without providing You with notice and an opportunity to opt-out of such sale as required by law. Similarly, cr8s does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. cr8s may engage in "targeted advertising" as that term is defined in the CTDPA. As of May 1, 2026, You will have the right to opt-out of targeted advertising by interacting with Our cookie banner available on the Service and selecting Your preferences. cr8s collects various categories of personal data when You use the Service, including identifiers, commercial information, internet or other electronic network or device activity information, geolocation data, and professional information. A more detailed description of the information cr8s collects and how we use it is provided above in the sections entitled, "Collection of Personal Data" and "Use of Personal Data." The section entitled "Sharing Personal Data" categories of third parties with whom we share personal data, and what information may be shared under different circumstances. If You are a resident of Connecticut, starting May 1, 2026, You will have the right to (1) request to know what personal data has been collected about You, and to access that information; (2) request to correct inaccuracies in Your personal data; (3) request deletion of Your personal data, though exceptions under the CTDPA and other laws may allow cr8s to retain and use certain personal data notwithstanding Your deletion request; and (4) obtain a copy of Your personal data. You can learn more about how to submit a data rights request, or appeal denial by emailing privacy@cr8s.com.

Colorado Residents: Your Colorado Privacy Rights

Under Colorado's Consumer Privacy Act ("CPA"), which goes into effect July 1, 2023, Colorado residents have certain rights around cr8s collection, use, and sharing of their personal data. cr8s does not sell Your personal data and will not do so in the future without providing You with notice and an opportunity to opt-out of such sale as required by law. Similarly, cr8s does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. cr8s may engage in "targeted advertising" as that term is defined in the CPA. As of May 1, 2026, You will have the right to opt-out of targeted advertising by interacting with Our cookie banner available on the Service and selecting Your preferences. cr8s collects various categories of personal data when You use the Service, including identifiers, commercial information, internet or other electronic network or device activity information, geolocation data, and professional information. A more detailed description of the information cr8s collects and how we use it is provided above in the sections entitled, "Collection of Personal Data" and "Use of Personal Data." The section entitled "Sharing Personal Data" categories of third parties with whom we share Personal Information. If You are a resident of Colorado, starting May 1, 2026, You will have the right to (1) request to know what personal data has been collected about You, and to access that information; (2) request to correct inaccuracies in Your personal data; (3) request deletion of Your personal data, though exceptions under the CPA and other laws may allow cr8s to retain and use certain personal data notwithstanding Your deletion request; and (4) obtain a copy of Your personal data. You can learn more about how to submit a data rights request, or appeal denial of a request, by emailing privacy@cr8s.com.

Utah Residents: Your Utah Privacy Rights

Under Utah's Data Privacy Act ("UCPA"), which goes into effect December 31, 2023, Utah residents have certain rights around cr8s collection, use, and sharing of their personal data. cr8s does not sell Your personal data and will not do so in the future without providing You with notice and an opportunity to opt-out of such sale as required by law. Similarly, cr8s does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. cr8s may engage in "targeted advertising" as that term is defined in the UCPA. As of May 1, 2026, You will have the right to opt-out of targeted advertising by interacting with Our cookie banner available on the Service and selecting Your preferences. cr8s collects various categories of personal data when You use the Service, including identifiers, commercial information, internet or other electronic network or device activity information, geolocation data, and professional information. A more detailed description of the information cr8s collects and how we use it is provided above in the sections entitled, "Collection of Personal Data" and "Use of Personal Data." The section entitled "Sharing Personal Data" categories of third parties with whom we share personal data, and what information may be shared under different circumstances. If You are a resident of Utah, starting May 1, 2026, You will have the right to (1) request to be informed of what personal data has been collected about You, and to access that information; (2) request rectification and to have the ability to correct inaccuracies in Your personal data; (3) request deletion and erasure of Your personal data, though exceptions under the UCPA and other laws may allow cr8s to retain and use certain personal data notwithstanding Your deletion request; (4) Right to restrict Your personal data; and (5) right to data portability; You can learn more about how to submit a data rights request, or appeal denial by emailing to privacy@cr8s.com.

Texas Residents: Your Texas Privacy Rights

Under the Texas Data Privacy and Security Act ("TDPSA"), which goes into effect on July 1, 2024, Texas residents have specific rights regarding cr8s' collection, use, and sharing of personal data. cr8s does not sell your personal data and will not do so in the future without providing you with notice and an opportunity to opt out, as required by law. Additionally, cr8s does not engage in profiling that leads to decisions with legal or similarly significant effects. However, cr8s may participate in targeted advertising as defined by the Act. Starting on May 1, 2026, you will have the right to opt out of targeted advertising by interacting with Our cookie banner available on the Service and selecting Your preferences. cr8s collects various categories of personal data when you use the Service, including identifiers, commercial information, internet or other electronic network activity, geolocation data, and professional information. A more detailed description of the information cr8s collects and how we use it is provided above in the sections entitled, "Collection of Personal Data" and "Use of Personal Data." The section entitled "Sharing Personal Data" categories of third parties with whom we share personal data, and what information may be shared under different circumstances. If You are a resident of Texas, you will have the right to (1) request to be informed of what personal data has been collected about You, and to access that information; (2) request correction and to have the ability to correct inaccuracies in Your personal data; (3) request deletion and erasure of Your personal data, though exceptions under the TDPSA and other laws may allow cr8s to retain and use certain personal data notwithstanding Your deletion request; (4) Right to data portability; and (5) Right to opt out of the sale of your personal data and the processing of your personal data for targeted advertising or profiling for significant decisions. You can learn more about how to submit a data rights request, or appeal denial by emailing privacy@cr8s.com.

To learn more about how to submit a data rights request or appeal a denial, please email privacy@cr8s.com.

Minnesota Residents: Your Minnesota Privacy Rights

Under the Minnesota Consumer Data Privacy Act ("MCDPA"), which goes into effect on July 1, 2025, Minnesota residents have specific rights regarding cr8s' collection, use, and sharing of personal data. cr8s does not sell your personal data and will not do so in the future without providing you with notice and an opportunity to opt out, as required by law. However, cr8s may participate in targeted advertising as defined by the Act. Starting on May 1, 2026, you will have the right to opt out of targeted advertising by interacting with Our cookie banner available on the Service and selecting Your preferences. cr8s collects various categories of personal data when you use the Service, including identifiers, commercial information, internet or other electronic network activity, geolocation data, and professional information. A more detailed description of the information cr8s collects and how we use it is provided above in the sections entitled, "Collection of Personal Data" and "Use of Personal Data." The section entitled "Sharing Personal Data" categories of third parties with whom we share personal data, and what information may be shared under different circumstances. If You are a resident of Minnesota, you will have the right to (1) request to be informed of what personal data has been collected about You, and to access that information; (2) request correction and to have the ability to correct inaccuracies in Your personal data; (3) request deletion and erasure of Your personal data, though exceptions under the MCDPA and other laws may allow cr8s to retain and use certain personal data notwithstanding Your deletion request; (4) Right to data portability; and (5) Right to opt out of the sale of your personal data and the processing of your personal data for targeted advertising or profiling for significant decisions. You can learn more about how to submit a data rights request, or appeal denial by emailing privacy@cr8s.com.

XIII. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via prominent notice on our Services, prior to the change becoming effective and update the "effective date" at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

XIV. Contact Us

If You have any questions about this Privacy Policy or wish to exercise one of Your Data Subject rights, please contact us:

• By emailing us at privacy@cr8s.com