Privacy Policy

Effective Date: August 13, 2026 Last Updated: August 13, 2026 This Privacy Policy explains how Sundae Foods Inc. ("Sundae," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with our website, mobile applications, and related consumer services (together, the "Service"). It also applies to the limited creator-program processing described in Section 2.5. This Privacy Policy is a notice about our data practices. Where applicable law requires consent for a particular activity, such as non-essential cookies or certain marketing, we will request that consent separately. 1. Who we are Sundae Foods Inc. is a Delaware corporation and is responsible for determining how and why personal information is processed through the Service, except where another company acts independently under its own privacy policy. For privacy questions or requests, contact hello@sundaefoods.com. 2. Personal information we collect The information we collect depends on how you use the Service. 2.1 Account and profile information We may collect: • name, email address, username, password credentials, and account identifiers; • information received from supported sign-in providers such as Google or Apple; • profile image, biography, social handle, and preferences; • age-confirmation information; and • communications, support requests, and feedback. Passwords are stored using protective technical measures rather than in readable form. 2.2 Recipe, health, and preference information Depending on the features you use, we may collect: • recipes, ingredient lists, images, videos, captions, links, and other content you submit or import; • dietary preferences, allergens, health or nutrition goals, and food preferences; • age, gender, height, weight, activity level, or similar information used for optional nutrition features; and • saved recipes, shopping lists, searches, interactions, and recommendations. Some nutrition or health-related information may be considered sensitive personal information in certain jurisdictions. You can choose not to provide optional information, although some personalized features may then be unavailable. When Sundae uses analytics to understand use of nutrition, health, or recipe features, our analytics configurations are designed to send generic feature-use events, such as whether a feature was opened or completed, rather than the specific recipes, ingredients, allergens, health goals, height, weight, or other values you enter into those features. 2.3 Device, usage, and technical information We may automatically collect: • IP address and approximate location derived from it; • device type, operating system, browser, app version, language, and identifiers; • pages or screens viewed, links clicked, referring pages, session activity, and feature use; • diagnostic, performance, crash, security, and log information; and • cookie, pixel, SDK, and similar technology data. 2.4 Shopping and attribution information Shopping Links may contain link, recipe, session, or attribution identifiers. Sundae and Shopping Partners may use link parameters, cookies, pixels, device information, and transaction reports to measure shopping activity, attribute transactions, prevent fraud, resolve disputes, and evaluate performance. Sundae generally receives attribution and transaction information needed for these purposes rather than a shopper's complete grocery account or full payment-card details. The Shopping Partner independently handles checkout, payment, fulfillment, and customer-service information under its own privacy policy. 2.5 Creator program information If you participate in a Sundae creator program, we may also process contact, account, content, tax, payment, attribution, and compliance information reasonably needed to administer that program. Participation is governed by the applicable Sundae Creator Tool Terms and Conditions. 3. Sources of personal information We collect personal information: • directly from you when you create an account, submit content, communicate with us, or use the Service; • automatically from your browser, device, app, cookies, SDKs, and use of the Service; • from service providers supporting sign-in, hosting, analytics, security, communications, payments, or customer support; • from Shopping Partners that report clicks, attribution, transactions, adjustments, and related activity; • from creators, rights holders, or their representatives when they authorize Sundae to publish Creator Content; • from connected social platforms or other services when you authorize the connection. 4. How we use personal information We may use personal information to: • provide, operate, maintain, secure, and troubleshoot the Service; • create and manage accounts and authenticate users; • personalize recipes, nutrition information, shopping features, and recommendations; • process imported or uploaded content and provide requested content tools; • host, display, attribute, and distribute authorized Creator Content; • operate Shopping Links and related shopping features; • attribute transactions and measure shopping activity; • detect and prevent fraud, abuse, infringement, security incidents, and prohibited activity; • communicate about accounts, features, support, policy changes, and the Service; • send marketing communications where permitted and provide opt-out choices; • understand performance, develop features, conduct analytics, and improve the Service; • enforce agreements, resolve disputes, and protect Sundae, users, partners, and others; • comply with legal, regulatory, and reporting requirements; and • carry out a merger, financing, reorganization, acquisition, or sale of all or part of our business, subject to appropriate safeguards. 5. Legal bases for processing Where the European Economic Area, United Kingdom, or another jurisdiction requires a legal basis, we rely on one or more of the following: • Contract: processing needed to provide the Service you request and perform our agreement with you. • Legal obligation: processing needed for regulatory, law-enforcement, or other legal requirements. • Legitimate interests: operating, securing, improving, and promoting the Service; understanding use; preventing fraud; administering Shopping Links; and protecting legal rights, provided those interests are not overridden by your rights. • Consent: where we ask permission for optional cookies, marketing, or another activity for which consent is required. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully. You choose whether to provide optional nutrition, health, and preference information. Sundae processes information you choose to provide to supply the personalization or nutrition feature you request. Where applicable law requires a separate form of consent before particular information may be processed, Sundae will request that consent before carrying out the processing that requires it. 6. How we disclose personal information We may disclose personal information to the following categories of recipients when reasonably necessary for the purposes described in this Policy: • Service providers supporting cloud hosting, databases, security, analytics, communications, customer support, content processing, and technical operations. • Shopping Partners supporting Shopping Links, transaction attribution, shopping activity, and fraud prevention. • Payment providers supporting subscriptions or other payments offered through the Service. • Sign-in, app-store, social, and content-distribution providers when you use their services or when needed to distribute and operate the Service. • Artificial-intelligence service providers that process prompts, recipe information, content, or other inputs as needed to provide requested features, subject to our agreements and applicable law. Our agreements prohibit those providers from using Sundae user inputs to train or improve their general-purpose models. • Professional advisers such as lawyers, accountants, auditors, and insurers. • Government authorities and other parties when required by law or reasonably necessary to protect rights, safety, security, or prevent fraud or abuse. • Corporate transaction participants in connection with a proposed or completed merger, financing, acquisition, reorganization, or sale of business or assets. • Other parties at your direction or with your permission. Some third parties, including Shopping Partners, app stores, social platforms, and sign-in providers, may independently determine how they use information under their own privacy policies. 7. Cookies, analytics, and advertising We and our providers may use cookies, pixels, SDKs, local storage, and similar technologies to: • keep the Service working and secure; • remember settings and preferences; • measure traffic, engagement, and performance; • attribute Shopping Link activity; • understand and improve the Service; and • measure the performance of Sundae's advertising campaigns where permitted. We may use providers such as Google Analytics, Mixpanel, Meta, or similar services only for product analytics and to measure the performance of Sundae's advertising campaigns. These providers may receive information such as IP address, device and browser information, cookie or similar identifiers, pages viewed, interactions, and generic events indicating that a recipe, nutrition, or health-related feature was used. Our analytics configurations are designed not to include names or email addresses in analytics events and not to send the specific recipe, ingredient, allergen, health goal, body measurement, or other value entered into those features. Sundae does not use these providers to personalize third-party advertisements. You may use our cookie banner, in-app privacy settings, or other available preference tools to manage applicable analytics and advertising choices. You may also adjust browser or device settings, although disabling some technologies may affect Service functionality. Where applicable law requires consent before a non-essential technology is activated, Sundae will request that consent. 8. Sale, sharing, and targeted advertising Sundae does not sell personal information in exchange for money and does not use personal information for targeted advertising. Some disclosures for product analytics or measurement of Sundae's advertising campaigns may nevertheless be considered a "sale" or "sharing" under certain U.S. state privacy laws even when no money changes hands. Where applicable law gives you the right to opt out of those activities, you may use the choices made available through our cookie banner or contact hello@sundaefoods.com with the subject "Privacy Opt-Out." We do not knowingly sell or share personal information of people under 18. Sundae does not disclose specific allergens, health goals, body measurements, or similar health-related values for product analytics or advertising-campaign measurement. When you use a shopping feature, a Shopping Partner may receive recipe, ingredient, shopping-list, cart, or related information needed to provide that feature, as described in Sections 2.4 and 6. 9. Marketing communications We may send account, security, payment, policy, and other service-related communications that are necessary to operate the Service. Where permitted, we may also send promotional communications. You can opt out of marketing email by using the unsubscribe link or contacting us. Opting out of marketing does not stop necessary service communications. 10. International data transfers Sundae is based in the United States, and personal information may be processed in the United States, the European Economic Area, and other countries where Sundae or its service providers operate. Those countries may have different privacy laws from your country. Where required, Sundae uses an approved transfer mechanism or other appropriate contractual, technical, and organizational safeguards for international transfers. 11. Data retention We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain accounts, resolve disputes, enforce agreements, protect security, and meet legal and reporting requirements. Retention depends on the category and context. For example: • account and profile information is generally retained while the account is active. After an account-deletion request is completed, Sundae deletes or de-identifies account information within a reasonable period, subject to the exceptions described below; • shopping, attribution, fraud, and transaction records may be retained for the period required or permitted by applicable law and for dispute resolution; • private imported content is retained as needed to provide the requested feature and may be deleted or de-identified following an account or content-deletion request, subject to applicable exceptions; • records retained for legitimate operational, security, analytics, dispute-resolution, fraud-prevention, accounting, or legal purposes may have direct identifiers, such as name and email address, removed or disassociated and may remain associated with an internally generated identifier; and • backup, security, and legal-compliance copies may remain until deleted through our ordinary retention cycle. Information associated with an internal identifier may be pseudonymized rather than anonymous and may remain personal information under applicable law. We may also retain aggregated or de-identified information that no longer reasonably identifies an individual. Where required by applicable law, we maintain de-identified information in de-identified form and do not attempt to re-identify it except as permitted by law. 12. Data security We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These may include access controls, authentication, encryption where appropriate, logging, monitoring, and service-provider controls. No online system or transmission is completely secure. We cannot guarantee absolute security. You are responsible for protecting your credentials and notifying us promptly of suspected account misuse. 13. Your privacy rights Depending on your location and subject to applicable exceptions, you may have the right to: • request access to personal information we hold about you; • request correction of inaccurate information; • request deletion of certain information; • request restriction of or object to certain processing; • receive certain information in a portable format; • withdraw consent where processing relies on consent; • opt out of certain sale, sharing, targeted advertising, or profiling activities; • appeal our response where applicable law provides that right; and • lodge a complaint with a privacy or data-protection authority. To make a request, contact hello@sundaefoods.com with the subject "Privacy Request." Describe your request and identify the account or email involved. We may request information reasonably needed to verify identity and authority. An authorized agent may submit a request where applicable law permits, subject to verification. We will not unlawfully discriminate against you for exercising a privacy right. We may deny or limit a request where permitted by law, including when we cannot verify it, an exception applies, or the request is manifestly unfounded or excessive. 14. EEA and UK information If you are in the European Economic Area or United Kingdom, you may contact us to exercise the rights described above and may lodge a complaint with the data-protection authority in your country. Where processing relies on legitimate interests, you may request information about the interests involved. Where processing is necessary for a contract or legal obligation, failure to provide required information may prevent Sundae from providing an account or feature. 15. California and other U.S. state privacy information Residents of California and certain other U.S. states may have rights concerning access, correction, deletion, portability, sale, sharing, targeted advertising, and certain profiling, subject to legal thresholds and exceptions. The categories of personal information we collect, the sources, business purposes, and recipient categories are described in Sections 2 through 8. Sundae may disclose identifiers, internet or network activity, transaction and commercial information, profile information, approximate location, professional information, user content, and inferences to the recipient categories described in Section 6 for the purposes stated in this Policy. To exercise an applicable right, use the process in Section 13. To opt out of applicable sale, sharing, or targeted advertising, use the process in Section 8. 16. Children's privacy The Service is intended for people aged 18 and older. Sundae does not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information, contact us so that we can investigate and take appropriate action. 17. Third-party services The Service may link to or integrate with third-party services. This Privacy Policy does not govern a third party's independent data practices. Review the third party's privacy policy before providing information or using its service. 18. Changes to this Privacy Policy We may update this Privacy Policy to reflect changes in our practices, technology, partners, or legal obligations. We will post the updated version with a new "Last Updated" date and provide additional notice of material changes where required. If applicable law requires consent for a new use of personal information, Sundae will request that consent rather than relying only on an update to this Policy. 19. Contact us For privacy questions or requests, contact: Sundae Foods Inc. Delaware, United States Email: hello@sundaefoods.com