BREWHOOD LLC
PRIVACY POLICY

Effective Date: September 25, 2026 Last Updated: September 25, 2026

This Privacy Policy (this "Policy") describes how Brewhood LLC, together with its subsidiaries, affiliates, successors and assigns (collectively, "Brewhood," "we," "us" or "our"), collects, uses, discloses, retains and otherwise Processes Personal Information in connection with the Brewhood mobile application, website, vendor tools, account features, communications and related services that link to or reference this Policy (collectively, the "Service").

For purposes of this Policy, "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, and "Process" (and its variants) means any operation performed on Personal Information, whether or not by automated means. Capitalized terms used but not defined in this Policy have the meanings given to them in the Brewhood Terms of Service (the "Terms").

This Policy applies to individuals who use the Service, create an account, submit content, communicate with us, claim or manage a vendor listing, or otherwise interact with Brewhood. It does not apply to third-party websites, applications, services, payment processors, map providers, social media platforms, breweries, food vendors or other businesses that Brewhood does not own or control. Your use of the Service is also subject to the Terms.

1. ABOUT BREWHOOD

Brewhood operates a discovery platform that helps users find breweries, food vendors, events, menus, business locations, hours and related local information.

The Service also includes engagement features. When you are physically at a participating business, you can check in ("Tap In"). Tap Ins earn an in-app currency ("Caps") that can be spent on digital collectible items ("Collectibles"). Caps and Collectibles have no cash value. Each business location has a title ("The Regular") held by the eligible user who visits most often, which may carry a discount offered by that business. Users you connect with as friends form your "Crew."

Brewhood is not an alcohol retailer. We do not sell, ship, deliver, broker or process purchases of alcohol. Many businesses listed on the Service serve alcohol; many also offer food-only service, non-alcoholic options, family-friendly events and other local experiences. Businesses listed on the Service are independently responsible for compliance with alcohol-beverage control, age-verification, food-service, event, licensing and other laws applicable to them.

2. AGE REQUIREMENT; CHILDREN'S PRIVACY

The Service is intended for users who are at least 18 years of age. You must be at least 18 to create a Brewhood account or use account-based features. By creating an account, you represent and warrant that you are at least 18 years of age.

Children under 13. Consistent with COPPA (15 U.S.C. §§ 6501–6506) and its implementing regulations (16 C.F.R. Part 312), the Service is not directed to children under the age of 13, and we do not knowingly collect, use or disclose Personal Information from any individual whom we know to be under the age of 13. If we learn that we have collected Personal Information from a child under 13 without verifiable parental consent, we will delete that information promptly. A parent or legal guardian who believes that we may have collected Personal Information from a child under 13 may contact us using the information in Section 21.

Minors 13 to 17. While the Service is intended for users 18 and older, if we become aware that we have collected Personal Information from an individual between the ages of 13 and 17, we will take reasonable steps to delete it, unless retention is required or permitted by applicable law. Consistent with California Business and Professions Code § 22581, a registered user under the age of 18 may request removal of content that the user has posted on the Service by contacting us at privacy@brewhood.app. Removal does not ensure complete or comprehensive removal of content that others have copied or reposted.

3. PERSONAL INFORMATION WE COLLECT

We collect Personal Information directly from you, automatically when you use the Service, and from the third-party sources described in Section 3.4.

3.1 Information You Provide

3.2 Information Collected Automatically

3.3 Location Information and Tap Ins

With your permission, we Process precise device location only when you actively use a location-based feature: displaying nearby breweries, food vendors or events; calculating distance-based search results; and verifying a Tap In.

Tap Ins. When you Tap In, we read your device location at that moment to confirm that you are at or near the business. If the visit is verified, we record the Tap In, including the business, the date and time, and the visibility setting you selected, in your visit history. We use Tap In records to award Caps; determine The Regular at each business; award bonuses when a Crew member Taps In at the same business on the same day (a visit marked private never triggers this bonus, for you or for your Crew); confirm that you have visited a business before you acquire its Collectibles; and show you your own visit history.

We do not collect location in the background, track your location continuously, or disclose your real-time location to businesses or other users. Your visit history is, however, a lasting record of the places where you have Tapped In and when, and we treat it as Sensitive Personal Information (see Section 8).

You may disable location access at any time through your device settings. You cannot Tap In, and some other features may not function, without location access.

3.4 Information from Third Parties

We may receive limited Personal Information from:

(a) service providers that support hosting, authentication, storage, email and push-notification delivery, security, diagnostics, analytics or customer support;

(b) publicly available business sources and third-party data providers used to populate, maintain or verify vendor listings;

(c) vendor representatives who submit information about a business; and

(d) other users who add you to their Crew, interact with your public content or report content to us.

4. HOW WE USE PERSONAL INFORMATION

We Process Personal Information for the following business and commercial purposes:

(a) Provide and maintain the Service. To create, authenticate and maintain accounts; provide profile, discovery, search, follow, review, rating, photo, badge, check-in and community features; verify and record Tap Ins; operate Caps, Collectibles, The Regular, Crew features and Crew leaderboards; send notifications about your activity and your Crew results; display breweries, food vendors, menus, events and related content; personalize discovery; provide vendor listing, claim and management tools; and handle support requests.

(b) Verify eligibility and vendor claims. To confirm the 18-and-older age requirement, verify vendor-account claims and confirm authority to manage a vendor listing.

(c) Communicate with you. To send account, security and administrative notices; email verification and password-reset messages; responses to support, privacy or legal requests; notices about changes to the Terms or this Policy; and optional product or marketing communications, where permitted by applicable law and consistent with the CAN-SPAM Act of 2003 (15 U.S.C. §§ 7701–7713) and the Telephone Consumer Protection Act (47 U.S.C. § 227) ("TCPA").

(d) Protect the Service. To detect, prevent and investigate fraud (including false Tap Ins), spam, abuse, unauthorized access and other harmful activity; enforce the Terms; and protect the rights, property, safety and security of Brewhood, our users, vendors and the public.

(e) Improve and develop the Service. To analyze usage and performance, including how often users return to the app; diagnose bugs and technical issues; and test, improve and develop features.

(f) Generate aggregated or de-identified information. For analytics, research and product development. Aggregated, anonymized and de-identified information is not Personal Information subject to this Policy, and we will not attempt to re-identify it.

(g) Promote the Service. To feature reviews, photos and other content you post publicly in Brewhood's own promotional materials for the Service, such as app-store listings and Brewhood's social media accounts, as permitted by the Terms.

(h) Comply with legal obligations. To comply with applicable laws, respond to lawful requests, and establish, exercise or defend legal claims.

5. HOW WE DISCLOSE PERSONAL INFORMATION

We disclose Personal Information only as described in this Section 5. We do not sell Personal Information, share Personal Information for cross-context behavioral advertising, or Process Personal Information for targeted advertising.

5.1 Service Providers

We disclose Personal Information to service providers, contractors and processors that perform services on our behalf under written contracts that obligate them to (a) use Personal Information only for the purposes we specify, (b) implement appropriate technical and organizational safeguards, and (c) comply with applicable privacy laws, including the CCPA and analogous U.S. state privacy laws.

5.2 Other Users, Your Crew and the Public

Public and community features. Depending on the feature and your settings, other users or the public may see your display name, avatar, biography, public reviews, ratings, comments, photos, badges, the vendors you follow (if displayed by the Service), and the Collectibles and titles shown on your profile. If you hold The Regular at a business, your display name appears publicly on that business's page.

Your Crew. Your Crew can see your visit history, except visits you mark private, unless you turn off Crew visibility (see Section 11.3). Your Crew can also see plans you share with them. Each week, Crew members see a Crew leaderboard that lists members by name and ranks them by the Caps earned that week.

Public content may be viewed, copied, saved, indexed or shared by others. Please do not submit public content that you do not want others to see or use.

5.3 Vendors

When you follow, review, rate, Tap In at, or otherwise interact with a vendor, the vendor may view your public content and aggregate engagement information about its listing (including follower counts, rating averages, review counts, check-in counts and similar listing-level metrics). In addition, a vendor can see:

(a) the display name of the user who currently holds The Regular at its business, which is also shown publicly; and

(b) on its vendor dashboard, a short list of the users next in line for The Regular at its business, identified by display name and ranked by how often they visit.

Turning on Full Privacy removes you from The Regular and from these lists (see Section 11.3). Except as described in this Section 5.3, vendors do not have access to your email address, date of birth, account credentials, real-time or precise device location or other non-public account information unless you direct otherwise, you consent, or disclosure is required or permitted by applicable law.

5.4 Legal, Safety and Enforcement Purposes

We may disclose Personal Information if we believe, in good faith, that disclosure is reasonably necessary to:

(a) comply with applicable law, regulation, subpoena, court order, legal process or governmental request;

(b) enforce the Terms or other agreements;

(c) investigate, prevent or address fraud, security incidents, abuse or illegal activity;

(d) protect the rights, property, safety or security of Brewhood, our users, vendors or the public; or

(e) establish, exercise or defend legal claims.

5.5 Business Transactions

We may disclose or transfer Personal Information in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, receivership, dissolution, sale of all or any portion of our business or assets, or similar corporate transaction. We will take reasonable steps to require the recipient to handle Personal Information in a manner consistent with this Policy, unless otherwise permitted by applicable law. Where required, we will notify affected users of any material change to the practices described in this Policy.

5.6 With Your Consent or Direction

We may disclose Personal Information with your consent or at your direction.

5.7 Aggregated or De-identified Information

We may use and disclose aggregated, anonymized or de-identified information that cannot reasonably be used to identify any individual, including aggregate usage trends, vendor engagement metrics and Service performance statistics. We maintain such information in de-identified form, do not attempt to re-identify it, and contractually obligate recipients to do the same.

6. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies, software development kits (SDKs), tokens and similar technologies (collectively, "Cookies") for the limited operational purposes described below.

We do not use third-party advertising cookies, cross-site tracking pixels, behavioral advertising identifiers, advertising SDKs, fingerprinting techniques or data-broker integrations. You may disable browser cookies through your browser settings, but the Service will not function correctly if authentication or security Cookies are disabled.

7. SALE, SHARING AND TARGETED ADVERTISING

To be unambiguous: Brewhood does not sell Personal Information (including precise geolocation or other sensitive data), share Personal Information for cross-context behavioral advertising, or Process Personal Information for targeted advertising, in each case as those terms are defined under the CCPA and analogous U.S. state privacy laws (including the Colorado Privacy Act, Connecticut Data Privacy Act, Virginia Consumer Data Protection Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, Montana Consumer Data Privacy Act, Delaware Personal Data Privacy Act, Iowa Consumer Data Protection Act, New Hampshire Privacy Act, New Jersey Data Privacy Act, Tennessee Information Protection Act, Minnesota Consumer Data Privacy Act, Maryland Online Data Privacy Act, Nebraska Data Privacy Act, Indiana Consumer Data Protection Act, Kentucky Consumer Data Protection Act and Rhode Island Data Transparency and Privacy Protection Act, as in effect from time to time (collectively, the "State Privacy Laws")).

Brewhood does not collect, use or sell Personal Information to train large language models.

Brewhood is not a data broker as defined under the California Delete Act (Cal. Civ. Code § 1798.99.80 et seq.), the Vermont Data Broker Law (9 V.S.A. § 2446) or the Texas data broker statute (Tex. Bus. & Com. Code Chapter 509), and is not registered as a data broker in any jurisdiction. If our practices materially change, we will update this Policy and provide any notices, choices and consent mechanisms required by applicable law before engaging in any such activity.

8. SENSITIVE PERSONAL INFORMATION

Certain Personal Information is treated as "sensitive" under the CCPA and analogous State Privacy Laws ("Sensitive Personal Information"). Depending on how you use the Service, Sensitive Personal Information we Process may include:

(a) account log-in credentials;

(b) precise device location, when you use a location-based feature, and your Tap In records and visit history; and

(c) business-license information submitted for vendor verification (to the extent it identifies an individual).

We use and disclose Sensitive Personal Information only as reasonably necessary and proportionate to provide the features you request (such as verifying Tap Ins and operating your visit history, Caps, The Regular and Crew features as described in this Policy), to secure the Service and prevent fraud, and for the other purposes permitted by California Code of Regulations title 11, § 7027(m) and analogous provisions of other State Privacy Laws. We do not use Sensitive Personal Information for advertising, and we do not sell it.

Where a State Privacy Law requires consent to Process sensitive data, we Process precise device location with your consent. You may withdraw that consent at any time by turning off location access in your device settings, which stops new location collection, or by contacting us at privacy@brewhood.app. Where applicable law requires, after you withdraw consent we will stop Processing Tap In records already created, which may end your participation in Tap In features. You may also remove those records by deleting your account (Section 11.2). Separately, you may submit a request to limit the use of Sensitive Personal Information as described in Section 12.1.

9. AUTOMATED DECISION-MAKING AND PROFILING

Brewhood does not use ADMT or profiling to make decisions that produce legal or similarly significant effects concerning you, within the meaning of the CCPA, its implementing regulations and analogous provisions of the State Privacy Laws, such as decisions about financial or lending services, housing, education, employment, health care or access to essential goods or services. Some features apply automated rules to your activity, for example awarding Caps, ranking visit frequency to determine The Regular, ordering Crew leaderboards and personalizing discovery. These features do not make decisions of that kind. If we begin using ADMT in a manner requiring additional disclosures or opt-out rights under applicable law, we will update this Policy and implement the controls required by law before doing so.

10. OPT-OUT PREFERENCE SIGNALS AND DO NOT TRACK

Some browsers, devices and extensions offer opt-out preference signals, such as Global Privacy Control (GPC), or "Do Not Track" signals. Because Brewhood does not sell Personal Information, share Personal Information for cross-context behavioral advertising, or Process Personal Information for targeted advertising, these signals do not change our Processing practices.

Pursuant to the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §§ 22575–22579), we disclose that we do not respond differently to Do Not Track signals because we do not engage in the Processing those signals are designed to address. Third parties may not collect personally identifiable information about an individual user's online activities over time and across different websites when the user uses the Service, because we do not permit any such Processing.

11. YOUR PRIVACY CHOICES

11.1 Access and Update

You may access, update or correct most account and profile information, and view your visit history, through the Service.

11.2 Account Deletion

You may delete your account through your account settings where self-service deletion is available. When you delete your account:

(a) your profile, avatar, biography and follow relationships are removed from active account features;

(b) your Tap In records and visit history are deleted, and any title you hold, including The Regular, is vacated;

(c) your Personal Information is deleted from active systems within thirty (30) days, unless retention is required or permitted by applicable law;

(d) reviews, ratings, photos, comments and other user-generated content (other than Tap In records) may remain in pseudonymous, de-identified, aggregated or account-disassociated form to preserve vendor-page integrity, prevent fraud, comply with legal obligations or enforce our rights (you may ask us to remove specific retained content as described in the Terms); and

(e) information may persist in disaster-recovery and operational backups for a limited period until those backups are overwritten or deleted in the ordinary course of business.

If self-service deletion is unavailable, you may submit a deletion request using the contact information in Section 21.

11.3 Location and Visibility Controls

Device location. You may control location permissions through your device settings, including granting access only while using the app, where supported. Disabling location access prevents Tap Ins and may limit distance-based discovery and nearby search.

Private visits. When you Tap In, you may mark the visit private. A private visit is not shown to your Crew and does not trigger Crew bonuses.

Crew visibility. You may turn off Crew visibility of your visit history. When it is off, your Crew cannot see your visit history; plans you share with your Crew remain visible to them.

Full Privacy. Full Privacy hides you from everyone outside your Crew and removes you from The Regular and from vendor lists of users next in line for it. If you hold The Regular when you turn on Full Privacy, the title is vacated and passes to the next eligible user; we will warn you before this happens. Full Privacy does not hide your visit history from your Crew. To be hidden from both, turn on Full Privacy and turn off Crew visibility.

Marking a visit private or turning off Crew visibility does not by itself remove you from The Regular or from vendor lists; only Full Privacy does.

11.4 Email Preferences

Consistent with the CAN-SPAM Act, you may unsubscribe from non-essential marketing or product-announcement emails using the unsubscribe link contained in each such message or through your account settings. Essential Service communications (such as email verification, password resets, account-security notices, legal and privacy notices, and other administrative messages) cannot be opted out of because they are necessary to operate your account.

11.5 Push and In-App Notifications

If you use the mobile application, you may enable or disable push notifications at any time through your device settings or in-app settings. If you mute a notification type, such as your weekly Crew leaderboard result, we stop sending it as a push notification, but it will still appear in your in-app notification list.

11.6 Telephone and Text Communications

Brewhood does not currently send marketing telephone calls or text messages. If we begin to do so, we will obtain prior express written consent where required by the TCPA and applicable state law, and we will provide a clear opt-out mechanism in each message.

12. U.S. STATE PRIVACY RIGHTS

Depending on your state of residence, and subject to applicable exceptions, you may have some or all of the following rights with respect to your Personal Information:

(a) Right to Know / Access. To confirm whether we Process Personal Information about you and, if so, to access that information.

(b) Right to Portability. To receive a copy of certain Personal Information in a portable and, to the extent technically feasible, readily usable format.

(c) Right to Correct. To correct inaccurate Personal Information, taking into account the nature of the information and the purposes of Processing.

(d) Right to Delete. To request deletion of Personal Information, subject to the exceptions set forth in applicable law.

(e) Right to Opt Out of Sale, Sharing and Targeted Advertising. Brewhood does not engage in any of these activities, so there is nothing to opt out of.

(f) Right to Opt Out of Profiling. Brewhood does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects.

(g) Right to Limit Use of Sensitive Personal Information. As described in Section 8, we Process Sensitive Personal Information only for permitted purposes, but you may still submit a limitation request.

(h) Right to Appeal. Where applicable law provides for an appeal of a decision regarding a privacy-rights request, to appeal that decision.

(i) Right to Non-Discrimination. Not to receive discriminatory treatment for exercising any of your privacy rights.

12.1 How to Exercise Your Rights

To exercise any of these rights, please email privacy@brewhood.app or use the privacy-rights tools in your account settings (where available). You may also submit requests by mail using the address in Section 21.

12.2 Verification

To protect your information, we will verify your identity before fulfilling requests to know, access, correct or delete. For account holders, we typically verify by confirming control of the registered email address. For more sensitive requests, we may ask for additional information necessary to verify your identity to a reasonable degree of certainty. Information provided for verification is used only to verify and respond to your request and is deleted promptly thereafter. We do not require identity verification for a request to limit the use of Sensitive Personal Information, but we may deny such a request if we have a good-faith, reasonable and documented belief that it is fraudulent.

12.3 Authorized Agents

You may designate an authorized agent to submit a request on your behalf where permitted by applicable law. We may require the agent to provide proof that you gave the agent signed permission to submit the request, and we may also ask you to verify your identity directly with us or to confirm directly with us that you gave the agent that permission. These additional steps do not apply if you have given the agent a power of attorney pursuant to California Probate Code §§ 4121–4130 or analogous law.

12.4 Response Timeframe

We will acknowledge receipt of a request to know, access, correct or delete within ten (10) business days and substantively respond within forty-five (45) calendar days. Where reasonably necessary, we may extend the response period by an additional forty-five (45) days (or such longer period as expressly permitted under applicable law), and we will notify you of the extension and the reasons for it within the initial 45-day period.

12.5 Appeals

If we deny your request in whole or in part and applicable law provides you with a right to appeal, you may appeal by replying to our denial or by contacting us at privacy@brewhood.app with the subject line "Privacy Request Appeal." We will respond to your appeal within sixty (60) days (or such shorter period as may be required under applicable law). If your appeal is denied, you may have the right to contact your state attorney general, the California Privacy Protection Agency, or other applicable regulator. Contact information for the Colorado Attorney General is coag.gov/file-complaint; for the Connecticut Attorney General, portal.ct.gov/AG; for the Virginia Attorney General, oag.state.va.us; and for the Texas Attorney General, texasattorneygeneral.gov.

13. CALIFORNIA PRIVACY DISCLOSURES

This Section 13 applies to California residents and supplements (and, where inconsistent, controls over) the balance of this Policy with respect to California residents. It is the "notice at collection" required by California Civil Code § 1798.100(a) and California Code of Regulations title 11, § 7012.

13.1 Notice at Collection

The following table sets forth, for each category of Personal Information we collect, the sources from which we collect it, the business and commercial purposes for which we Process it, the categories of recipients to whom we disclose it, the length of time we intend to retain it, and whether we sell or share it for cross-context behavioral advertising.

13.2 Sources of Personal Information

We collect Personal Information from you, your device, your use of the Service, other users, vendor representatives, service providers, publicly available business sources and third-party data providers.

13.3 Business and Commercial Purposes

We collect, use and disclose Personal Information for the business and commercial purposes described in Sections 4 and 5 of this Policy.

13.4 Disclosures for Business Purposes

In the preceding twelve (12) months, we may have disclosed the categories of Personal Information described above to service providers and contractors, to legal recipients where required, to other users where you make information public or visible to your Crew, and to vendors as described in Section 5.3.

13.5 No Sale or Sharing

Brewhood does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising. We have not sold or shared Personal Information in the preceding twelve (12) months, including with respect to minors under sixteen (16) years of age.

13.6 Minors

We do not knowingly collect Personal Information from individuals under 18 years of age. We do not knowingly sell or share Personal Information of individuals under 16 years of age, and we will not do so without obtaining the affirmative opt-in consent required by California Civil Code § 1798.120(c).

13.7 Rewards Features

Caps, Collectibles and The Regular are optional features. You take part by choosing to Tap In, which requires the location Processing described in Section 3.3. Caps cannot be purchased, transferred or redeemed for money. Any discount associated with The Regular is offered by the applicable business. You may stop participating at any time by not Tapping In, by turning on Full Privacy (which removes you from The Regular) or by deleting your account. We do not offer payments or price differences in exchange for the sale or sharing of Personal Information.

13.8 Shine the Light

California Civil Code § 1798.83 (commonly referred to as the "Shine the Light" law) permits California residents to request certain information regarding our disclosure of Personal Information to third parties for those third parties' direct-marketing purposes. Brewhood does not disclose Personal Information to third parties for those third parties' own direct-marketing purposes. California residents may submit a Shine the Light request to privacy@brewhood.app with the subject line "Shine the Light Request."

13.9 California Rights

California residents may exercise the rights described in Section 12, subject to applicable exceptions, by contacting us at privacy@brewhood.app or through available account tools. California residents may also contact the California Privacy Protection Agency at cppa.ca.gov or the California Attorney General at oag.ca.gov.

14. ADDITIONAL STATE-SPECIFIC DISCLOSURES

14.1 Residents of Other States with Comprehensive Privacy Laws

If you reside in a state with a State Privacy Law that applies to our Processing, you may exercise the rights described in Section 12 to the extent provided by that law. You may submit a request by email to privacy@brewhood.app or through the privacy-rights tools in your account settings (where available). You may appeal a denied request as described in Section 12.5. If your appeal is denied, you may have the right to contact the attorney general of your state.

14.2 Nevada Residents

Nevada residents may, under Nevada Revised Statutes Chapter 603A, opt out of the sale of certain covered information. Brewhood does not engage in such sales. To submit a verified request, contact us at the email in Section 21.

14.3 Texas Residents

Texas residents may exercise the rights described in Section 12 pursuant to the Texas Data Privacy and Security Act, where applicable. Brewhood does not sell sensitive personal data or biometric personal data.

15. DATA RETENTION

We retain Personal Information only for so long as is reasonably necessary to fulfill the purposes described in this Policy, including providing the Service, maintaining account functionality, complying with legal obligations, resolving disputes, enforcing agreements, preventing fraud, maintaining security and protecting legal rights. The specific retention periods (or, where periods are not feasible, the criteria used to determine them) are set forth in the notice-at-collection table in Section 13.1 and supplemented as follows:

(a) Tap In records, visit history, Caps and Collectibles records, titles and app-open records are retained for as long as your account remains open, unless we delete or de-identify them sooner, and are deleted when you delete your account, as described in Section 11.2;

(b) server, security and diagnostic logs are typically retained for up to ninety (90) days, unless retained longer for security, fraud-prevention, legal or operational reasons;

(c) disaster-recovery and operational backups are retained in accordance with our backup schedules and overwritten or deleted in the ordinary course of business (typically within 90 days);

(d) support and privacy-request records are retained for as long as necessary to respond, maintain records, resolve disputes, comply with applicable law and protect legal rights;

(e) vendor verification records are retained for the duration of the vendor account plus three (3) years thereafter for fraud-prevention and recordkeeping purposes; and

(f) tax, accounting and corporate records associated with vendor or commercial relationships are retained for the period required by applicable federal and state law.

When Personal Information is no longer needed for the purposes described in this Policy, we delete, destroy or de-identify it in accordance with our records-retention policies.

16. INFORMATION SECURITY

We maintain reasonable administrative, technical, organizational and physical safeguards designed to protect Personal Information against unauthorized access, loss, misuse, disclosure, alteration or destruction, and we require our service providers to maintain appropriate safeguards.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident involving your Personal Information, we will provide notice as required by applicable law, including California Civil Code § 1798.82 and analogous state and federal breach-notification statutes.

17. THIRD-PARTY SERVICES AND LINKS

The Service may contain links to, or integrations with, third-party websites, applications, services, vendor pages, event pages, reservation tools, menu tools, payment tools, map services, application stores and social networks. Brewhood does not control, and is not responsible for, the privacy, security or data-Processing practices of such third parties. Your interactions with third parties are governed by their own privacy notices and policies, which we encourage you to review.

18. INTERNATIONAL USERS

Brewhood is operated from the United States and is intended for users located in the United States. If you access the Service from outside the United States, your Personal Information will be transferred to, stored in and Processed in the United States and other jurisdictions where privacy laws may differ from those in your jurisdiction. Where the laws of your jurisdiction apply (including, where applicable, the EU General Data Protection Regulation, the UK GDPR, the Canadian Personal Information Protection and Electronic Documents Act or the Brazilian Lei Geral de Proteção de Dados), we will respond to applicable requests and obligations as and to the extent required by law.

19. ACCESSIBILITY

We strive to make this Policy and the Service accessible to all users, consistent with the Americans with Disabilities Act and the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA where reasonably practicable. If you have difficulty accessing any portion of this Policy or the Service due to a disability, please contact us using the information in Section 21, and we will work with you to provide the information in an accessible format.

20. CHANGES TO THIS POLICY

We may update this Policy from time to time. When we do, we will update the "Last Updated" date set forth above. If we make material changes, we will post the updated Policy in the Service and notify you by email or in-app notification. Material changes take effect on the date stated in the notice, which will be no earlier than thirty (30) days after we provide notice, except where a shorter period is necessary to comply with applicable law or to address a security or fraud concern. We will not Process Personal Information collected before a material change in a manner materially inconsistent with the Policy in effect when it was collected without obtaining any consent required by applicable law.

21. CONTACT US

For privacy questions, requests or concerns, please contact us using any of the following:

Email: privacy@brewhood.app

Mail: Brewhood LLC, Attn: Privacy, 2108 N St., Ste. N, Sacramento, CA 95816

Legal Entity: Brewhood LLC, a California limited liability company.

© 2026 Brewhood LLC. All rights reserved.