This privacy policy (the "Privacy Policy") describes how Too Lost LLC ("Too Lost," "we," "our," or "us") may collect, use, share, and otherwise process personal information when you access and use the platform available at https://www.toolost.com, including any content, functionality, and services offered on or through the website (the "Platform"), or through other means that expressly reference this Privacy Policy.

Your use of this Platform is also subject to the Terms of Use available on the website. If you are located outside the European Economic Area ("EEA") or the United Kingdom ("UK"), by accessing and using the Platform, you agree and consent to the collection, use, processing and disclosure of your personal information as outlined in this Privacy Policy. If you are in the EEA or the UK, this Privacy Policy is provided for informational purposes only. Any capitalized terms not defined in this notice have the meanings given in the Terms of Use.

Personal information that you provide us

As used in this Privacy Policy, personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, consumer or household. We may collect and process the following categories and examples of personal information about you:

i. Account signup: When you sign up for an account to access one or more of our services, you'll be required to use a full name, an email address and a password for creating the account. In some cases, we or our third-party identity verification or fraud-prevention providers may request or process additional information as reasonably necessary to verify identity, assess fraud or security risk, protect the Services, or comply with applicable law.

ii. Identity verification and fraud prevention: We may use identity verification, risk assessment, fraud-prevention, security, and compliance tools, technologies, and service providers in connection with accounts, transactions, content-distribution activities, payouts, account access, security reviews, compliance reviews, and fraud-prevention processes. In connection with these activities, Too Lost and its service providers may collect, receive, use, disclose, review, or otherwise process verification-related information, including identity and contact information, government-issued identification information, images or recordings submitted for verification, device, browser, network, and connection information, internet protocol address, transaction-related information, location information or location indicators, and the results of verification, screening, or risk assessment. Depending on the service, workflow, verification method used, and applicable law, this information may include sensitive personal information, biometric information, or special categories of personal data. We and our service providers may use this information for identity verification, authentication, account security, fraud detection and prevention, compliance, enforcement of our terms and policies, protection of users, protection of the Platform, and related business, legal, or regulatory purposes, subject to applicable law and any required notice, consent, rights, or choice mechanisms.

iii. Payment processing: We ask you to provide your name, contact information and credit card information or other payment account information. In all cases, your payment information is stored and processed by our Payment Gateway Service Provider, Stripe; not by us.

iv. Interactions with Too Lost: We may record, analyze and use your interactions with us, including email, telephone, and chat conversations with our sales and customer support professionals, for improving our interactions with you and other customers.

Information that we collect automatically

i. Information from browsers, devices and servers: When you visit our Platform, use our Services, or interact with verification, security, or fraud-prevention tools we make available, we and our service providers may collect information that web browsers, mobile devices and servers make available, such as the internet protocol address, browser type, language preference, time zone, referring URL, date and time of access, operating system, mobile device manufacturer, device identifiers, and mobile network information. We include these in our log files and related security records to understand more about visitors to our websites, support the Services, and help protect against fraud, abuse, and unauthorized activity.

ii. Information from first party cookies and tracking technologies: We use temporary and permanent cookies to identify users of our services and to enhance user experience. We may also use cookies, beacons, tags, scripts, and other similar technologies to identify visitors, track website navigation, gather demographic information about visitors and users, understand email campaign effectiveness and for targeted visitor and user engagement by tracking your activities on our Platform. We use first-party and third-party cookies on our Platform. For more information on cookies, please see our Cookie Policy.

iii. Information from application logs and mobile analytics: We or our contractors may collect information about your use of our services from application logs and in-house analytics tools, and use it to understand how your business use and needs can improve our products. This information includes clicks, scrolls, features accessed, access time and frequency, errors generated, performance data, storage utilized, user settings and configurations, and devices used to access and their locations.

Purposes for processing personal information

In addition to the purposes mentioned above, we may use your personal information for the following purposes:

To communicate with you (such as through email) about services that you have signed up for, changes to this Privacy Policy, changes to the Terms of Use, or important notices; to keep you posted on new products and services, upcoming events, offers, promotions and other information that we think will be of interest to you; to ask you to participate in surveys, or to solicit feedback on our products and services; to set up and maintain your account, and to do all other things required for providing our services, such as enabling collaboration, providing website and mail hosting, and backing up and restoring your data; to understand how users use our products and services, to monitor and prevent problems, and to improve our products and services; to provide customer support, and to analyze and improve our interactions with customers; to verify identity, authenticate users, evaluate account integrity, and use service providers to help detect, investigate, prevent, and address fraudulent transactions, impersonation, abuse, security incidents, and other illegal or unauthorized activities; to detect and prevent fraudulent transactions and other illegal activities, to report spam, and to protect the rights and interests of Too Lost, Too Lost's users, third parties and the public; to update, expand and analyze our records, identify new customers, and provide products and services that may be of interest to you; to analyze trends, administer our websites, and track visitor navigations on our websites to understand what visitors are looking for and to better help them; to monitor and improve marketing campaigns and make suggestions relevant to the user; to collect and use information necessary for legal purposes, including to comply with any legal, regulatory, contractual obligation, legal process or governmental request.

If you are an individual from the EEA or UK, our legal basis under the GDPR/UK GDPR for personal information collection and use depends on the personal information concerned and the context in which we collect it. Please refer to the GDPR Privacy Notice for further information on our processing of your personal information and your related rights.

Opt out of non-essential electronic communications: You may opt out of receiving newsletters and other non-essential messages by using the 'unsubscribe' function included in all such messages or contacting us at [email protected]. However, you will continue to receive essential notices and transactional emails.

Disable cookies: You can disable browser cookies on our Platform. However, if you do so, you may not be able to use certain features of the Platform properly.

Optional information: You can choose not to provide optional profile information such as your photo. You can also delete or change your optional profile information within your profile settings.

Who we share your personal information with

We may disclose your personal information to the following categories of third parties for our business purposes.

i. Third-party service providers: We may need to share your personal information and aggregated or de-identified information with third-party service providers that we engage, such as marketing and advertising partners, event organizers, web analytics providers, payment processors, and providers that support hosting, payments, analytics, customer support, identity verification, fraud prevention, security, risk management, and account or transaction review. Depending on the service provided, these providers may process identification data, photos, videos, selfie images, device and network information, verification results, and, where applicable, biometric information or other sensitive personal information, solely as reasonably necessary to provide services to us, help protect the Services, or comply with applicable law.

ii. Third-party integrations you have enabled: Most of our products and services support integrations with third-party products and services. Through these third-party integrations, you may be allowing the third party to access your service information and personal information about you. We encourage you to review the privacy practices of the third-party services and products before you enable integrations with them.

iii. As required by law or in connection with a legal claim, dispute, or proceeding or in response to requests by governmental regulatory authorities, or as we may reasonably determine to be necessary or appropriate to protect our rights or the rights of others or to avert loss or harm to persons or property.

iv. Third parties as needed to protect our legitimate interests, including to establish or defend our legal rights, and where we believe that such disclosure is necessary for preventing fraud, investigating any suspected illegal activity, enforcing our agreements or policies, or protecting the safety of our users.

v. Third parties in the event that we sell all or part of our business or make a sale or transfer of assets or are otherwise involved in a merger, restructuring, reorganization, or business transfer.

vi. Certain other persons to the extent authorized by you.

Your rights

Depending on your jurisdiction, including in jurisdictions in which we operate such as the EEA, UK and certain US states, you may have certain rights with respect to personal information that Too Lost holds about you. These rights vary by jurisdiction and may be subject to certain limitations and exemptions. These rights may include the right to:

i. Right to access: You have the right to confirm whether we are processing your personal information and request access to (and obtain a copy of, if applicable) the personal information that we hold about you, including the type and source of the personal information, the purpose and period of processing, and the persons with whom the information is shared.

ii. Right to rectification: You have the right to update the personal information we hold about you or to rectify any inaccuracies. Based on the purpose for which we use your personal information, you can instruct us to add supplemental information about you in our database.

iii. Right to erasure: You have the right to request that we delete your personal information in certain circumstances, such as when it is no longer necessary for the purpose for which it was originally collected.

iv. Right to restriction of processing: You may also have the right to request that we restrict the use of your personal information in certain circumstances, such as when you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

v. Right to data portability: You have the right to transfer your personal information to a third party in a structured, commonly used and machine-readable format, in circumstances where the information was collected via automated means and processed with your consent or where we used the data to perform a contract with you.

vi. Right to object: You have the right to object to the use of your information in certain circumstances, such as the use of your personal information for direct marketing or in certain circumstances where we rely on legitimate interests.

vii. Right to opt out: Too Lost may disclose personal information to analytics and advertising partners, which may constitute a "sale" or "targeted advertising" under applicable laws. You have the right to opt out of such processing and can do so using any "Do Not Sell or Share My Personal Information" link, cookie preference center, or other privacy choice mechanism we make available on the Platform, or by contacting [email protected]. Where required by law, we honor browser-based opt-out preference signals, including Global Privacy Control (("GPC") signals), as a valid request to opt out of the sale of personal information or the use of personal information for targeted advertising.

viii. Right to lodge a complaint: You have the right to lodge a complaint about the processing of your personal information with the appropriate supervisory authority or other regulator.

The rights described in this section are not absolute and we reserve all of our rights available to us at law in this regard. If you wish to exercise any of these rights, please email us at [email protected]. If you make a request related to personal information about you, we will need to verify your identity. For example, we may request that you match specific pieces of information you have provided to us previously to ensure that you are the individual whose personal information is the subject of the request. If it is necessary to collect additional information from you, we will use the information only for verification purposes and will delete it as soon as practicable after complying with the request. If you make a request through an authorized agent, we will require written proof that the agent is authorized to act on your behalf. We will process your request within the time period provided by applicable law.

If you are a California resident, please see our California Privacy Notice (CCPA/CPRA Addendum) for additional information about your privacy rights and how to exercise them.

Retention of personal information

We retain your personal information for as long as it is required for the purposes stated in this Privacy Policy. Sometimes, we may retain your information for longer periods as permitted or required by law, such as to maintain suppression lists, prevent abuse, if required in connection with a legal claim or proceeding, to enforce our agreements, for tax, accounting, or to comply with other legal obligations. When deciding how long to retain your personal information, we take into account our legal and regulatory obligations, the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means.

When we no longer have a legitimate need to process your information, we will delete or anonymize your information from our active databases.

Biometric Information

Where relevant to the Services, identity verification and fraud-prevention providers such as Veriff may process personal information and service data associated with identity, eligibility, account security, transaction risk, or fraud review. Depending on the circumstances, this may include identity-document data, document images, photographs, videos, selfies, device and browser data, network and connection data, internet protocol addresses, verification metadata and results, risk signals, and, where applicable, biometric information or other sensitive personal information used for identity confirmation, liveness detection, fraud prevention, security, or legal compliance. Such processing may be carried out on our behalf, for the provider's compliance purposes, or as otherwise permitted by applicable law and the provider's terms or privacy notice.

Too Lost does not retain or store your biometric information or biometric identifiers. Veriff collects certain biometric identifiers and biometric information, namely face scan information (face geometry information and information based on that), during the identity verification process. The processing of such biometric identifiers and biometric information will be done pursuant to Veriff's Privacy Policy. In accordance with Veriff's Privacy Policy and applicable law, Veriff (i) collects and uses such information to verify your identity, prevent fraud, and provide authentication services on an ongoing basis; (ii) limits access to such information only to Veriff and its service providers; and (iii) does not otherwise share, sell, lease, trade, or otherwise profit from such information. In accordance with Veriff's Privacy Policy, Veriff will permanently destroy biometric identifiers and biometric information (i) of Illinois residents when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within three years of the individual's last interaction with Veriff, whichever occurs first, and (ii) of Texas residents the later of one year after the purpose for collecting the identifier expires, or one year after any recordkeeping obligations imposed by law in connection with the collection of the biometric identifier expires.

We do not control the systems or security practices of Veriff or other third-party service providers and cannot guarantee, and are not responsible for, the privacy or security of any data collected, shared with or processed by such parties, even if such parties are acting on our behalf. Any data collection, processing, or handling performed by third parties is subject to the security and privacy policies and practices of those third parties and we encourage you to review the privacy and/or security statements of any such third-party vendors.

Biometric identifiers and biometric information will only be collected by our service providers with your prior explicit consent. Before opting to provide Veriff with any biometric identifiers or biometric information, you will be prompted to provide your consent. By checking the box provided when prompted, you are consenting to the collection and storage of your biometric identifiers or biometric information in accordance with this Privacy Policy and the privacy notices of Veriff linked above.

Children's personal information

Our products and services are not directed to individuals under the age of 16. Too Lost does not knowingly collect personal information from children who are under 16 years of age. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete such information. If you believe that a child under 16 years has provided personal information to us, please write to us with the details, and we will take the necessary steps to delete the information.

Data security

Too Lost has taken steps to implement administrative, technical and physical safeguards designed to prevent unauthorized access, use, modification, disclosure or destruction of your personal information. Despite the security measures we have put in place, no such measures can guarantee security or protect against unauthorized activity.

Links to other websites

The Platform may provide links to third-party websites. This Privacy Policy does not apply to those sites, which operate independently from the Platform and are not under our control. These sites may have their own privacy notices in place, which we strongly suggest you review if you visit them. We are not responsible for the content of these sites, any products or services that may be offered through these sites or any other use of these sites, nor for any data processing and privacy practices associated with such sites.

Updates to this Privacy Policy

We may amend this Privacy Policy from time to time in our sole discretion. We encourage you to periodically review this Privacy Policy to stay informed about our information practices. We will indicate above the date on which this Privacy Policy was last modified.