PRIVACY POLICY

FEBRUARY 3RD, 2026 EZ-AD TV

1. SCOPE OF THIS POLICY

This Privacy Policy describes how EZ‑AD Inc. ("EZ‑AD," "we," "our," or "us") collects, uses, shares, and protects personal information when you:

visit any EZ‑AD websites (including ezadtv.com, localecommerce.com, saturntext.com, ezai.io, and their sub‑domains);
use the EZ‑AD TV in‑store digital‑signage platform, our mobile applications, or any SaaS dashboards we provide;
interact with the EZ‑AD Digital Commerce platform ("LocaleCommerce") or SaturnText SMS marketing tool; or
communicate with us through support channels, email, social media, or events.

This Policy applies globally. Additional region‑specific disclosures are embedded throughout this document and detailed in Section 8.

By continuing to use the Services, you acknowledge that you have read and understood this Policy.

2. INFORMATION WE COLLECT

We collect information that falls into the categories below:

Category	Examples	Source	Sensitive?
Identifiers	Full name, postal address, email, phone, store name, unique account ID, IP address	You / your company	No
Commercial Information	Products purchased, subscription tier, transaction history, POS SKU inventory	You / POS feed	No
Internet / Device Data	Browser type, OS, referral URL, time zone, screen resolution, cookie IDs	Automated	No
Geolocation	Approximate location from IP; optional precise GPS (within 1,750 feet) if you enable "Show nearest store." We do not sell or share precise geolocation data.	Automated / App	Yes (precise GPS)
Promotions & Survey Data	Information you submit when entering a contest, sweepstakes, or survey (e.g., name, email, mailing address, responses)	You	No
Contact‑List Data (Mobile app - optional)	Names, phone numbers, and email addresses from your device's address book, accessed only with your permission so you can select contacts to invite into the EZ‑AD app; we store details solely for the contacts you choose to invite.	You	Yes (third‑party)
Usage Analytics	Heat‑map & session data (Hotjar), page views (GA4), feature interaction	Automated	No
Marketing & Ad IDs	Google Ads conversion ID, Facebook Pixel ID	Automated	No
Payment Tokens	Encrypted Stripe token, last 4 digits of card	Stripe	No (tokenized)
Support Records	Chats, emails, call recordings, screenshots	You	May contain sensitive data

Important: We do not deliberately collect biometric identifiers or images; our screens do not perform facial recognition. Sensitive data (including contact‑list data, precise geolocation, and any health information) is processed only with your explicit consent and is not sold or shared for cross‑context advertising.

3. HOW & WHY WE USE PERSONAL DATA

We process personal data for the purposes and legal bases outlined below:

Purpose	Data Categories	Lawful Basis (GDPR)	CPRA Purpose
Account creation & authentication	Identifiers	Contract (Art 6(1)(b))	1798.140(e)(1) "Account Services"
Provide digital‑signage & e‑commerce services (including technical support / Call Center assistance)	Identifiers, Commercial Info, POS Inventory, Support Records	Contract (Art 6(1)(b))	1798.140(e)(1) "Account Services"; 1798.140(e)(2) "Processing Transactions"
Improve & debug services	Usage Analytics, Device Data	Legitimate Interest (Art 6(1)(f))	1798.140(e)(7) "Debugging"
Marketing communications (email/SMS)	Identifiers	Consent (Art 6(1)(a)) or Legitimate Interest	1798.140(e)(5) "Marketing"
Administer promotions, contests & surveys	Promotions & Survey Data, Identifiers	Consent (Art 6(1)(a)) or Legitimate Interest	1798.140(e)(5) "Marketing & Promotional events"
Interest‑based advertising (website only)	Ad IDs, Device Data	Consent (Art 6(1)(a))	"Cross‑context behavioral advertising" (opt‑out)
Payment processing	Payment Tokens	Contract; Legal Obligation	1798.140(e)(3) "Payment Processing"
Legal compliance, fraud prevention	Identifiers, Device Data	Legal Obligation (Art 6(1)(c)); Legitimate Interest	1798.140(e)(4) "Security & Integrity"

4. RETENTION OF PERSONAL DATA

Unless a longer period is required by law, we retain data for the periods below and then securely delete or anonymize:

Account & billing records - 7 years after account closure;
Payment tokens - 7 years (for tax/audit);
Usage analytics (Google Analytics, Hotjar) - 26 months;
Support tickets & call recordings - 3 years;
Advertising cookie IDs - as per cookie expiry listed in Section 5.

5. COOKIES & TRACKING TECHNOLOGIES

We use cookies, web beacons, pixel tags, HTML5 local storage, and legacy Flash cookies (where supported) for analytics and security.

5.1 Cookie Categories

Essential - required for the site to function (e.g., session tokens).
Functional - remember preferences such as language.
Analytics - measure site performance (Google Analytics, Hotjar). Off by default in EEA/UK.
Advertising - measure conversions & deliver personalized ads (Google Ads, Facebook Pixel). Off by default in EEA/UK. Opt‑out = "Do Not Share" under CPRA.

5.2 Cookie Inventory

Name	Provider	Category	Purpose	Expiry
_ga, _ga_EMSN20NPKN, _ga_T26MN09CEZ	Google Analytics	Analytics	Distinguish visitors & sessions	2 years
_gid	Google Analytics	Analytics	24‑hour unique ID	24 hours
_gcl_au	Google Ads	Advertising	Store ad click information	3 months
_hjSessionUser_2278343	Hotjar	Analytics	User session persistence	12 months
fbm_3174816862864579	Facebook Pixel	Advertising	Identify browser for ads	90 days
hdlanguage	EZ‑AD	Functional	Store UI language	1 year
hadpricing_page	EZ‑AD	Essential	Maintain pricing wizard state	Session
hadrpgsess	EZ‑AD	Essential	Session identifier	Session
hadterms	EZ‑AD	Functional	Record T&C acceptance	1 year

You can control cookies via our banner ("Accept all", "Decline all", "Adjust my preferences") or through your browser settings. See "Cookie Settings" link in the footer.

Opt‑Out Confirmation: When you decline or opt out of advertising cookies, we will display a confirmation message. Your preference is stored and will be honored on future visits. You can change your preference at any time via the Cookie Settings link in our footer.

5.3 Universal Opt‑Out Mechanism & Global Privacy Control

We recognize and honor Universal Opt‑Out Mechanism (UOOM) and Global Privacy Control (GPC) signals. When your browser or device sends one of these signals, we will treat it as a request to opt out of the sharing of your personal information for cross‑context behavioral advertising. You can enable GPC through participating browsers (such as Firefox, Brave, or DuckDuckGo) or browser extensions.

6. SHARING OF PERSONAL DATA

We do not sell personal information. We may "share" it for cross‑context advertising as defined by CPRA (Advertising cookies above). We disclose data only to:

Service Providers acting under written DPAs (Google Cloud - USA; Stripe - USA; Mailgun - USA/EU; Twilio - USA; Hotjar - EU; Meta Platforms - USA);
Third‑party integrations: If you choose to link an external account (e.g., YouTube, Facebook) to EZ‑AD, we will share and receive information as authorized by you through the OAuth consent screen. You can disconnect any integration at any time by visiting the respective feature page.
Business partners you authorize (e.g., your POS vendor);
Legal authorities when required;
Successors in the event of a merger or acquisition (notice will be provided).

All transfers are governed by 2021 Standard Contractual Clauses where applicable.

7. INTERNATIONAL DATA TRANSFERS

Our primary servers are in the United States. When we transfer personal data from the EEA/UK to the U.S. or another third country, we rely on:

Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914);
Adequacy decisions, where available; or
Your explicit consent (Art 49 GDPR) for specific transfers.

8. YOUR PRIVACY RIGHTS

8.1 EU / UK Residents (GDPR)

You have the right to request access, rectification, erasure, restriction, objection, and portability of your personal data, and to withdraw consent at any time. You can submit requests in any of the following ways:

Online form (erasure, restriction, or objection): https://ezadtv.com/forget-me
Dashboard (access, rectification, portability): log in, open Settings → Account, and click "Download your Data - Request Data." From the same page you can edit your profile details.
Other inquiries: email us at [email protected].
Email marketing opt-out: click the "Unsubscribe" link at the bottom of any marketing e-mail. Because EZ-AD TV signage licenses are held by independently owned retail stores, you may need to unsubscribe separately from each store that contacts you. Transactional messages (order confirmations, product-recall notices, account or service updates) will still be sent even if you opt out of marketing.

We will acknowledge your request within 48 hours and provide a substantive response within 30 days.

8.2 California Residents (CCPA/CPRA)

You have the right to Know, Delete, Correct, Opt‑Out of Sharing, and Non‑Discrimination. To exercise these rights:

Online form (Delete or Opt-Out of Sharing): https://ezadtv.com/forget-me
Dashboard (Know or Correct): log in, open Settings → Account, and click "Download your Data - Request Data." From the same page, you can edit your profile details.
Other inquiries: email us at [email protected].
Email marketing opt-out: click the "Unsubscribe" link at the bottom of any marketing e-mail. Because EZ-AD TV signage licenses are held by independently owned retail stores, you may need to unsubscribe separately from each store that contacts you. Transactional messages (order confirmations, product-recall notices, account or service updates) will still be sent even if you opt out of marketing.
Opt‑Out Preference Signals: We recognize and honor Universal Opt‑Out Mechanism (UOOM) and Global Privacy Control (GPC) signals. When your browser or device sends one of these signals, we will treat it as a request to opt out of the sharing of your personal information for cross‑context behavioral advertising. You can enable GPC through participating browsers or browser extensions.

We confirm receipt within 10 business days and fulfill verified requests within 45 days.

8.3 Oregon Residents

Oregon residents have rights similar to California residents under the Oregon Consumer Privacy Act, including the right to opt out of sales and targeted advertising. Specific Oregon provisions effective January 1, 2026:

We recognize Universal Opt‑Out Mechanism signals as valid opt‑out requests;
We do not sell geolocation data and have ceased all such sales as of January 1, 2026;
For children under 16, we require verifiable parental consent before processing data for targeted advertising or sales.

Submit requests using the same methods as California residents listed in Section 8.2 above.

8.4 Connecticut Residents

Connecticut residents have comprehensive privacy rights under the Connecticut Data Privacy Act, including access, deletion, correction, data portability, and opt‑out of sales and targeted advertising. As of January 1, 2026, we recognize Universal Opt‑Out Mechanism signals for Connecticut residents. Submit requests using the same methods as California residents listed in Section 8.2 above. We will respond within 45 days and provide an appeal process if you are unsatisfied with our response.

8.5 Indiana, Kentucky, and Rhode Island Residents

Residents of these states have the right to confirm whether we process their personal data, access that data, delete it, obtain a portable copy, and opt out of targeted advertising and sales. To exercise these rights:

Online form: https://ezadtv.com/forget-me
Email: [email protected]

We will respond within 45 days. You may appeal our decision by contacting [email protected] within a reasonable period. These laws took effect January 1, 2026.

8.6 Multi‑State Privacy Rights Summary

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have specific privacy rights under their state laws, including rights to access, delete, correct, and opt out of sales/sharing of personal information. Use the contact methods provided above to exercise your rights.

9. SECURITY MEASURES

We implement industry‑standard security measures to protect your personal data:

TLS 1.3 encryption in transit; AES‑256 at rest
Role‑based access control & MFA for staff
Quarterly penetration testing & annual SOC 2 Type II audits
Daily encrypted backups stored off‑site

10. ACCOUNT SECURITY & ANTI-PHISHING REMINDER

Choose a strong, unique password for your EZ-AD account and keep it confidential. EZ-AD will never ask you to reveal your password, credit-card details, or other sensitive information by email, SMS, or phone. If you receive a message that appears to come from EZ-AD requesting such data, please treat it as phishing and delete it. If you believe your account credentials have been lost, stolen, or misused, contact us immediately at [email protected] or +1 888‑800‑5593

11. CHILDREN'S PRIVACY

Our Services are not directed to children under 16. We do not knowingly collect, sell, or share personal information of consumers under 16 without affirmative authorization. If you are under 16, you must have a parent or guardian create and manage your account.

For children under 16 in states with enhanced protections (including California, Connecticut, and Oregon), we require verifiable parental consent before processing data for targeted advertising or sales. If we learn we have collected data from a child under 16 without proper authorization, we will delete it promptly.

12. BREACH NOTIFICATION COMMITMENT

In the event of a personal‑data breach likely to result in risk, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, consistent with GDPR Art 33‑34 and applicable U.S. state laws.

13. CHANGES TO THIS POLICY

We may update this Policy. Material changes will be notified via banner or email 30 days before they take effect. The "Last Updated" date at the top of this document reflects the latest revision.

14. CONTACT US

Data Controller: EZ-AD TV, Inc.

Address: 101 West Big Beaver Ave, Floor 14, Troy, MI 48084

Email: [email protected]

Phone: +1 888‑580‑5593

15. GLOSSARY

Personal Data: Information relating to an identified or identifiable individual.

Processing: Any operation performed on Personal Data.

Service Provider / Processor: Third party that processes Personal Data on our behalf.

Sell / Share: As defined in the California Privacy Rights Act.

Contract (Art 6(1)(b) GDPR): Processing necessary to deliver the products or services you request, or to take steps at your request prior to entering into a contract.

Legitimate Interest (Art 6(1)(f) GDPR): Processing based on our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Legal Obligation (Art 6(1)(c) GDPR): Processing required to comply with a legal or regulatory obligation, such as tax or accounting rules.

Consent (Art 6(1)(a) GDPR): Processing carried out only when you have given clear permission, which you may withdraw at any time.

Universal Opt‑Out Mechanism (UOOM): A technology that enables consumers to automatically communicate their privacy preferences (such as opting out of data sales) across multiple websites and services without having to opt out manually on each individual platform.

Global Privacy Control (GPC): A browser or device signal that communicates a user's request to opt out of data sales and targeted advertising. When enabled, websites that recognize GPC automatically honor the user's opt‑out preference.

Precise Geolocation: Location data that identifies a geographic area within a radius of 1,750 feet or less.