PRIVACY NOTICE

This U.S. Privacy Notice ("Notice") describes how Hailstone AI Innovations Limited ("Hailstone," "we," "us,") collects, uses, discloses, and safeguards personal information in connection with the Entro.ly Service, for creators and other users located in the United States and for international users outside Indonesia. It supplements, and should be read together with, our U.S. Terms of Service.

01Scope & who we are

This Notice applies to: (a) U.S. residents using the Service, and (b) international users who are not residents of Indonesia. If you are a resident of Indonesia, see our Indonesia Privacy Policy instead.

02Notice at collection (summary)

The table below summarizes the categories of personal information we process, in accordance with Cal. Civ. Code § 1798.100(a). Full detail is in §03–§07.

03Personal information we collect

3.1 Information from TikTok

When you connect your TikTok account to Entro.ly via "Login with TikTok," we collect:

• Profile information: TikTok username, display name, profile photo/avatar, unique user ID (open_id), bio/description, and verification status
• Account statistics: Follower count, total likes, total video count
• Video information: Video titles, descriptions, hashtags, posting date/time, thumbnail images
• Performance metrics: Video views, likes, shares, comments, watch time (where available)

What we do not collect from TikTok

• Private messages or direct messages
• Draft videos (unless you explicitly upload them through a future feature)
• Your TikTok password or login credentials
• Financial account information or payment details (see §07 for how we separately collect tax/payout information directly from you)
• Location data (unless you enable it for a TikTok GO feature)

3.2 Information you provide directly

• Email address (for account notifications)
• Contact preferences and communication settings
• Feedback and support requests

3.3 Automatically collected information

• Device information (browser type, operating system)
• IP address and general location (city/country level)
• Usage data (pages visited, features used, time spent on the platform)
• Cookies and similar tracking technologies (see §17)

04Sensitive personal information

Under the California Privacy Rights Act (Cal. Civ. Code § 1798.140(ae) and § 1798.121), you have the right to direct us to limit the use of sensitive personal information to what is necessary to perform the services you requested. See §14 to submit a request.

05Data from TikTok

This mirrors the same TikTok data-handling disclosure in our Indonesia Privacy Policy — the underlying technical facts are the same regardless of jurisdiction.

• Profile information: TikTok username, display name, profile photo/avatar, unique user ID (open_id), bio/description, and verification status
• Account statistics: Follower count, total likes, total video count
• Video information: Video titles, descriptions, hashtags, posting date/time, thumbnail images
• Performance metrics: Video views, likes, shares, comments, watch time (where available)
• Commission/GMV data: TikTok Shop commission and GMV figures tied to your affiliate activity

What we do not collect from TikTok

• Private messages or direct messages
• Draft videos (unless you explicitly upload them through a future feature)
• Your TikTok password or login credentials
• Financial account information or payment details
• Location data (unless you enable it for a TikTok GO feature)

06How we use your information

We use your information to:

• Provide core services: Display your creator dashboard, analytics charts, and performance metrics
• Build your portfolio: Create a professional creator showcase page (with your consent)
• Meet tax reporting obligations: Issue Form 1099-K and comply with IRS backup withholding rules — see §07
• Improve our services: Analyze usage patterns to enhance features and user experience
• Customer support: Respond to your inquiries and resolve technical issues
• Legal compliance: Meet regulatory requirements and enforce our U.S. Terms of Service

What we will never do with your data

• We do not sell your personal information for monetary consideration, as "sell" is defined by the CCPA
• We do not share your performance metrics with other creators without your permission

See §08 for our disclosure on "sharing" for cross-context behavioral advertising, consistent with our U.S. Terms of Service §11.

07Tax & financial data

If you earn TikTok Shop commissions through Entro.ly, U.S. tax law may require us (or our payment partner) to collect a completed Form W-9 (U.S. persons) or Form W-8 (non-U.S. persons), and to report your earnings on Form 1099-K under 26 U.S.C. § 6050W once you cross the applicable reporting threshold.

• We collect your Taxpayer Identification Number (TIN), which may be a Social Security Number (SSN), Employer Identification Number (EIN), or Individual Taxpayer Identification Number (ITIN);
• If you do not provide a valid TIN, or if the IRS notifies us of a mismatch, we may be required to withhold 24% of your payments as "backup withholding" under 26 U.S.C. § 3406;
• [PENDING CONFIRMATION — confirm — internal access list and retention period for W-9/TIN records];
• [PENDING CONFIRMATION — confirm — is Hailstone or a third-party payment processor the "third-party settlement organization" of record for 1099-K purposes? (open question #5)]

IRS regulations generally require tax records to be retained for a minimum period after the relevant tax year; [PENDING CONFIRMATION — confirm the exact retention period Finance applies]

08How we share information — "sell" and "share"

Under the CCPA/CPRA, "sell" and "share" are distinct, defined terms. We do not "sell" personal information for monetary or other valuable consideration. We may "share" limited identifiers for cross-context behavioral advertising on our public marketing site, consistent with the disclosure already made in our U.S. Terms of Service §11. You can opt out at any time by emailing [email protected] or by enabling a Global Privacy Control (GPC) signal in your browser — see §17.

Categories of recipients

• Service providers who process data on our behalf (see §09);
• TikTok, to the extent required for the API integration you authorize;
• Payment processors, for payout and tax reporting purposes (see §07);
• Government authorities or courts, where required by law;
• A successor entity, in the event of a merger, acquisition, or asset sale, subject to this Notice continuing to apply to your data.

09Service providers & sub-processors

We work with third-party service providers who process personal information on our behalf, under contractual confidentiality and data-protection obligations. Categories include:

• Cloud hosting and infrastructure providers;
• Analytics services (for platform improvement);
• Customer support tooling;
• Email notification services;
• Payment and payout processors.

10Data storage & international transfer

11Retention

• Active accounts: Your data is updated regularly while your account is active
• Inactive accounts: [PENDING CONFIRMATION — confirm inactivity threshold and archival policy for U.S. accounts (Indonesia policy uses 90 days — confirm whether the same applies here)]
• Account deletion: [PENDING CONFIRMATION — confirm deletion timeline for U.S. accounts (Indonesia policy commits to 90 days)]
• Sensitive PI / tax records: [PENDING CONFIRMATION — see §07 — Finance to confirm retention period for W-9/TIN and 1099-K records]

12Security

We implement security measures designed to protect your information, including:

• Encryption: Data transmission uses HTTPS/TLS encryption
• Token security: TikTok OAuth access tokens are encrypted at rest
• Access control: Internal access policies limit who can view your data
• Token rotation: Access tokens are automatically refreshed on a regular schedule

13Your privacy rights

Depending on your state of residence, you may have some or all of the following rights over your personal information:

• Right to know/access — what personal information we have collected, used, or shared about you;
• Right to correct — inaccurate personal information;
• Right to delete — your personal information, subject to certain exceptions;
• Right to data portability — receive a copy of your data in a portable format;
• Right to opt out — of the sale or sharing of your personal information;
• Right to opt out of targeted advertising;
• Right to limit — use of sensitive personal information (see §04);
• Right to opt out of profiling — in furtherance of decisions producing legal or similarly significant effects (see §19);
• Right to non-discrimination — for exercising any of these rights.

Not every right is available in every state. See §16 for state-specific detail.

14How to exercise your rights

You may submit a request using either of the following methods:

• Email:

  Send your request to [email protected], including your account email, the right you wish to exercise, and your state of residence.

• Identity verification: We will verify your identity in a manner proportionate to the sensitivity of your request before acting on it. We will not ask for more information than necessary.
• Authorized agent: You may designate an authorized agent to submit a request on your behalf. We may require proof of the agent's authorization and may still need to verify your identity directly.
• Response time: We will acknowledge your request within 10 calendar days and respond substantively within 45 days, with a possible one-time 45-day extension where permitted by law.
• Cost: Exercising your rights is free. We may decline requests that are manifestly unfounded or excessive, including repeated requests within a 12-month period beyond what applicable law allows.

15Appeals

If we decline your rights request, you may appeal our decision. To submit an appeal, email [email protected] with the subject line "Privacy Rights Appeal" and reference your original request. We will respond to your appeal within 45 days of receipt, consistent with Virginia, Colorado, Connecticut, and Texas law.

If we deny your appeal, you may contact your state Attorney General's office to file a complaint.

16State-specific notices

The following states have additional or state-specific privacy rights. This list will grow as more states enact comprehensive privacy laws.

17Cookies, tracking & Global Privacy Control

We use cookies and similar technologies as described in our Cookie Policy.

Do Not Track: Our systems do not currently respond to browser "Do Not Track" signals, which lack a common industry standard.

18Children's privacy

The Service is intended for users who are at least 18 years old, consistent with our U.S. Terms of Service §2. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506 and 16 C.F.R. Part 312. If you believe a child has provided us with personal information, contact [email protected] and we will promptly delete it.

19Automated decision-making & profiling

20Changes to this Notice

We may update this Notice from time to time. We will notify you of material changes by posting the updated Notice on this page with a new "Effective" date, and by email or in-app notice where required by law. Prior versions will remain accessible in our archive.

21Contact us

[PENDING CONFIRMATION — version stamp + effective date to be set at legal sign-off, format YYYY.MM.DD-US, per PRD §10.3]