Spillit Privacy Notice

Effective Date: September 16, 2025

This Privacy Notice ("Notice") details the types of personal information that Hylite Labs ("Hylite Labs," "Company," "We," "Our") may collect, process, and/or disclose when you access, use, or signup for an account with the "Spillit" mobile application (the "Spillit app" or "Services") and our practices for processing that personal information. Please read this Notice carefully to understand our policies and practices regarding your personal information. By using or registering with our Services, you acknowledge that your personal information will be collected, used, processed and disclosed as outlined in this Privacy Notice.

Table of Contents

1. Personal Information We Collect and How We Collect It
2. Face Data Collection
3. Use of Personal Information We Collect
4. How We Disclose Personal Information We Collect
5. Data Retention
6. Security of Your Personal Information
7. Additional Information for Residents of California
8. Additional Information for Residents of Certain Other U.S. States
9. Your Choices
10. Third-Party Disclosure and Links
11. Notice Concerning the Information of Minors
12. Additional Information About the Spillit App
13. International Data Transfers
14. Changes to This Notice
15. Contact Us

1. Personal Information We Collect and How We Collect It

The term "Personal information" as used in this Notice means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. Personal information does not include information that is publicly available, deidentified, or aggregated.

We and our vendors may collect personal information from and about users of our Services from the following sources:

• Directly from you when you provide it to us
• Automatically when you use the Services
• From the Spillit app
• From your contacts when they refer you to the Spillit app
• From our vendors who help us provide the Services such as Apple, Facebook, and Google during the signup process on the Spillit app

A. Personal Information You Provide to Us

When you sign up for the Spillit app, we ask you to provide personal information such as your email address, date of birth, location, and photograph (your selfie). We process additional personal information when you use the Services, such as your audio recordings when you make an audio post/comment or your messages when you communicate with other users in the Spillit app. The personal information we get from you includes:

• Identifiers, such as name, date of birth, username, unique personal identifier, online identifier, Apple ID, Internet Protocol address, or other similar identifiers
• Records and copies of your correspondence (including email addresses and phone numbers), if you contact us. We also collect copies of your correspondences with us or other Spillit app users when you use the Spillit app chat capabilities
• Audio and visual information, including your images and voice recordings when you send us a selfie for verification, or make a post or comments with pictures and/or audio

B. Personal Information Collected Automatically

We and our vendors use cookies, web beacons, pixels, SDKs, tags and other similar technologies (collectively, "Cookies") to collect personal information when you interact with our Services. These Cookies may collect personal information about your usage and activities (such as your IP address and device identifier, the browser you are using, length and time of visit and pages visited), geolocation data and details about how you interact with our Services. This data is used by us and our vendors for various purposes, including to: operate, enable and improve our online Services; analyze usage and performance; track bugs and errors; verify account credentials and enable logins; and identify fraud, as well as protect and secure our Services.

C. Personal Information Collected Via the Spillit App

When you download, access or use the Spillit app, the Spillit app may request certain permissions from your device, which you can choose to authorize or not. These include access to your:

• Camera: You are required to take a new photo (selfie) using the camera app on your device for verification purposes
• Microphone: The Spillit app may access your microphone to capture audio (sound) if you would like to add audio to your posts and comments
• Contacts: The Spillit app may access your contacts when you give us permission to invite a friend to use the Spillit app
• Photos: The Spillit app accesses your photos to upload photos on your posts and comments. This includes the metadata associated with each photo
• Push Notifications: If you choose to enable this feature, the Spillit app will be able to send you notifications about your registration status and keep you up to date on content on the Spillit app

However, please note that if you choose not to authorize the above permissions, some of the functionality on the Spillit app may be affected.

Information Collected Through Interactive Features

You may provide personal information when you use certain interactive features on the Spillit app. Your use of interactive features on the Spillit app is voluntary. By using these interactive features, you understand we may retain the information that you submit through these features, and that our vendors may process the information obtained through these features to provide the service on our behalf. For example, we may offer an interactive chat feature on the Spillit app. Our interactive chat feature may be powered by artificial intelligence, machine learning tools, or similar technology which may be provided by our external partners. When you participate in the interactive chat, the contents of the chat may be captured and kept as a transcript.

2. Face Data Collection

A. Face Data We Collect

When you sign up for Spillit, you are required to take a selfie photograph using your device camera. This selfie is used solely to verify that you are a real person.

B. How We Process Your Selfie

• Your selfie is processed by on-device AI for immediate verification
• If automated verification fails, your photo is temporarily uploaded to our secure database for manual review by our verification team
• Photos are ONLY stored when manual review is required

C. Data Storage and Retention

• Successfully verified selfies are NOT stored - verification happens on-device
• Photos requiring manual review are deleted within 24 hours after review completion
• We do not share your face data with any third parties
• All data is stored securely using industry-standard encryption

D. Your Rights

• You can request deletion of your account and all associated data at any time through Account settings
• You can contact us at teacontact4@gmail.com for any privacy concerns
• Once your account is deleted, all personal data including any verification photos are permanently removed

3. Use of Personal Information We Collect

We may use the personal information we collect from you in the following ways:

• To set up and verify your account with us (for example, users of the Spillit app are required to submit a selfie photo for verification purposes)
• To enable you to make posts and comments
• To process and manage your subscription
• To personalize your user experience and to allow us to deliver the type of content and offerings in which you are most interested
• To deliver messages and other services and content you request and send information related to your account and the Services, including confirmations, technical notices, updates, security alerts, support and administrative messages, and enable user-to-user communication
• To conduct an aggregated analysis of the performance of our Services, including referral data if you arrive at our Services from an external source
• To maintain and improve the Services
• To conduct our business-related operations and functions, including preventing fraud, security, and legal reasons
• For other internal business purposes such as recordkeeping and risk management

4. How We Disclose Personal Information We Collect

We may disclose personal information as follows:

• With our Vendors: We may disclose your personal information to service providers that perform services on our behalf, such as analytics platforms
• If we sell or transfer all or a portion of our business assets: We may disclose personal information when we do a business deal, or negotiate a business deal, involving the sale or transfer of all or a part of our business or assets. These deals can include any merger, financing, acquisition, or bankruptcy transaction or proceeding
• To respond to lawful requests and legal processes
• To protect the rights and property of Hylite Labs, our agents, customers, and others. This includes enforcing our agreements, policies, and Terms of Use
• In an emergency: This includes protecting the safety of our employees and agents, our customers, or any person
• With those who need it to do work for us

5. Data Retention

We endeavor to retain your personal information for as long as your account is active or as needed to provide you the Services, or where we have an ongoing legitimate business need. Additionally, we will retain and use your personal information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. You can request deletion of your active account via the Spillit app by accessing your "Account" under your Profile.

6. Security of Your Personal Information

Safeguarding personal information is important to us. While no systems, applications, or websites are 100% secure, we take reasonable and appropriate steps to help protect personal information from unauthorized access, use, disclosure, alteration, and destruction. To help us protect personal information, we request that you use a strong password and never disclose your password to anyone or use the same password with other sites or accounts.

7. Additional Information for Residents of California

California Notice at Collection

This section supplements the other parts of this Notice and provides additional disclosures for residents of California. This notice at collection is meant to comply with the California Consumer Privacy Act (as amended, and together with related regulations the "CCPA").

A. Collection, Use, and Disclosure of Personal Information

We collect, use, and disclose personal information about California consumers as described in this Notice. The personal information we collect about you may vary depending on the nature of your interactions with us.

B. Sales and Sharing of Personal Information

While we do not sell personal information for monetary consideration, some of the ways we disclose personal information collected through the Spillit app may constitute a "sale" under the CCPA. The categories of personal information we have sold to third parties over the past 12 months includes:

• Identifiers
• Internet or other electronic network activity information
• Geolocation data

We sell this personal information to third-party analytics vendors for analytics purposes and to provide Services within the Spillit app. As explained below, our Services are designed for users aged 18 and older. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

C. California Privacy Rights

The CCPA provides California consumers with specific rights regarding their personal information. To exercise any of these rights, you or your authorized representative may submit a request by contacting us at teacontact4@gmail.com. If you are a California resident, you have the following rights:

• Right to Know (Categories): Request disclosure of categories of personal information collected
• Right to Know (Specific Pieces): Request specific pieces of personal information we collected about you
• Right to Delete: Request deletion of personal information we collected from you
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sales: Opt out of the sale of your personal information by contacting us at teacontact4@gmail.com
• Right to Limit Use and Disclosure of Sensitive Personal Information: We do not use or disclose sensitive personal information in ways to which this right applies
• Right to Appeal: Appeal our decision if unsatisfied with our response

Shine the Light: California's "Shine the Light" law permits California residents to request certain information regarding our disclosure of personal information to third parties for their own direct marketing purposes. However, we do not disclose personal information to third parties for their own direct marketing purposes. Requests can be sent to teacontact4@gmail.com with "California Shine the Light Request" in the subject line.

8. Additional Information for Residents of Certain Other U.S. States

This section provides additional information for residents of Maryland, New Jersey, and Virginia.

Sales and Targeted Advertising

While we do not sell personal information for monetary consideration, some of the ways we disclose personal information collected through the Spillit app may constitute a "sale" under certain state privacy laws. We may "sell" the following categories for analytics purposes:

• Identifiers
• Internet or other electronic network activity information
• Geolocation data

Privacy Rights

Residents of Maryland, New Jersey, and Virginia have the following rights:

• Right to access
• Right to correct
• Right to delete
• Right to opt out of the sale of personal data
• Right to appeal

To exercise any of these rights, contact us at teacontact4@gmail.com.

9. Your Choices

Deleting Your Account: Delete your account through your account settings. Certain information may be maintained when we have a legal requirement.

Updating Your Information: Correct or update your information within the app or by contacting us at teacontact4@gmail.com.

Mobile Application Device Permissions: Use your mobile device settings to limit mobile tracking technologies and our collection of certain information. You can stop all collection of data by uninstalling the Spillit app. Note that uninstalling the app or changing permissions will not delete your user account or previously collected personal information.

10. Third-Party Disclosure and Links

The Services may include links or integrations to other websites and software platforms whose privacy practices may differ from those of Hylite Labs. Your information on third-party sites is governed by their privacy statements. We encourage you to carefully read the privacy statement of any third-party websites or software you use.

11. Notice Concerning the Information of Minors

Spillit is not directed to children under the age of 13 and does not intentionally collect any personal information from children under the age of 13. Please contact us if your child has provided personal information to us and we will delete it. If you are a California resident under 18 who has registered to use Services, you can request content removal by contacting us at teacontact4@gmail.com.

12. Additional Information About the Spillit App

Age Restrictions

Our platform is designed for users aged 18 and older. We strictly prohibit anyone under the age of 18 from creating an account or using our services.

Content Moderation

Our team employs both automated systems and human moderation to monitor content shared on our platform. These systems are designed to detect, review, and remove content that violates our policies. All reported content is reviewed, and we may take necessary action, including removal of content, termination and banning of offending accounts, and, where appropriate, reporting to relevant authorities.

User Reporting Mechanisms

We provide tools within the Spillit app for users to report prohibited and inappropriate content and behavior. Our support team investigates reports and takes appropriate action in accordance with our policies.

13. International Data Transfers

We may transfer personal information to countries other than the country in which the data was originally collected. These countries may not have the same data protection laws as the country in which you initially provided the personal information. When we transfer your personal information to other countries, we will protect that information as described in this Notice.

14. Changes to This Notice

Hylite Labs may change this Notice from time to time. If we make any changes to this Notice, we will change the "Effective Date" above. We encourage you to review this Notice whenever you visit the Services to understand how your personal information is used.

15. Contact Us

If you have any questions about this Notice, please contact us at teacontact4@gmail.com.