PRIVACY POLICY

1. INTRODUCTION

This Privacy Policy describes how Illuminated Story (the Company, we, our, or us), a company organized under the laws of the jurisdiction in which we operate, collects, uses, and protects your personal information when you visit our website at https://illuminatedstory.com/ or use our services.

Effective Date: 2026-09-16

Privacy Contact: Illuminated Story

Email: [email protected]

2. INFORMATION WE COLLECT

2.1. Personal Information You Provide

We may collect the following personal information when you voluntarily provide it:

• Name, email address, and phone number

• Billing and shipping addresses

• Payment information (processed securely through third-party processors)

• Communication preferences and feedback

• Information relevant to the services you request

• Any information you provide in forms, surveys, or communications

2.2. Information Automatically Collected

When you visit our website, we automatically collect:

• IP address and general location information

• Browser type, device information, and operating system

• Pages visited, time spent, and navigation patterns

• Referring website and search terms used

• Cookies and similar tracking technologies

2.3. Third-Party Information

We may receive information about you from third-party sources such as:

• Social media platforms (if you connect your accounts)

• Payment processors and financial institutions

• Marketing and analytics service providers

• Public databases and directories

3. HOW WE USE YOUR INFORMATION

We use your personal information for the following business purposes:

3.1. Service Delivery

• Providing the services described on our website and in our agreements

• Processing transactions and managing your account

• Communicating with you about our services

• Customizing your experience and content

3.2. Business Operations

• Improving our website and services

• Conducting analytics and research

• Managing customer relationships

• Preventing fraud and ensuring security

3.3. Marketing Communications

• Sending newsletters and promotional materials (with your consent)

• Providing information about new services or offerings

• Conducting customer surveys and feedback collection

3.4. Legal Compliance

• Complying with applicable laws and regulations

• Responding to legal requests and law enforcement

• Protecting our rights and interests

• Enforcing our terms and conditions

4. LEGAL BASIS FOR PROCESSING

We process your personal information based on:

• Consent: When you explicitly agree to specific processing activities

• Contractual Necessity: To fulfill our obligations under service agreements

• Legitimate Business Interests: For business operations, analytics, and improvements

• Legal Compliance: To comply with applicable laws and regulations

3.4. Legal Compliance

5. INFORMATION SHARING AND DISCLOSURE

5.1. Service Providers

We may share your information with trusted third-party service providers who assist us with:

• Payment processing through industry-standard secure payment processors

• Email marketing through email marketing platforms

• Website hosting through cloud hosting providers

• Analytics and performance monitoring through website analytics and monitoring services

• Customer support services

All service providers are bound by confidentiality agreements and are prohibited from using your information for purposes other than providing services to us.

5.2. Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity, subject to appropriate confidentiality agreements and notice to affected individuals.

5.3. Legal Requirements

We may disclose your information when required by law or in good faith belief that such disclosure is necessary to:

• Comply with legal processes or government requests

• Protect and defend our rights and property

• Investigate potential violations of our terms

• Protect the safety of our users or the public

5.4. With Your Consent

We may share your information for other purposes with your explicit consent.

5.5. No Sale of Personal Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. INTERNATIONAL DATA TRANSFERS

6.1. Cross-Border Processing

As a business serving clients in multiple locations, your personal information may be transferred to and processed in countries where we or our service providers operate.

6.2. Safeguards for International Transfers

When transferring data internationally, we implement appropriate safeguards including:

• Standard contractual clauses with service providers

• Adequacy decisions where available

• Your explicit consent for specific transfers

• Technical and organizational security measures

7. STATE-SPECIFIC PRIVACY RIGHTS (U.S. RESIDENTS)

7.1. California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights:

• Right to Know: Request information about personal information we collect, use, and share

• Right to Delete: Request deletion of your personal information

• Right to Correct: Request correction of inaccurate personal information

• Right to Opt-Out: Opt-out of the sale or sharing of personal information (we do not sell personal information)

• Right to Limit Sensitive Personal Information: Limit the use of sensitive personal information

• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your rights

7.2. Virginia Residents (VCDPA)

Virginia residents have rights to access, correct, delete, and obtain a copy of their personal information, as well as opt-out of certain processing activities.

7.3. Colorado Residents (CPA)

Colorado residents have rights to access, correct, delete, and port their personal information, as well as opt-out of certain processing.

7.4. Connecticut Residents (CTDPA)

Connecticut residents have rights similar to other state privacy laws regarding access, correction, deletion, and opt-out.

7.5. Other States

We monitor developments in state privacy laws and will update this policy as new regulations take effect.

8. EUROPEAN UNION RESIDENTS (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

8.1. Enhanced Rights

• Right of Access: Obtain copies of your personal data

• Right of Rectification: Correct inaccurate or incomplete data

• Right of Erasure: Request deletion of your personal data

• Right to Restrict Processing: Limit how we process your data

• Right to Data Portability: Receive your data in a portable format

• Right to Object: Object to processing based on legitimate interests

• Rights Related to Automated Decision-Making: Protection against automated profiling

8.2. Legal Basis for EU Processing

We process EU residents' data based on:

• Consent for marketing and non-essential services

• Contractual necessity for service delivery

• Legitimate interests for business operations

• Legal compliance where required

8.3. Data Transfers from EU

We ensure adequate protection for EU data through:

• Standard Contractual Clauses approved by the European Commission

• Adequacy decisions where available

• Your explicit consent for specific transfers

8.4. EU Data Protection Officer

For EU-specific privacy inquiries, you may contact our privacy team at [email protected].

9. PAYMENT INFORMATION SECURITY

9.1. PCI DSS Compliance

We comply with the Payment Card Industry Data Security Standard (PCI DSS) when handling payment card information. We use certified payment processors and implement industry-standard security measures.

9.2. Secure Payment Processing

• All payment transactions are encrypted using SSL/TLS technology

• We use tokenization to avoid storing actual card numbers

• Payment data is processed by PCI-compliant third-party providers

• We maintain minimal payment information necessary for business purposes

10. SENSITIVE PERSONAL INFORMATION

10.1. Definition of Sensitive Information

Depending on jurisdiction, sensitive personal information may include:

• Health information and medical data

• Biometric data (fingerprints, facial recognition, voice recognition

• Genetic data

• Racial or ethnic origin

• Religious or philosophical beliefs

• Trade union membership

• Political opinions or affiliations

• Sexual orientation or sex life information

• Criminal history or alleged offenses

• Financial account numbers or payment card details

• Social security numbers or national identification numbers

• Precise geolocation data

• Information about minors (under 13-18 depending on jurisdiction)

10.2. Collection and Use of Sensitive Information

We generally do NOT collect sensitive personal information unless:

• You voluntarily provide it for specific services (e.g., health coaching programs)

• It is necessary for service delivery you requested

• Required by law or legal process

• Necessary for legal claims or defense

10.3. Special Protections by Region

EUROPEAN UNION (GDPR Article 9):

• Sensitive data requires explicit consent or specific legal basis

• Enhanced protections for special categories of data

• Prohibition on processing unless exception applies

CALIFORNIA (CPRA):

• Right to limit use and disclosure of sensitive personal information

• Enhanced penalties for breaches involving sensitive data

• Opt-out rights for sensitive information processing

BRAZIL (LGPD):

• Sensitive data requires specific, highlighted consent

• Enhanced restrictions on processing sensitive data

• Special protections for children's and adolescents' data

ASIA-PACIFIC:

• South Korea: Enhanced consent for sensitive information

• Singapore: Reasonable notification and consent for sensitive data

• Australia: Special handling for sensitive information under APP

10.4. Verbal or Session-Based Information

For service providers (coaches, consultants, therapists, counselors):

When you participate in sessions, coaching calls, or consultations:

• Information discussed may include sensitive topic

• We treat all session information as confidential

• Notes or recordings (if any) are securely stored

• Access is strictly limited to authorized service providers

• Enhanced security measures protect this information

• We obtain separate consent for recording sessions

• You may request deletion of session notes (subject to legal/professional retention requirements)

IMPORTANT: If you are a healthcare provider or mental health professional, you may be subject to HIPAA (US), PHIPA (Canada), or equivalent healthcare privacy laws that impose additional requirements beyond this privacy policy.

10.5. Your Rights Regarding Sensitive Information

You have enhanced rights for sensitive information:

• Right to withdraw consent at any time

• Right to request deletion (subject to legal requirements)

• Right to limit use and disclosure (where applicable)

• Right to know what sensitive information we hold

• Right to request additional security measures

• Right to obtain copies in a secure manner

10.6. Security of Sensitive Information

We implement heightened security for sensitive information:/

• End-to-end encryption where technically feasible

• Access controls and authentication requirements

• Regular security audits

• Secure deletion protocols

• Breach notification procedures

• Staff training on sensitive data handling

11. DATA RETENTION

We retain your personal information only as long as necessary for the purposes stated in this policy or as required by applicable law.

11.1. Customer Data

• Active customers: For the duration of the business relationship plus [3] years

• Former customers: [7] years for tax, legal, and business record purposes

• Marketing contacts: Until you unsubscribe or request deletion, or after [3] years of inactivity

11.2. Website Data

• Analytics data: [26] months (standard analytics platform retention) or as configured

• Server logs: [12] months for security and troubleshooting purposes

• Cookie data: As specified in our cookie settings (typically 90 days to 13 months)

11.3. Legal and Regulatory Requirements

• Tax records: [7] years or as required by applicable tax regulations in your jurisdiction

• Employment records: As required by applicable employment laws (typically 3-7 years)

• Dispute-related records: Until resolution plus applicable statute of limitations period

• Contractual records: Duration of contract plus 6-7 years per business record requirements

11.4. Retention Period Justification

The retention periods above represent standard business practices based on:

• Accounting and tax requirements

• Legal obligations and statute of limitations periods

• Industry best practices

• Business operational needs

• Customer service and support requirements

11.5. Regional Retention Variations

Note: These retention periods may be adjusted based on:

• Specific legal requirements in your jurisdiction

• Nature of your business and industry

• Contractual obligations

• Legitimate business needs

• Your company's record retention policy

ASIA-PACIFIC:

• Retention periods vary by country and data type

• Legal and contractual obligations may require retention

• Data subjects may request earlier deletion in some jurisdictions

CALIFORNIA AND U.S. STATES:

• No specific retention periods mandated

• Business record retention follows state commercial codes

• Right to deletion applies with exceptions for legal compliance

BRAZIL (LGPD):

• Retention limited to fulfillment of processing purpose

• Retention for legal/regulatory compliance permitted

• Immediate deletion upon request unless legal basis exists

IMPORTANT: If you operate in regulated industries (healthcare, finance, legal), you may be subject to specific retention requirements that override these general periods. Consult with legal counsel regarding industry-specific obligations.

11.6. Data Deletion Process

When retention periods expire or upon valid deletion request:

• Personal data is securely deleted from active systems

• Backups are overwritten during next backup cycle (typically 30-90 days)

• Anonymized or aggregated data may be retained for analytics

• De-identified data not subject to deletion requirements

• Secure deletion methods prevent data recovery

12. DATA SECURITY

We implement comprehensive security measures to protect your personal information:

12.1. Technical Safeguards

• Encryption of data in transit and at rest

• Secure hosting with reputable cloud providers

• Regular security updates and patches

• Multi-factor authentication for administrative access

• Firewall and intrusion detection systems

12.2. Organizational Safeguards

• Employee training on data protection

• Access controls and need-to-know principles

• Regular security audits and assessments

• Incident response procedures

• Confidentiality agreements with employees and contractors

12.3. Data Breach Response

In the event of a data breach, we will:

• Contain and assess the breach within 24 hours

• Notify affected individuals without unreasonable dela

• Report to relevant authorities as required by law

• Take remedial actions to prevent future incidents

13. YOUR PRIVACY CHOICES

13.1. Email Marketing Communications

EMAIL CONSENT REQUIREMENTS BY REGION:

European Union / UK / Canada / Australia (OPT-IN):

• We obtain explicit opt-in consent before sending marketing emails

• Each email contains a clear unsubscribe link

• We honor unsubscribe requests within 10 business days

• Separate consent for different types of marketing

Germany (DOUBLE OPT-IN):

• For German residents, we implement double opt-in (confirmed opt-in)

• You receive confirmation email to verify your email address

• Marketing emails only sent after confirmation

United States (OPT-OUT / CAN-SPAM):

• You may receive marketing emails based on business relationship

• Each email contains clear opt-out mechanism

• We honor opt-out requests within 10 business days

• We include our physical postal address in all marketing emails

Brazil (OPT-IN):

• We obtain explicit consent before marketing communications

• Clear unsubscribe mechanism in every email

• Consent withdrawal honored immediately

MANAGING EMAIL PREFERENCES:

• Unsubscribe from marketing emails using the link in each email

• Contact us directly at [email protected] to opt-out of all communications

• Update your communication preferences in your account settings

• Email us to modify frequency or types of emails received

Note: Transactional emails (order confirmations, account notifications, password resets) are not considered "marketing" and cannot be unsubscribed from as they are necessary for service delivery.

13.2. SMS/Text Message Marketing

Where we send marketing SMS messages:

• We obtain explicit opt-in consent before sending promotional texts

• Standard message and data rates may apply

• Reply STOP to opt-out at any time

• Reply HELP for assistance

• We comply with TCPA (US), Privacy Act (Australia), and applicable SMS marketing laws

• Opt-out requests honored immediately

13.3. Cookies and Tracking

• Adjust cookie settings through your browser preferences

• Manage cookie consent through our cookie banner (where available)

• Opt-out of analytics tracking through platform-specific settings:

  • Google Analytics: tools.google.com/dlpage/gaoptout

  • Google Ads: adssettings.google.com

• Use browser "Do Not Track" settings (where supported)

• Enable Global Privacy Control (GPC) for automatic opt-out where required

• Delete existing cookies through browser settings

13.4. Targeted Advertising and Sale/Sharing

CALIFORNIA / U.S. STATE RESIDENTS:

• Right to opt-out of "sale" or "sharing" of personal information

• Note: Using analytics and advertising pixels may constitute "sharing" under state laws

• Opt-out through our "Do Not Sell/Share My Personal Information" link

• We honor Global Privacy Control (GPC) signals automatically

EU / UK RESIDENTS:

• Right to object to processing for direct marketing purposes

• Right to object to profiling for marketing

• Opt-out through privacy settings or contact us directly

ALL USERS:

• Opt-out of targeted advertising through:

  - NAI Opt-Out: www.networkadvertising.org/choices

  - DAA Opt-Out: www.aboutads.info/choices

  - Platform-specific ad settings (Google, Facebook, etc.)

13.5. Account Information and Data Access

• Update your account information through our website/platform

• Request a copy of your personal information (data portability)

• Download your personal information in a portable format where available

• Request correction of inaccurate information

• Request deletion of your account and associated data (subject to legal retention requirements)

13.6. Withdrawing Consent

For processing based on consent, you may withdraw consent at any time:

• Update your account preferences

• Use unsubscribe links in communications

• Adjust cookie settings in your browser

• Contact us at [email protected]

• Use in-app privacy controls where available

Important: Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

13.7. Do Not Track Signals

Some browsers offer "Do Not Track" (DNT) signals. Our response:

• We honor Global Privacy Control (GPC) where legally required (California, Colorado, etc.)

• We may not respond to standard DNT signals unless legally required

• We recommend using GPC for more reliable opt-out signaling

• Browser privacy settings and cookie controls remain available

14. CHILDREN'S PRIVACY (U.S. COPPA)

Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete such information promptly.

For children between 13 and 18, we may require parental consent before collecting personal information for marketing purposes where required by applicable law.

Note: See Section 24 for regional variations in children's privacy requirements across different jurisdictions.

15. COOKIES AND TRACKING TECHNOLOGIES

15.1. Types of Cookies We Use

• Essential Cookies: Necessary for website functionality, security, and authentication (no consent required in most jurisdictions)

• Performance Cookies: Help us analyze website usage, traffic sources, and performance metrics

• Functionality Cookies: Remember your preferences, settings, and personalization choices

• Advertising/Marketing Cookies: Used for targeted advertising, retargeting, and conversion tracking (requires consent in many jurisdictions)

15.2. Third-Party Tracking and Disclosure

We may use the following categories of third-party services that may place cookies or use tracking technologies:

ADVERTISING AND MARKETING:

• Advertising optimization and conversion tracking (tracks ad performance, conversions, retargeting)

  • Purpose: Measure ad effectiveness, retarget interested visitors, optimize campaign

  • Duration: Typically 90 days to 13 months depending on platform

  • Legal Basis: Consent (required in most jurisdictions

• Social media pixels and plugins (Facebook, LinkedIn, TikTok, Instagram, Twitter/X)

  • Purpose: Track conversions from social ads, enable social sharing, show relevant ads

  • Duration: Varies by platform (typically 90-180 days)

  • Legal Basis: Consent (required in EU, UK, Brazil, and other jurisdictions)

PAYMENT AND FRAUD PREVENTION:

• Payment processor tracking for fraud prevention and transaction security

  • Purpose: Prevent fraudulent transactions, ensure payment security

  • Duration: Session-based or as required for fraud prevention

  • Legal Basis: Contractual necessity / Legal obligation

COMMUNICATION TOOLS:

• Email tracking pixels (tracks email opens, link clicks)

  • Purpose: Understand email engagement, improve communications

  • Duration: Varies by email platform

  • Legal Basis: Legitimate interest / Consent where required

• Live chat and customer support tools

  • Purpose: Provide customer support, track support interactions

  • Duration: Session-based or as configured

  • Legal Basis: Legitimate interest / Contractual necessity

15.3. Specific Cookie Information:

Where required by applicable law (EU ePrivacy Directive, UK PECR, French CNIL, Brazilian LGPD cookie requirements), we maintain a detailed cookie table listing:

• Cookie name and identifier

• Purpose and category

• Duration/expiration

• First-party vs third-party

• Legal basis for processing

EUROPEAN UNION / UK (ePrivacy Directive / PECR):

• We obtain prior consent before placing non-essential cookies

• Essential cookies may be placed without consent

• Consent must be freely given, specific, informed, and unambiguous

• Cookie walls (blocking access until consent) may not comply with law

BRAZIL (LGPD):

• We obtain consent before placing cookies that process personal data

• We provide clear information about cookie purposes

• Users can revoke consent at any time

CALIFORNIA / U.S. STATES:

• We disclose use of cookies and tracking in privacy notices

• We honor Global Privacy Control (GPC) signals where required

• We provide opt-out mechanisms for sale/sharing of personal information

OTHER JURISDICTIONS:

• We comply with applicable cookie and tracking regulations

• We implement consent mechanisms where legally required

• We provide cookie management options

15.5. Managing Cookies and Tracking

You can control cookies and tracking through:

BROWSER SETTINGS:

• Delete existing cookies through browser settings

• Block future cookies through browser preferences

• Enable "Do Not Track" signals (where supported)

• Use private/incognito browsing mode

OUR COOKIE CONSENT BANNER:

• Manage cookie preferences through our consent banner (where applicable)

• Update preferences at any time through cookie settings link

• Granular control over different cookie categories

THIRD-PARTY OPT-OUT TOOLS:

• NAI Opt-Out: www.networkadvertising.org/choices

• DAA Opt-Out: www.aboutads.info/choices

• Google Analytics Opt-Out: tools.google.com/dlpage/gaoptout

• Google Ads Settings: adssettings.google.com

• Facebook Ad Preferences: www.facebook.com/ads/preferences

MOBILE DEVICE SETTINGS:

• iOS: Settings > Privacy > Advertising > Limit Ad Tracking

• Android: Settings > Google > Ads > Opt out of Ads Personalization

GLOBAL PRIVACY CONTROL (GPC):

• We honor GPC signals where legally required

• Enable GPC in supported browsers to automatically opt-out

15.6. Consequences of Disabling Cookies

If you disable cookies:

• Essential cookies: Website may not function properly

• Performance cookies: We cannot improve site performance based on usage data

• Functionality cookies: Site will not remember your preferences

• Advertising cookies: You will still see ads, but they will be less relevant

15.7. Behavioral Profiling and Automated Decision-Making

We may use cookies and tracking data for:

• Behavioral profiling to show relevant content and offers

• Automated decision-making for fraud prevention

• Retargeting and personalized advertising

Where required by law (GDPR, LGPD), you have the right to:

• Opt-out of profiling for marketing purposes

• Not be subject to automated decision-making with legal effects

• Request human review of automated decisions

16. UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect:

• Changes in our business practices

• Updates to applicable privacy laws

• New features or services we offer

• Feedback from users and regulators

We will notify you of material changes by:

• Posting the updated policy on our website

• Sending email notifications to registered users

• Updating the "Last Updated" date at the top of this policy

Your continued use of our services after changes constitutes acceptance of the updated Privacy Policy.

17. CONTACT INFORMATION

For privacy-related questions, concerns, or to exercise your rights, please contact us:

Illuminated Story

Privacy Contact: Illuminated Story

Email: [email protected]

Address: 17 Millicent Road, Langwarrin, Victoria 3910, Australia

Website: https://illuminatedstory.com/

Response Time: We will respond to privacy requests within 45 days (or as required by applicable law).

18. ASIA-PACIFIC RESIDENTS (REGIONAL SUPPLEMENT)

18.1. Singapore Residents (PDPA)

If you are a resident of Singapore, you have rights under the Personal Data Protection Act (PDPA):

• Right to Access: Request access to your personal data we hold

• Right to Correction: Request correction of inaccurate personal data

• Right to Withdraw Consent: Withdraw consent for marketing and non-essential processing

• Right to Data Portability: Request your data in a commonly used format

• Data Protection Officer: We maintain appropriate data protection practices as required

We ensure that personal data transferred outside Singapore is subject to appropriate safeguards.

18.2. Australia Residents (Privacy Act)

If you are an Australian resident, you have rights under the Privacy Act 1988 and Australian Privacy Principles (APPs):

• Right to Access: Access your personal information we hold

• Right to Correction: Correct inaccurate or out-of-date information

• Right to Complain: Lodge complaints with the Office of the Australian Information Commissioner (OAIC)

• Overseas Disclosure: We take reasonable steps to ensure overseas recipients comply with Australian privacy law

• Sensitive Information: We obtain explicit consent for collection of sensitive information

18.3. Japan Residents (APPI)

If you are a resident of Japan, you have rights under the Act on the Protection of Personal Information (APPI):

• Right to Disclosure: Request disclosure of your personal information

• Right to Correction: Request correction, addition, or deletion of personal information

• Right to Suspend Use: Request suspension of use or erasure of personal information

• Cross-Border Transfers: We obtain consent or ensure adequate protection for transfers outside Japan

• Individual Identification Code: Special protections apply to biometric and identification data

18.4. South Korea Residents (PIPA)

If you are a resident of South Korea, you have rights under the Personal Information Protection Act (PIPA):

• Right to Access: Request to view your personal information

• Right to Correction: Request correction of inaccurate information

• Right to Deletion: Request deletion of your personal information

• Right to Suspend Processing: Request temporary suspension of processing

• Consent Requirements: We obtain explicit consent for collection and use of personal information

• Unique Identifiers: Special protections for resident registration numbers and other unique identifiers

• Children's Data: Enhanced protections for persons under 14 years of age

18.5. India Residents (DPDP Act)

If you are a resident of India, you have rights under the Digital Personal Data Protection Act 2023

• Right to Access: Obtain information about processing of your personal data

• Right to Correction: Correct inaccurate or misleading personal data

• Right to Erasure: Request deletion of personal data

• Right to Grievance Redressal: Access our grievance redressal mechanism

• Right to Nominate: Nominate another person to exercise rights in case of death or incapacity

• Consent Manager: You may manage consent through authorized consent managers

We process personal data of Indian residents only with valid consent and for lawful purposes.

18.6. Philippines Residents (DPA)

If you are a resident of the Philippines, you have rights under the Data Privacy Act:

• Right to Information: Be informed about collection and processing of personal data

• Right to Access: Access your personal data in our custody

• Right to Correction: Dispute and correct inaccurate personal data

• Right to Erasure: Request deletion of personal data

• Right to Damages: Claim compensation for damages from privacy violations

• Sensitive Personal Information: Enhanced protections for sensitive information

Philippine residents may file complaints with the National Privacy Commission at www.privacy.gov.ph.

18.7. Thailand Residents (PDPA)

If you are a resident of Thailand, you have rights under the Personal Data Protection Act:

• Right to Access: Access and obtain copy of your personal data

• Right to Data Portability: Receive data in machine-readable format

• Right to Object: Object to processing based on legitimate interests

• Right to Erasure: Request deletion of personal data

• Right to Restrict Processing: Request restriction of processing

• Consent Withdrawal: Withdraw consent at any time

19. BRAZIL RESIDENTS (LGPD)

If you are a resident of Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD):

19.1. Your LGPD Rights

• Right to Confirmation and Access: Confirm existence of processing and access your personal data

• Right to Correction: Correct incomplete, inaccurate, or outdated data

• Right to Anonymization, Blocking, or Deletion: Request anonymization, blocking, or deletion of unnecessary or excessive data

• Right to Portability: Request portability of data to another service provider

• Right to Information: Be informed about public and private entities with which we share data

• Right to Information about Consent: Be informed about the possibility and consequences of not providing consent

• Right to Revoke Consent: Revoke consent at any time

19.2. Legal Basis for Processing in Brazil

We process personal data of Brazilian residents based on:

• Consent

• Compliance with legal or regulatory obligations

• Execution of contract

• Legitimate interests

• Protection of life or physical safety

• Health protection procedures

19.3. International Data Transfers from Brazil

When transferring personal data outside Brazil, we ensure adequate safeguards through:

• Standard contractual clauses

• Adequacy decisions

• Specific safeguards and guarantees

• Your explicit consent

Brazilian residents may file complaints with the Autoridade Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd.

20. CANADA RESIDENTS (PIPEDA)

If you are a resident of Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws:

20.1. Your Canadian Privacy Rights

• Right to Access: Access your personal information in our custody or control

• Right to Correction: Challenge the accuracy and completeness of your information

• Right to Withdraw Consent: Withdraw consent for collection, use, or disclosure

• Right to Information: Understand how your information is used

• Right to Complain: File complaints with the Privacy Commissioner of Canada

20.2. Consent Requirements

We obtain meaningful consent for collection, use, and disclosure of personal information. Consent can be express or implied depending on sensitivity of information and reasonable expectations.

19.3. Accountability

We are accountable for personal information under our control, including information transferred to third parties for processing.

Canadian residents may file complaints with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

21. SOUTH AFRICA RESIDENTS (POPIA)

If you are a resident of South Africa, you have rights under the Protection of Personal Information Act (POPIA):

21.1. Your POPIA Rights

• Right to Access: Request access to personal information we hold

• Right to Correction: Request correction or deletion of inaccurate information

• Right to Object: Object to processing of personal information

• Right to Deletion: Request destruction of personal information

• Right to Complain: Lodge complaints with the Information Regulator

21.2. Processing Conditions

We process personal information of South African residents in accordance with POPIA's conditions for lawful processing:

• Accountability

• Processing limitation

• Purpose specification

• Further processing limitation

• Information quality

• Openness

• Security safeguards

• Data subject participation

21.3. Cross-Border Transfers

We ensure adequate protection when transferring personal information outside South Africa through:

• Recipient's compliance with POPIA-equivalent laws

• Binding corporate rules

• Standard data protection clauses

• Your consent

South African residents may contact the Information Regulator at https://inforegulator.org.za.

22. CHINA RESIDENTS (PIPL)

If you are a resident of China, you have rights under the Personal Information Protection Law (PIPL):

22.1. Your PIPL Rights

• Right to Know and Decide: Know and decide on the processing of your personal information

• Right to Restrict or Refuse: Restrict or refuse processing of personal information

• Right to Access and Copy: Access and obtain copies of your personal information

• Right to Portability: Request transfer of personal information

• Right to Correction and Deletion: Request correction or deletion of personal information

• Right to Explanation: Receive explanation of processing rules

• Right to Withdraw Consent: Withdraw consent at any time

22.2. Sensitive Personal Information

We process sensitive personal information (biometric, religious beliefs, medical health, financial accounts, location tracking, minors under 14) only with separate consent and clear necessity.

22.3. Cross-Border Data Transfers

For transfers of personal information outside China, we:

• Conduct security assessments as required

• Obtain certification from professional institutions

• Execute standard contracts with overseas recipients

• Comply with other conditions specified by Chinese authorities

22.4. Personal Information Protection Officer

We designate personnel responsible for personal information protection and publish contact information for handling complaints.

23. MIDDLE EAST RESIDENTS

23.1. United Arab Emirates

If you are a resident of the UAE, we comply with applicable federal and emirate-level data protection laws. You have rights to access, correct, and delete your personal data. We implement appropriate security measures and obtain consent for data processing.

23.2. Qatar

If you are a resident of Qatar, we comply with Law No. 13 of 2016 on Personal Data Privacy. You have rights to access, correct, and delete personal data. We process data lawfully and ensure appropriate security measures.

23.3. Saudi Arabia

If you are a resident of Saudi Arabia, we comply with the Personal Data Protection Law (PDPL). You have rights to access, correct, delete, and restrict processing of your personal data. We obtain consent for processing and ensure data security.

23.4. Israel

If you are a resident of Israel, we comply with the Protection of Privacy Law, 5741-1981. You have rights to access and correct personal information in databases. We register databases as required and comply with transfer restrictions.

24. OTHER INTERNATIONAL RESIDENTS

24.1. General International Rights

If you are a resident of a country not specifically mentioned above, you generally have rights to:

• Access your personal information

• Request correction of inaccurate information

• Request deletion of your information

• Withdraw consent for processing

• Object to certain types of processing

• Lodge complaints with local data protection authorities

24.2. Our Commitment

We commit to:

• Respecting privacy rights under applicable local laws

• Implementing appropriate security measures

• Providing transparency about our data practices

• Responding to privacy requests within reasonable timeframes

• Complying with local data protection requirements

24.3. Local Law Compliance

Where local laws provide greater privacy protections than described in this policy, those local laws shall govern. Nothing in this policy is intended to limit or override mandatory privacy rights provided by applicable law.

25. CHILDREN'S PRIVACY (REGIONAL VARIATIONS)

25.1. United States (COPPA)

Our services are not intended for children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

25.2. European Union (GDPR)

For EU residents, the minimum age for consent varies by country (13-16 years). We require parental consent for users below the applicable age threshold in their country.

25.3. South Korea

For users under 14 in South Korea, we obtain parental consent and provide enhanced protections as required by PIPA.

25.4. Other Regions

We comply with applicable age requirements and parental consent obligations in all jurisdictions where we operate. If we learn we have collected information from children below the applicable age without required consent, we will delete such information promptly.

26. ACKNOWLEDGMENT AND CONSENT

26.1. Agreement to Policy

By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy. However, your use of our services does not automatically constitute consent to all processing activities.

26.2. Consent Requirements

Where required by applicable law:

• We obtain explicit, affirmative consent for data collection and processing

• We provide separate consent options for different processing purposes

• We obtain specific consent for marketing communication

• We obtain enhanced consent for sensitive personal information

• We provide clear options to withdraw consent at any time

26.3. Cookie Consent

Where required by applicable law (including EU ePrivacy Directive, UK PECR), we obtain prior consent before placing non-essential cookies on your device. You can manage cookie preferences through our cookie consent banner.

26.4. Withdrawal of Consent

You may withdraw consent at any time by:

• Updating your account preferences

• Using unsubscribe links in communications

• Adjusting cookie settings in your browser

• Contacting us at [email protected]

Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

26.5. Continued Use After Updates

When we update this Privacy Policy, your continued use of our services after notification of changes indicates your acceptance of the updated terms, except where applicable law requires separate affirmative consent for material changes

27. FINAL PROVISIONS

27.1. Severability

If any provision of this Privacy Policy is found to be unenforceable or invalid under applicable law, such provision shall be modified to the minimum extent necessary to make it enforceable, or if it cannot be made enforceable, it shall be severed from this policy. The remaining provisions shall continue in full force and effect.

27.2. Language

This Privacy Policy is provided in English. Where translations are provided, the English version shall govern in case of any conflict, except where local law requires the local language version to prevail.

27.3. Entire Agreement

This Privacy Policy, together with our Terms and Conditions, constitutes the entire agreement between you and us regarding the processing of your personal information.

Authorized Representative: Illuminated Story / Illuminated Story

Date: 2026-09-16