PRIVACY POLICY

1. INFORMATION WE COLLECT

The information we collect depends on how you use VAULT, the features available to you and the permissions you provide.

We may collect the following categories of information.

Account and Profile Information

When you apply for or maintain a VAULT account, we may collect information such as:

• your name;
• date of birth;
• age or age category;
• city;
• gender, where you choose or are asked to provide it;
• discovery interests;
• social media usernames, where provided;
• account credentials or authentication information;
• membership, waitlist or approval status;
• invite and referral information; and
• other profile information you choose to provide.

We use age information in part to determine which account features, content permissions and protections apply to you.

Location Information

VAULT uses location to support location-based experiences.

Depending on the feature you use and the permissions you grant through your device, we may collect or process approximate or precise location information when necessary to:

• show relevant experiences in or near your city;
• determine proximity to a VAULT location or checkpoint;
• validate a check-in;
• confirm eligibility to complete a location-based step;
• prevent fraudulent or inaccurate check-ins; or
• operate other location-dependent features you choose to use.

VAULT does not use location permission to imply continuous monitoring of your movements.

Location access depends on the functionality being used and your device settings. You can manage location permissions through your device settings, although disabling location may prevent certain VAULT features from working.

Where practical, VAULT may retain the result of a location-based interaction—such as a successful checkpoint or check-in—rather than continuously retaining a detailed history of your precise movements.

Photos and Participant Content

When you participate in a VAULT experience, you may capture or submit photographs or other content (“Participant Content”).

We may collect and store:

• the content itself;
• information connecting the content to a particular VAULT or checkpoint;
• the date and time associated with the content;
• technical information associated with the upload or capture;
• the content permission applicable to the asset; and
• records relating to access or rights associated with the asset.

Participant Content is handled according to the permissions applicable to you and the content.

For more information, see the VAULT Content & Media Rights terms.

Participation and Checkpoint Information

When you interact with a VAULT experience, we may collect information such as:

• experiences viewed, joined or completed;
• checkpoints visited or completed;
• check-in status;
• QR code or verification activity;
• participation progress;
• completion status;
• timestamps associated with participation;
• reward eligibility; and
• other information required to operate the experience.

Rewards and Redemption Information

If you unlock or redeem a reward, we may collect information necessary to administer that reward, including:

• reward assignment;
• reward type;
• redemption status;
• redemption time;
• applicable redemption code or verification;
• inventory or availability information; and
• other information necessary to verify or complete redemption.

Participating Brands or venue personnel may receive limited information where necessary to verify or fulfill a reward.

Device and Technical Information

When you use VAULT, we may automatically collect certain technical information, including:

• device type;
• operating system;
• app version;
• device or app identifiers;
• IP address;
• crash and diagnostic information;
• security events;
• authentication activity; and
• information about how the app or website functions on your device.

We use this information to operate, secure, troubleshoot and improve VAULT.

App and Website Activity

We may collect information about how you interact with VAULT, such as:

• screens or features used;
• experiences viewed;
• notifications interacted with;
• navigation and engagement information;
• campaign interactions;
• feature usage; and
• related analytics information.

Communications and Support

If you contact VAULT, we may collect your contact information, the content of your communication and information reasonably necessary to respond to your request.

Consent, Permission and Legal Records

VAULT may maintain records concerning:

• acceptance of Terms of Use and other legal documents;
• the version of the legal terms accepted;
• Participant Content permissions;
• changes to content permissions;
• asset-level permission status;
• privacy requests;
• safety acknowledgements;
• age-related protections or consents where applicable; and
• other records reasonably necessary to demonstrate permissions, compliance or legal acceptance.

These records may be maintained even where your current settings later change because they document permissions and legal states that existed at a particular time.

2. HOW WE USE INFORMATION

We may use personal information to:

• create and manage your VAULT account;
• process membership or waitlist applications;
• administer invitations and access;
• provide and personalize the VAULT experience;
• show relevant experiences;
• enable location-based features;
• verify checkpoints and participation;
• store and develop your VAULT photos;
• administer Participant Content permissions;
• unlock, assign and administer rewards;
• process redemptions;
• send service and campaign notifications;
• provide customer support;
• prevent fraud, abuse and unauthorized activity;
• maintain platform safety and security;
• troubleshoot technical problems;
• understand how VAULT is used;
• measure campaign performance;
• improve and develop VAULT;
• maintain legal, permission and audit records;
• enforce our terms and policies;
• comply with legal obligations; and
• protect the rights, safety and security of users, Brands, VAULT and others.

We may also use information for other purposes that we explain when the information is collected or for which you provide permission.

3. PARTICIPANT CONTENT PERMISSIONS

VAULT does not automatically give participating Brands commercial rights to every photo captured through the platform.

Participant Content is governed by the permission applicable to that content.

For eligible adult users, the available permission structures may include:

Private to VAULT

Your content remains within VAULT and is not made available to participating Brands through the Brand Portal.

Share With Brand

Your content may be made Brand Viewable, allowing the applicable Brand to view it within the authorized VAULT Brand Portal.

Brand Viewable content cannot be downloaded or externally or commercially published by the Brand under this permission.

Share + Brand Usage

Your content may be designated Usage Cleared, allowing the applicable Brand to download and use the content subject to the licence, duration, permitted uses and restrictions described in the VAULT Content & Media Rights terms.

Your selected permission does not transfer ownership of your Participant Content to VAULT or the Brand.

For complete information about these permissions, see VAULT Content & Media Rights.

4. USERS AGED 14 TO 17

VAULT is intended for users aged 14 and older.

Users under 14 may not create or maintain a standard VAULT account.

VAULT applies additional protections to users aged 14 to 17.

Under VAULT's current permission structure:

• Participant Content from users aged 14 to 17 is Private to VAULT;
• that Participant Content is not made available to participating Brands through the Brand Portal;
• it cannot be designated Brand Viewable or Usage Cleared through the standard content permission system; and
• Brands do not receive commercial usage rights to that Participant Content through standard VAULT functionality.

Age information may therefore affect which permissions and features are available to an account.

VAULT does not knowingly permit a user under 14 to maintain a standard account. If we learn that an account belongs to a user under 14, we may suspend or remove the account and take appropriate steps regarding associated personal information.

A parent or guardian who believes that a child under 14 has provided personal information to VAULT may contact us using the information at the end of this Privacy Policy.

5. HOW WE SHARE INFORMATION

We do not make all information collected through VAULT available to Brands.

We may disclose information in the circumstances described below.

Participating Brands

We may provide participating Brands with information necessary to operate, fulfill or measure their VAULT campaigns.

The information available to a Brand depends on the applicable campaign, feature and participant permissions.

Brands do not receive unrestricted access to VAULT member information.

Private-to-VAULT Participant Content is not made available to participating Brands.

Brand access to Participant Content is governed by the applicable content permission and rights status.

Reward and Experience Fulfillment

We may provide limited information to a Brand, venue or other party where reasonably necessary to verify participation, administer an experience, prevent fraud or fulfill a reward.

Such information is provided for the applicable operational purpose and does not automatically authorize unrelated marketing.

Service Providers

We use service providers to help operate VAULT.

These providers may support functions such as:

• cloud hosting;
• data storage;
• authentication;
• app infrastructure;
• analytics;
• communications and notifications;
• security;
• technical support; and
• other services necessary to operate the platform.

Service providers may process information on our behalf only as permitted by applicable agreements and law.

Legal and Safety Reasons

We may disclose information where reasonably necessary to:

• comply with applicable law, regulation, legal process or a binding governmental request;
• investigate fraud or unlawful activity;
• enforce our agreements;
• protect the safety or security of users, VAULT, Brands or others;
• investigate or respond to security incidents; or
• establish, exercise or defend legal claims.

Corporate Transactions

If VAULT WORLD INC. is involved in a merger, financing, acquisition, reorganization, sale of assets or similar corporate transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable law and appropriate confidentiality protections.

6. WHAT BRANDS DO NOT AUTOMATICALLY RECEIVE

Participation in a VAULT campaign does not automatically give a Brand access to:

• your private Participant Content;
• your entire VAULT profile;
• your precise location history;
• your personal contact information;
• your private VAULT activity;
• content from users aged 14 to 17;
• permission to add you to marketing lists;
• permission to independently track your movements;
• permission to create unrelated advertising profiles about you; or
• commercial usage rights to content that has not been designated Usage Cleared.

Brand access is limited by the applicable VAULT functionality, participant permissions and contractual restrictions.

7. AGGREGATED AND DE-IDENTIFIED CAMPAIGN ANALYTICS

VAULT may provide participating Brands with aggregated or de-identified information about campaign performance.

This may include metrics such as:

• number of participants;
• checkpoint completions;
• campaign completions;
• reward or redemption activity;
• engagement;
• Moments Captured;
• Brand Viewable content counts; and
• Usage Cleared content counts.

Moments Captured is an aggregate participation metric. It does not mean that the Brand can see, download or use every photo contributing to that number.

Private Participant Content may contribute to appropriately aggregated or de-identified campaign metrics without the underlying private asset being disclosed to the Brand.

We require Brands not to attempt to re-identify individuals from aggregated or de-identified information.

8. LOCATION PRIVACY

Location is an important part of certain VAULT experiences, but location-based participation does not mean that VAULT continuously tracks your movements.

Depending on the applicable feature, VAULT may use location while you are actively interacting with the app to determine whether you are sufficiently close to a campaign location or checkpoint.

VAULT may retain information confirming that a checkpoint or location requirement was successfully completed.

We may also use approximate location or your selected city to help surface relevant experiences.

You can control device-level location access through your device settings. Certain location-dependent features may not function if location access is disabled.

9. NOTIFICATIONS

If you allow notifications, VAULT may send notifications relating to:

• account or membership status;
• experiences becoming available;
• experiences you asked to be reminded about;
• campaign timing or availability;
• approaching campaign closures;
• rewards;
• account activity;
• security;
• service updates; and
• other VAULT functionality.

You can manage push-notification permissions through your device settings.

Certain essential account or service communications may still be provided through other available channels where necessary.

10. PERMISSION CHANGES

Eligible adult users may be able to change their current Participant Content permission through VAULT.

A change to your permission generally applies prospectively.

If content has not yet been licensed or downloaded by a Brand, changing to a more restrictive permission may prevent future Brand access or licensing.

If a Brand already obtained a valid Usage Cleared licence while the applicable permission was in effect, that previously granted licence may continue for its remaining term to the extent permitted by applicable law.

Changing your permission does not erase the historical fact that a particular permission was previously granted.

VAULT may therefore retain records showing:

• the permission previously selected;
• when the permission was selected or changed;
• the applicable version of the legal terms; and
• the permission associated with an asset at the relevant time.

Where applicable law gives you additional withdrawal, deletion or objection rights, those rights are not limited by this section.

11. HOW LONG WE KEEP INFORMATION

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to operate VAULT, maintain your account, provide experiences, administer Participant Content and rewards, meet legal and regulatory obligations, resolve disputes, maintain security and enforce agreements.

Different categories of information may be retained for different periods.

For example, legal acceptance, permission, security and audit records may need to be retained after other account information has been deleted where reasonably necessary to demonstrate permissions, investigate activity, comply with law or establish or defend legal rights.

When personal information is no longer reasonably required, we will delete, destroy or de-identify it in accordance with applicable law and our retention practices.

12. INTERNATIONAL AND CROSS-BORDER PROCESSING

VAULT is based in Canada, but our service providers, participating Brands or technology infrastructure may operate in other provinces, countries or jurisdictions.

As a result, personal information may be processed or stored outside your province or country.

When information is processed in another jurisdiction, it may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement agencies or governmental authorities where legally permitted.

VAULT uses contractual, organizational and other safeguards appropriate to the nature of the information and applicable legal requirements when working with service providers and other recipients.

13. SECURITY

VAULT uses reasonable administrative, technical and organizational safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration or loss.

These measures may include access controls, authentication, platform permissions, security monitoring and restrictions on Brand and service-provider access.

No online service, application or method of electronic storage can guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and should notify VAULT if you believe your account has been compromised.

14. YOUR PRIVACY RIGHTS AND CHOICES

Depending on where you live and applicable law, you may have rights concerning your personal information.

These may include rights to:

• request access to personal information we hold about you;
• request correction of inaccurate information;
• request deletion of certain information;
• withdraw consent where processing is based on consent, subject to legal limitations;
• object to or restrict certain processing where applicable;
• ask questions about how your information is handled;
• make a complaint regarding our privacy practices; and
• request information about our use or disclosure of your personal information where required by law.

You may also have in-app controls for certain permissions and account settings.

Some requests may be subject to identity verification and legal exceptions.

For example, we may need to retain certain information where required for legal, security, fraud-prevention, rights-management or recordkeeping purposes.

15. ACCOUNT DELETION

You may request deletion of your VAULT account through available account functionality or by contacting VAULT.

Account deletion does not necessarily require immediate deletion of every record associated with the account.

We may retain limited information where reasonably necessary to:

• comply with law;
• maintain records of legal acceptance or Participant Content permissions;
• establish, exercise or defend legal rights;
• prevent fraud or abuse;
• investigate security incidents;
• honour previously granted content rights; or
• complete other legitimate retention obligations permitted by applicable law.

Information retained for these purposes will remain subject to appropriate protections and will not be used for unrelated purposes.

16. THIRD-PARTY LINKS AND EXPERIENCES

VAULT experiences may involve or link to participating Brands, venues, websites, services or other third parties.

If you independently provide information directly to a Brand or another third party outside VAULT, that party's own privacy practices may apply.

This Privacy Policy governs VAULT WORLD INC.'s handling of personal information and does not govern independent data collection performed by third parties outside the VAULT platform.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy as VAULT evolves, our practices change or legal requirements develop.

When we update the policy, we will update the effective date.

If a change materially affects how we collect, use or disclose personal information, we will provide additional notice or obtain consent where required by applicable law.

Historical legal acceptance records may identify the version of the applicable terms or policies presented at the relevant time.

18. CONTACT VAULT ABOUT PRIVACY

Questions, requests or concerns regarding this Privacy Policy or VAULT's privacy practices may be directed to:

Privacy Officer

VAULT WORLD INC.

Toronto, Ontario, Canada

Email: enter@thisisvault.world

If you submit a privacy request, we may need to verify your identity before providing access to, correcting or deleting certain information.