PRIVACY POLICY

MY EVO DIGITAL BUSINESS CARDS L.L.C.

www.myevocard.com

Effective Date: 1 September 2026 Last Updated: 1 September 2026

1. Introduction

MY EVO DIGITAL BUSINESS CARDS L.L.C., a Michigan limited liability company ("EVO," "we," "us," or "our"), operates www.myevocard.com and app.myevocard.com (together, the "Site") and provides NFC-enabled products and hosted digital business card profiles (together, the "Services").

This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It applies to information we collect through the Site, your account, your orders, and your use of the Services. It does not apply to third-party websites or services that we do not control, including the sites linked from a user's digital profile.

By using the Site or the Services, you agree to this Policy.

2. Information We Collect

We collect information you give us, information generated when you use the Services, and a limited amount of information from our service providers.

Information you give us:

• Account Information. Your name, email address, and password when you create an account.

• Profile Content. The information you choose to publish on your digital profile, which may include your name, job title, company, photograph, phone number, email address, social media links, and any other content you add. You decide what this contains.

• Order and Shipping Information. Your billing name, shipping address, and order details when you buy a product or a subscription.

• Communications. The content of messages you send us when you contact support or otherwise communicate with us.

Information generated when the Services are used:

• Device and Browser Information. The user-agent string sent by your browser, which identifies your browser type and general device type, and the pages and links you interact with on the Site.

• IP Address, for Security Only. When you submit a form or load a public page, your IP address is used to enforce rate limits and to verify that you are not an automated bot. Section 3 explains exactly how, and how briefly, it is held.

• Profile Interaction Data. When someone views your digital profile, we record counts of the interaction so that we can provide analytics to you. This includes the number of views or scans and the method used, such as a QR code scan, an NFC tap, or a wallet pass, the number of taps on each link by link type, and the number of times your contact details were downloaded.

• Cookies and Similar Technologies. As described in Section 9.

Information from our service providers:

• Payment Information. Payments are processed by Stripe, Inc. We do not receive or store your full payment card number. Stripe provides us with limited information such as the last four digits of your card, the card type, and confirmation that a transaction succeeded or failed.

3. How We Use IP Addresses, and What We Do Not Collect

Your IP address is used for security and abuse prevention, and for nothing else. We do not use it to determine your location, to build a profile of you, or for advertising. It is used in two places:

• Rate limiting. Public pages and forms, including signup, login, lead capture, and card views, count recent requests against the visitor's IP address so that we can block automated abuse. Each entry expires after approximately 60 seconds and is not retained after that.

• Bot verification. On signup, login, registration, and lead form submission, the visitor's IP address is sent to Cloudflare's CAPTCHA verification service to confirm that the visitor is a person rather than a bot. Cloudflare handles that information under its own privacy practices.

We do not store IP addresses in your account record, we do not attach them to your profile or to analytics we show account holders, and we do not keep a log of the addresses that have viewed a digital profile.

So that you can rely on this Policy as an accurate description of our practices, we also confirm the following:

• We do not collect location data of any kind, including approximate or city-level location, and we do not derive location from an IP address.

• We do not use any third-party analytics or advertising software development kit in the Services.

• We do not collect biometric information, precise geolocation, or the categories of sensitive personal information defined under state privacy laws.

If we change any of these practices, we will update this Policy and, where the change is material, notify account holders in accordance with Section 17 before it takes effect.

4. How We Use Information

We use the information we collect to:

• provide, operate, and maintain the Services, including hosting your digital profile and fulfilling product orders;

• process payments, subscriptions, and renewals through Stripe;

• ship physical products and provide order and delivery updates;

• provide customer support and respond to your requests;

• provide profile analytics and usage insights to account holders;

• send transactional messages such as order confirmations, renewal reminders, price change notices, and service announcements;

• send marketing messages where permitted, which you may opt out of at any time;

• secure, monitor, debug, and improve the Site and the Services, and prevent fraud and abuse; and

• comply with our legal obligations and enforce our Terms of Service.

We do not use your personal information to train artificial intelligence or machine learning models, and we do not make automated decisions about you that produce legal or similarly significant effects.

5. Your Digital Profile Is Public by Design

The purpose of a digital business card is to share your professional information with the people you choose to share it with. When you publish a digital profile, its content is accessible to anyone who taps your product, scans your QR code, or visits your profile link. Profile links are not password protected. They may be forwarded, shared, and indexed by search engines.

You decide what to include on your profile, and you can edit or remove that content at any time through your account. Do not publish information you are not willing to make public.

6. Contact Information Captured by Account Holders

Some subscription plans include a lead capture feature that allows an account holder to record the contact details of people who interact with their digital profile ("Lead Data").

The lead capture form is designed and provided by EVO and is the same for every account holder. Account holders cannot add, remove, or alter the fields on the form, and cannot use it to collect information beyond what the form requests. When the form is presented to you, it identifies the account holder who will receive the information you provide.

Once Lead Data has been collected, the account holder decides what to do with it, and the account holder is responsible for that use, including for complying with the laws that govern marketing calls, text messages, and email. EVO stores and processes Lead Data on the account holder's behalf and only as needed to provide the Services. We do not use Lead Data for our own marketing purposes and we do not sell it.

If your contact details were captured through someone's digital profile and you wish to access, correct, or delete them, you may contact that account holder directly, since they control what is done with the information. You may also contact us at contact-us@myevocard.com, and we will act on your request in respect of the copy we hold and will pass the request on to the account holder.

Where an organization holds the account, the organization, and not the individual seat holder, is the party responsible for Lead Data collected through its seats.

7. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We disclose information only as follows:

• Service Providers. We share information with vendors who process it on our behalf and only on our instructions. Our current service providers are Stripe, Inc. for payment processing; Supabase, Inc., hosted on Amazon Web Services, for database services and authentication; Vercel Inc. for website hosting and infrastructure; Resend for transactional email delivery; Cloudflare, Inc. for CAPTCHA and bot verification, which receives the visitor IP address described in Section 3; and Upstash, Inc. for the rate limiting described in Section 3, which briefly holds the same IP address and no other personal information. We will update this Policy if we add a provider that processes personal information in a materially different way.

• Shipping and Fulfillment. We share the name and address you provide with the carrier and any manufacturing partner needed to produce and deliver your order.

• Profile Visitors. As described in Section 5, the content you publish on your digital profile is available to anyone who accesses it.

• Organization Administrators. Where your seat is provided by an organization, that organization's administrators can access the account information, profile content, lead data, and analytics associated with your seat.

• Legal Requirements. We may disclose information where required by law, subpoena, court order, or other legal process, or where we reasonably believe disclosure is necessary to protect our legal rights, to investigate fraud or a breach of our Terms of Service, or to protect the safety of any person.

• Business Transfers. If EVO is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will notify you of any resulting change in the ownership or use of your personal information.

• With Your Consent. We may share information for other purposes with your consent or at your direction.

8. Data Retention

We keep your information for as long as your account remains open and we need it to provide the Services. We do not operate an automated deletion schedule, and we do not delete or de-identify account data on a timer. Deletion takes place when it is requested and processed, as described below.

Deletion by an organization administrator. An authorized administrator can delete a profile, a card, or the records associated with a seat directly from the dashboard. That deletion takes effect immediately.

Deletion of an entire account. Deletion of a whole account or organization is carried out by us on request. An authorized administrator should contact us at contact-us@myevocard.com, and we will delete the associated data promptly once we have processed and verified the request.

What deletion does. Deletion is permanent and cannot be undone. It is a hard delete rather than a gradual process, and it cascades through the records associated with the account, including the profile, contact and lead records, scan and analytics history, cards, and related organizational data. We do not retain a de-identified copy of deleted data.

The IP address data described in Section 3 is not part of this process, because it is not retained. Rate limiting entries expire after approximately 60 seconds, and information sent to our bot verification provider is held by that provider under its own retention practices.

Some records fall outside this process. We keep order, payment, and transaction records for the period required by applicable tax, accounting, and commercial law, and our payment processor keeps its own transaction records independently of us. We may also retain information where necessary to resolve a dispute, enforce our agreements, or comply with a legal obligation or a legal hold. Copies may remain in routine backups until those backups are overwritten in the ordinary course, and are not accessed in the meantime.

9. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, operate the shopping cart and checkout, and understand in aggregate how the Site is used. The cookies we set are strictly necessary or functional. We do not set advertising cookies, and we do not use a third-party analytics or advertising tool on the Site.

Stripe sets cookies during checkout for payment processing and fraud prevention, in accordance with its own privacy policy.

Most browsers allow you to block or delete cookies through their settings. Disabling cookies may prevent parts of the Site from working, including staying signed in and completing checkout. We do not currently respond to browser Do Not Track signals, because no common standard for them has been adopted. Opt-out preference signals, including Global Privacy Control, communicate a request not to sell or share personal information or to use it for targeted advertising. We do not do any of those things, as stated in Sections 7 and 16, so there is nothing for such a signal to opt you out of. If we ever begin selling or sharing personal information or using it for targeted advertising, we will update this Policy and will honor opt-out preference signals as required by applicable state law before doing so.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit over HTTPS, access controls and authentication, and reliance on payment processing by a PCI DSS Level 1 certified processor. Our database and hosting providers maintain their own independently assessed security programs.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account password confidential and for notifying us promptly at contact-us@myevocard.com if you believe your account has been accessed without your authorization.

11. Your Choices

Access and Update. You can access and update your account information and the content of a profile you control at any time by signing in to your account.

Deletion. Where you are an authorized administrator of an account, you can delete a profile, a card, or the records associated with a seat directly from the dashboard, and that deletion is immediate and permanent. If you are an individual team member using a seat provided by an organization, you do not have a deletion function of your own; ask your administrator to delete the profile, or contact us at contact-us@myevocard.com and we will pass the request to the administrator and act on it as described in Section 6. Deletion of an entire account or organization is handled by us on request to contact-us@myevocard.com.

Marketing. You can opt out of marketing email by using the unsubscribe link in any marketing message or by contacting us. You will continue to receive transactional messages relating to your account, your orders, and your subscription.

Cookies. You can manage cookies through your browser settings as described in Section 9.

12. State Privacy Rights

Depending on the state in which you live, you may have some or all of the following rights in relation to your personal information: the right to know what personal information we have collected and how we use and disclose it; the right to access a copy of that information in a portable format; the right to correct inaccurate information; the right to delete your information; the right to opt out of the sale or sharing of your information and of targeted advertising and certain profiling; and the right not to be discriminated against for exercising any of these rights.

As stated in Section 7, we do not sell personal information and we do not share it for targeted advertising, so there is nothing for you to opt out of in those categories.

How to exercise your rights. Contact us at contact-us@myevocard.com with the email address associated with your account and a description of the right you wish to exercise. We will verify your request by matching the information you provide against our records, and may ask for additional information where we cannot verify you from the account itself. We will respond within the period required by the law that applies to you, which is generally 45 days, and we may extend that period once where permitted, in which case we will tell you.

Authorized agents. You may use an authorized agent to submit a request on your behalf where your state's law allows. We may ask the agent for proof of authority and may ask you to confirm the authorization directly.

Appeals. If we decline your request and the law of your state provides a right of appeal, you may appeal by replying to our decision with the word "Appeal" and your reasons. We will respond to the appeal within the period required by that law and, if we again decline, will tell you how to complain to your state attorney general.

Financial incentives. We do not offer financial incentives in exchange for personal information.

Because we do not collect precise geolocation, biometric information, or the other categories treated as sensitive under state privacy laws, we do not process sensitive personal information and do not require your consent to do so.

13. Children's Privacy

The Services are intended for people aged 18 and over and are not directed to children. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, contact us at contact-us@myevocard.com.

14. Where We Operate

EVO is based in the United States, and the information we collect is processed and stored in the United States. The Services are intended for customers in the United States.

If you access the Services or view a digital profile from outside the United States, you do so on your own initiative and you understand that your information will be transferred to and processed in the United States, where data protection law may differ from the law of your own country. We do not currently market the Services to individuals in the European Economic Area or the United Kingdom, and this Policy does not describe rights under the General Data Protection Regulation. If we begin to offer the Services in those markets, we will update this Policy before doing so.

15. Third-Party Links and Services

The Site and user digital profiles may contain links to third-party websites and services, including social media platforms. We do not control those services and are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party service you visit.

16. Do Not Sell or Share

We do not sell personal information, we have not sold personal information in the preceding twelve months, and we do not share personal information for cross-context behavioral advertising or targeted advertising. We do not sell or share the personal information of anyone we know to be under 16.

17. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will post the updated Policy on the Site, update the "Last Updated" date above, and, where the change materially affects your rights or expands how we use information we have already collected, notify account holders by email before the change takes effect. Your continued use of the Services after the change takes effect constitutes acceptance of the revised Policy.

18. Contact Us

If you have questions about this Privacy Policy or about how we handle your information, contact us at:

MY EVO DIGITAL BUSINESS CARDS L.L.C.

3400 Cooley Lake Rd, Milford, Mi 48381

Email: contact-us@myevocard.com

Website: www.myevocard.com