PRIVACY POLICY

Last Updated: September 1, 2026

This Privacy Policy describes the privacy practices of Elfster, Inc. ("Elfster", "we", "us ", or "our"), and how we handle personal information that we collect through and in connection with our websites and applications, marketing initiatives, third parties and interactions with you (collectively, the "Service" or "Services "). This Policy applies to our website visitors, users of our applications, business contacts, and other individuals who interact with us. Elfster is the controller of your personal information under this Privacy Policy, which means we are responsible for your personal information.

Please see our Privacy Snapshot below for a high-level overview of our privacy practices.

Personal Information We Collect

We collect the following categories of personal information about you:

Information you provide to us:

• Contact information, such as your first and last name, email address, mailing address, the content of communications, and any other information you choose to provide. You may also provide contact information of your friends or other contacts when you invite them to join Elfster.
• Account information, such as the username and password you use to access our Services. We also collect details of your account profile and how you use your account, including your account settings, saved addresses, birthday, email preferences, linked accounts, and other information associated with your account.
• Gift exchange and Wishlist information, such as gift exchanges you create, organize, participate in, or are invited to, and information you include in wishlists you create or contribute to.
• Social interactions information, such as users you follow, messages exchanged through the Services, and other information relating to your interactions with users through the Services.
• Marketing information such as your preferences for receiving our marketing communications and details about your engagement with them.
• Events, competitions and promotions, such as your name, contact details, registration information, participation details, images, and any other information you choose to provide when you attend, participate in, or otherwise engage with events, competitions, promotions, or similar activities that we organize, host, sponsor, or support.
• Surveys and reviews, such as your name, contact information, survey responses, feedback, reviews, and related communications when you participate in surveys, provide feedback, submit reviews, or otherwise communicate your views regarding our Services.
• Suppliers, partners and their representatives, such as your name, organization, job role, contact details, and the content of communications with us when you enter into a supplier or partnership relationship with us, or if you are a representative of a supplier or partner.
• Other information not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Where you provide us with the personal information of third parties, such as your friends or other contacts, it is your responsibility to inform them about the processing of their personal information in accordance with this Privacy Policy, and to confirm that they have given their permission.

Automatic data collection. We and our service providers may automatically log and combine information about you, your computer or mobile device, and your interactions over time with the Services, online resources, and our communications, such as:

• Device data, including your computer's or mobile device's operating system type and version, manufacturer and model, browser type, screen resolution, device type (e.g., phone, tablet), IP address, unique identifiers, language settings, and general location information such as city, state, or geographic area.
• Usage data, including pages, screens and/or features you viewed, accessed and/or used, how long you spent on a page, screen and/or feature, the website you visited before browsing to the Services, navigation paths between pages or screens, information about your activity on a page, screen and/or feature, access times, duration of access, and whether you have opened or otherwise engaged with our communications, such as our marketing emails, or clicked links or files within them.

We use cookies, web beacons (e.g., pixel tags), and local and session storage technologies to collect some of this information. For more information on how we use these technologies, please visit our Cookie Policy.

Information we obtain from other sources:

• Third-party login information. When you link, connect, or log in to our Services with a third-party service (e.g., Google or Facebook), you may direct the service to send us information controlled by that service or as authorized by you via your privacy settings on that service.
• Social media. We may maintain pages on social media platforms, such as LinkedIn, Instagram, and other third-party platforms. When you visit or interact with our pages on those platforms, you or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.
• Other users. We may receive personal information about you from other users of our Services, such as when they provide your contact information to invite you to participate in a gift exchange on our Services.

How We Use Personal Information

We use personal information for the following purposes or as otherwise described at the time of collection:

To provide our Services. We use personal information to operate, maintain, and provide our Services, including ensuring you can use our websites and applications. We do this to perform our contractual obligations to you, or where it is in our legitimate business interests.

To communicate with you about our Services. We use personal information to respond to your enquiries and requests, provide customer support, and send announcements, updates, security alerts, support messages, and other administrative communications relating to our Services. We do this to perform our contractual obligations to you, or where it is in our legitimate business interests.

For surveys and reviews. We use personal information to process surveys, feedback, and reviews relating to our Services, and to help us understand satisfaction, improve our Services, and monitor service quality. We do this where it is in our legitimate business interests.

For marketing and advertising.

• Emails and Text messages. We may send you direct marketing communications by email and text message, as permitted by law, including information about our Services, special promotions, offers, events and other updates. You may be liable for standard SMS and per-minute charges by your mobile carrier. Please review the "Opt out of marketing communications" section below for information on how you can opt out of these communications and our do-not-call policy. We will only send you direct marketing communications if you consent to receiving these communications or if we are otherwise permitted to send these communications under applicable law in our legitimate business interests.
• Interest-based advertising. We engage our advertising partners, including third party advertising companies and social media companies, to display ads around the web. These companies may use cookies and similar technologies to collect information (including the automatically-collected data described above) about your interaction over time across our Services, our communications, and other online services, and use that information to serve online ads that they think will interest you. Where required by law we will undertake such advertising activities on the basis of your consent, otherwise we will do so only if it is in our legitimate business interests to undertake such activities. You can learn more about your choices for limiting interest-based advertising in our Cookie Policy.

For events, competitions and promotions. We use personal information to administer and manage events, competitions, promotions, and similar activities, including communicating with participants, facilitating participation, and managing related activities. We do this where it is in our legitimate business interests to do so. Where you participate in these activities and a photographer or videographer is in attendance, we may also use images or video footage in which you appear for marketing, advertising, promotional, and related business purposes, including publication on our websites, social media channels, and other promotional materials. We do this where it is in our legitimate business interests. If you would like us to remove an image or video featuring you, please contact us using the details set out below.

For supplier and partner relationship management. If you are a supplier, partner, or representative of one of these organizations, it is in our legitimate business interests to use your personal information to communicate with you and manage our relationship with you or your organization. Where we have entered into a contract with you or your organization, we will use your personal information as required to perform our contractual obligations.

For research, development, benchmarking, and improving our Services. We may use personal information for research and development purposes in our legitimate business interests, including to analyze and improve the Services, identify trends, and operate and expand our business activities. We may also create aggregated, anonymized, or other de-identified statistics, which we may use for lawful business purposes, including for product development, service improvement, analytics, forecasting, and strategic planning.

Improve, monitor, personalize, and protect our Services. We may use personal information to improve and keep our Services safe, where it is in our legitimate interests to do so, including: (i) understanding your needs and interests, and personalizing your experience with our Services and our communications; (ii) troubleshooting, testing and research and to keep our Services secure; (iii) investigating and protecting against fraudulent, harmful, unauthorized or illegal activity; and (iv) monitoring and improving the performance and user experience of our Services.

For compliance and protection. We may use personal information to comply with legal obligations, and to defend us against legal claims or disputes where it is in our legitimate business interests to do so, including to: (i) protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); (ii) audit our internal processes for compliance with legal and contractual requirements and internal policies; (iii) enforce the terms and conditions that govern our Services; (iv) prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft; and (v) comply with applicable laws, lawful requests and legal process, such as to respond to subpoenas or requests from government authorities.

How We Disclose Personal Information

We may disclose personal information to the following individuals or entities and as otherwise described in this Privacy Policy or at the time of collection:

Other Elfster users. Other users, such as other wishlist creators who may choose to follow you or a specific wishlist that you set as public. If your account is discoverable, other Elfster users may see basic information including your name, wishes, and birthday, if you have provided it. You may exclude your account from being discoverable via the "Privacy Settings" within your "profile settings". Similarly, you can modify the discoverability of your wishlists within "wishlist settings".

Elfster users within your Elfster family. To make wishing, shopping, and gift exchange fun and social, we offer the ability to link existing accounts or create new accounts associated under an existing account, which we call "families". The managing account is designated as the "Family Admin". If you have a linked account under a Family Admin, we share all account information to allow the Family Admin to manage the account for you.

Affiliates. Our affiliates, meaning an entity that controls, is controlled by, or is under common control with Elfster, who will use your personal information in a manner consistent with this Privacy Policy.

Service providers. Companies and individuals that provide services on our behalf or help us operate the Services or our business (such as hosting, information technology, customer support, email delivery, and analytics services).

Third-party business partners. Third-party companies from which you may purchase products directly from after being redirected from the Services.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, our business (including, in connection with a bankruptcy or similar proceedings).

Your instruction or permission. We share your personal information with other relevant third parties, where you give us permission to do so in the course of your relationship with us from time to time.

International Data Transfers

You will provide personal information directly to us in the United States. We may also transfer personal information to our affiliates and service providers in the United States. Please note that such jurisdictions may not provide the same protections as the data protection laws in your home country.

Where there are cross-border transfers of your personal information, unless we can rely on a derogation provided under applicable data protection law, we will ensure that appropriate safeguards are in place to protect your personal information and will comply with applicable data protection laws. These safeguards may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms recognized under applicable law. For more information about how we transfer personal information internationally, please contact us as set out in the “How to Contact Us” section below.

Your Privacy Rights and Choices

Access or update your information. If you have registered for an account with us, you may review and update certain personal information in your account profile by logging into the account.

Opt out of marketing communications. You may opt out of marketing-related communications – both emails and texts - by following the opt-out or unsubscribe instructions in the communications you receive from us or by contacting us as provided in the "How to Contact Us" section below. You may continue to receive Services-related and other non-marketing communications.

Personal information requests. We offer you choices that affect how we handle your personal information. Depending on your location and the nature of your interactions with our Services, you may have the following rights in relation to our processing of your personal information, subject to applicable law:

• Access to a copy of the personal information that we have collected about you and information on how we have used your personal information.
• Portability of your personal information (i.e. to provide the personal information in a portable, machine-readable, readily usable format to you or another third-party you designate).
• Correction of personal information that is inaccurate or out of date.
• Deletion of personal information that we no longer need to provide the Services or for other lawful purposes.
• Objection to us processing your personal information where we rely on our legitimate business interest to do so (see the "How We Use Personal Information" section above) or for any direct marketing purposes.
• Withdraw your consent to our processing of your personal information at any time where we rely on your consent to process that personal information. This won’t affect anything we have used your personal information for before you withdraw your consent.
• Opt out of the sharing of your personal information or use of your information for interest-based advertising. We share information with third-party advertising partners as described in the "How We Use Personal information" and "How We Disclose Personal Information" sections above. Our disclosure of information to these partners may be considered a "sale" or "sharing" of personal information or "targeted advertising" under applicable laws. You can opt out of these disclosures and limit our use of tracking technologies as described below or by clicking the "Do Not Sell or Share My Personal Information" link on the footer of our website or in our mobile applications.
• Opt out of "profiling" in connection with decisions that produce legal or similarly significant effects. By default, we do not engage in profiling in connection with decisions that produce legal or similarly significant effects.
• Appeal our denial of your personal information request by contacting us as set out in the "How to Contact Us" section below.

To make a request, please email us or write to us as provided in the "How to Contact Us" section below. We may ask for specific information from you to help us confirm your identity. You are entitled to exercise the rights described above free from discrimination.

Limits on your privacy rights and choices. In some instances, your choices may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. If you are not satisfied with how we address your request, you may submit a complaint by contacting us as provided in the "How to Contact Us" section below.

Right to complain. You have the right to lodge a complaint about the way we handle or process your personal information with a data protection regulator in the country where you live or work, or where you believe your data protection rights have been violated.

Right not to share your personal information. Where we are required by law to collect your personal information, or where we need your personal information in order to provide services to you, if you choose not to provide this information when requested (or you later ask to delete it), we may not be able to provide you with these services. We will tell you what information is necessary at the time of collection or through other appropriate means.

Limit cookies. As part of our commitment to transparency and your privacy, our Cookie Policy provides information on how you can limit or opt-out of our use of cookie technology.

Do Not Track. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

Other Sites and Services

Our Services may contain links to websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions. This Privacy Policy does not apply to such third-party sites or services.

Security

We use reasonable organizational, technical, and administrative measures designed to protect against unauthorized access, misuse, loss, disclosure, alteration, and destruction of personal information we maintain. Unfortunately, data transmission over the Internet cannot be guaranteed as completely secure. Therefore, while we strive to protect your personal information, we cannot guarantee the security of personal information.

Retention of Personal Information

We retain personal information only for as long as is necessary to fulfil the purposes described in this Privacy Policy (including to provide the Services), and where we have a legitimate business need to do so, such as where the retention is required by law or regulatory obligations (e.g. tax, legal, or accounting purposes), to enforce and prevent violations of our terms and conditions of service, or to defend against legal claims.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information, the purposes for which we use personal information and whether we can achieve those purposes through other means, any permissions you give us with regards to your personal information, and the applicable legal and regulatory requirements.

Children's Privacy

Our Services are not intended for use by children under 13 years of age. If we learn that we have collected personal information through our Services from a child under 13 without the consent of the child's parent or guardian as required by law, we will delete it.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Where we do so, we will update the date of this Privacy Policy and post it on the Services. If we make material changes to this Privacy Policy, we will let you know by updating the date of this Privacy Policy and posting the revised version on our website, or as otherwise required by applicable law. We may also provide notice of changes in another manner that we believe is reasonably likely to reach you, such as by email (where we have your contact information). The "Last Updated" date at the top of this Privacy Policy indicates when it was last revised.

How to Contact Us

Contact us. If you have any questions or comments about this Privacy Policy, our privacy practices, or if you would like to exercise your rights with respect to your personal information, please email us at help@elfster.com or write to us at: Elfster, Inc., 2930 Domingo Ave #531, Berkeley, CA 94705

EU and UK Representatives. We have appointed European Data Protection Office (EDPO) as our GDPR Representative in the EU, and EDPO UK Ltd as our representative in the UK for data protection matters. If you are located in the EU, EEA or UK, you can contact our EU and UK representatives using the contact details below:

By request form:

• EU Representative: https://edpo.com/gdpr-data-request/
• UK Representative: https://edpo.com/uk-gdpr-data-request/

By post:

• EU Representative: EDPO, Avenue Huart Hamoir 71, 1030 Brussels, Belgium
• UK Representative: EDPO UK Ltd, Unit 33, Waterside, Schooner Court, 44-48 Wharf Road, London, N1 7UX, United Kingdom

Privacy Snapshot

Below is a high-level snapshot of how we collect, use, and disclose your personal information when you use the Service, but you need to read the entire Privacy Policy for complete information.

*As described further in our Privacy Policy, we may disclose all categories of personal information with our service providers, affiliates, and professional advisors for the purposes described in the Privacy Policy. We also may disclose personal information with authorities and others for legal and compliance purposes, and with business transferees in the context of an acquisition or the sale of our business or another corporate transaction.