California Privacy Addendum

This California Privacy Addendum ("Addendum") supplements the ORYN QUEST — PRIVACY POLICY and applies to California residents ("you") under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (together, the "CCPA"). ORYN Quest, Inc. ("ORYN Quest," "we," "our," or "us") operates first in the Los Angeles area, and we intend this Addendum to describe our practices accurately and without exaggeration. If this Addendum conflicts with the ORYN QUEST — PRIVACY POLICY as to California residents' rights, this Addendum controls.

ARTICLE 1 — NOTICE AT COLLECTION: CATEGORIES WE COLLECT

The categories below use the CCPA's statutory categories, mapped to the actual data described in the ORYN QUEST — PRIVACY POLICY. We collect each category from you directly, from your use of the Platform, or from service providers acting for us. We do not purchase personal information from data brokers.

1.1 Identifiers

Name, email address, phone number (if provided), postal address (if you choose to enter one), account identifiers, push notification subscription identifiers (if you enable push notifications), and IP address; and, if you use the website's optional find-friends-by-contacts feature, one-way hashes of your contacts' email addresses and phone numbers, computed in your browser, used only to answer that request and not stored (ORYN QUEST — PRIVACY POLICY, Section 2.11). Purpose: account creation and authentication, service operation, security, communications, and — for the contact hashes — finding people you already know.

1.2 Personal Information Categories in Cal. Civ. Code Section 1798.80(e); Protected-Classification Characteristics

Contact information; a Child's gender if the Parent chooses to record it (a characteristic of protected classifications), used only to personalize the Child's avatar and as one signal for activity recommendations; and, where a Parent optionally provides it for insurance-based activities, insurance details (provider, policy number, group code). Purpose: service operation; avatar personalization and recommendations; insurance verification the Parent initiates.

1.3 Commercial Information

Membership and subscription records, Credit balances and transactions, Bookings, purchases, refunds, referral rewards, and Vendor payout records. Purpose: providing the marketplace, payments and payouts, refunds, tax compliance.

1.4 Internet or Other Electronic Network Activity Information

Technical log information (device type, browser type, IP address) and in-app activity events — such as searches, listing views, filters, favorites, bookings, and recommendation interactions — used to compute the interest profile associated with your account. We do not track you across other businesses' sites or apps, and no advertising technology is installed on the Platform. If you choose "Accept All" on the cookie banner, Google Analytics measures website usage as our service provider, with Google Signals and every advertising feature switched off; we do not "sell" or "share" personal information as those terms are defined in the CCPA, and a Global Privacy Control signal is honored by not loading analytics at all. You may opt out of activity-event collection entirely in account settings. Purpose: operating and securing the Platform; personalization with opt-out.

1.5 Geolocation Data

You may search by typing or selecting a city, neighborhood, or map area without sharing any device location. If you instead grant your device's location permission, the coordinates your device reports are rounded to three decimal places — a neighborhood-level area of roughly one hundred ten (110) meters — before they are stored and before they are transmitted to any service, including the OpenStreetMap Foundation's Nominatim reverse-geocoding service, which returns a nearby city, state, and ZIP code. We never retain your device's exact (unrounded) coordinates, we do not derive or save a street address from device location, and we do not collect location in the background. Because the CCPA defines precise geolocation as data that locates you within a circle with a radius of 1,850 feet (about 565 meters), and the rounded coordinates locate you more closely than that, we treat them as precise geolocation and therefore as sensitive personal information (Section 1.9(d)); the Apple App Store and Google Play classify location at this resolution as precise location as well. Separately, if you use an address search box, the text you type — which may include a street address — is sent to the Nominatim service as you type so matching addresses can be suggested, as described in the ORYN QUEST — PRIVACY POLICY, Section 9.2. Purpose: showing activities near you.

1.6 Audio Information

Voice audio you choose to submit when using the AI assistant's voice features, streamed from your device directly to our AI provider and processed in real time to respond to you; ORYN Quest does not receive, record or store the audio and keeps only the text transcript in your conversation history (ORYN QUEST — PRIVACY POLICY, Section 5.2). Purpose: providing the voice assistant.

1.7 Professional or Employment-Related Information (Vendors)

Vendor business information, self-reported credentials and insurance types, and payout and tax-reporting details. Purpose: operating the Vendor marketplace.

1.8 Inferences

Interest profiles associated with your parent account (for example, top activity categories, recent searches, and activities viewed but not booked); recommendation embeddings derived from Child profile information; and family-facing developmental insights — weekly per-Child skill scores across eight developmental domains with trends over time, and behavioral signals such as a preferred activity category and typical session frequency — computed from Vendor session feedback and the Child's activity history. Developmental insights are visible to the Parent on the Progress page and are used by the family's AI assistant; they are not shown to other users. All of the above are subject to the personalization opt-out, which stops these computations and deletes stored developmental insight scores and behavioral signals. Purpose: recommendations and family-facing progress insights within the Platform only.

1.9 Sensitive Personal Information

We collect the following sensitive personal information, in each case only after a deliberate choice by the account holder:

• (a) information a Parent records in a Child profile concerning a Child's accessibility, support, or health-adjacent needs (such as neurodivergence indicators, sensory support needs, vision or hearing impairment indicators, wheelchair accessibility needs) and behavior notes;

• (b) insurance identifiers (policy number and group code) a Parent optionally provides for insurance-based activities;

• (c) account log-in credentials, processed by our identity provider to authenticate you; and

• (d) if — and only if — you grant your device's location permission, device coordinates rounded to three decimal places — a neighborhood-level area of roughly one hundred ten (110) meters — before storage or any transmission (Section 1.5). Location at that resolution is precise geolocation under the CCPA's 1,850-foot definition, so we treat it as sensitive personal information; we never retain your exact (unrounded) coordinates.

Purpose: matching and accommodations, insurance verification the Parent initiates, account security, and showing activities near you when you request that — and nothing else. See Article 3.

1.10 Categories We Do Not Collect

We do not collect biometric information, racial or ethnic origin, religious beliefs, citizenship or immigration status, genetic data, or the contents of mail, email, or text messages where we are not the intended recipient. We do not retain your device's exact coordinates: if you grant location permission, coordinates are rounded to a neighborhood-level area of roughly one hundred ten (110) meters before they are stored or transmitted anywhere (Sections 1.5 and 1.9(d)), and we do not collect location in the background. We do not maintain medical records.

1.11 De-identified Information

Where we maintain information that has been de-identified or aggregated, we maintain it without attempting to re-identify it, and we require the same of service providers, except as permitted by the CCPA to test de-identification.

1.12 Children's Information

Children never have accounts on the Platform, and we do not knowingly collect personal information online directly from children under thirteen (13). Information about a child that we hold is provided by the child's account-holding Parent or Guardian, supplemented only by the Vendor session feedback about booked sessions noted in Section 2.1, all as described in the ORYN QUEST — CHILDREN'S PRIVACY POLICY.

ARTICLE 2 — SOURCES, PURPOSES, AND DISCLOSURES

2.1 Sources

We collect personal information from: you (including information you provide about your Child); your use of the Platform; Vendors you book with (session feedback about your Child after a booked session, described in the ORYN QUEST — PRIVACY POLICY, Article 3); and service providers that operate the Platform for us (for example, our identity provider and payment processor).

2.2 Business Purposes

We use personal information for the business purposes described in the ORYN QUEST — PRIVACY POLICY: operating the marketplace and bookings; payments and payouts; AI features and personalization (with opt-out); communications; safety, moderation, and fraud prevention; debugging and security; and legal compliance.

2.3 Disclosures for a Business Purpose

We disclose the categories above to: service providers and contractors (database and hosting, identity, payments, email, error monitoring, AI model processing, place data and reverse geocoding, push-notification delivery through Expo Application Services relaying to Apple and Google, and the map's tile, library and font hosts — the OpenStreetMap Foundation, unpkg and Google Fonts — each identified in the ORYN QUEST — PRIVACY POLICY, Section 9.2); Vendors, limited to what is needed to deliver an activity you booked; and authorities where required by law or to protect safety.

2.4 Retention

Retention criteria and the specific automated retention windows that exist today are described in the ORYN QUEST — DATA RETENTION POLICY. We retain each category for as long as needed for the purposes above, subject to deletion on request and legal carve-outs.

2.5 Notice of Financial Incentive

The Platform offers three programs that grant Credits or benefits to account holders. Each is available only to a person who has created an account, which involves providing the identifiers in Section 1.1, so the CCPA may treat them as financial incentives. This section is our notice of their material terms.

• (a) Welcome Credits. Every new Parent account receives 10 Credits when it is created (ORYN QUEST — REFUND & CANCELLATION POLICY, Section 12.8).

• (b) Referral program. A person who redeems a friend's referral code receives 2 Credits at that moment; the referring Parent receives 3 Credits, once per referred person, when that person makes their first Booking or purchases a Membership — never for the sign-up alone (Refund & Cancellation Policy, Sections 12.6 and 12.8).

• (c) Loyalty program. Points are earned on Bookings (10 points per Credit charged, plus a one-time 50-point bonus on the first Booking), on reviews (25 points) and on qualifying referrals (20 points). Reaching 100, 300 and 600 points unlocks the Silver, Gold and Platinum tiers, which carry bonus Credits on Credit-pack purchases (5%, 10% and 15%), priority waitlist position (Gold and Platinum) and full Credit restoration on cancellations (Platinum) (Refund & Cancellation Policy, Section 12.4).

Personal information involved: none beyond what the account already holds. No program asks you for additional personal information, and none varies with the data you provide. Good-faith estimate of value: we do not sell or share personal information, so it has no resale value to us; we value each program at the Credits it grants, priced at the Membership rate for Credits shown on the Platform, and offer it because a new active account and each Booking generate marketplace revenue. Opting in and withdrawing: you opt in to Welcome Credits by creating an account after this notice, to the referral program by choosing to share or redeem a code, and to the loyalty program by making a Booking; you may withdraw at any time by leaving the Credits or benefits unused, by not sharing a code, or by deleting your account (which forfeits unused Credits — Refund & Cancellation Policy, Section 5.6). We will not deny you services, charge different prices, or provide a different level of service because you decline to participate or exercise a CCPA right.

ARTICLE 3 — NO SALE, NO SHARING, AND SENSITIVE INFORMATION LIMITS

3.1 No Sale

We do not sell personal information, and we have not sold personal information in the preceding twelve (12) months.

3.2 No Sharing for Cross-Context Behavioral Advertising

We do not share personal information for cross-context behavioral advertising, and we have not done so in the preceding twelve (12) months. No advertising technology exists on the Platform.

3.3 Minors

We do not sell or share the personal information of any consumer, and therefore do not sell or share the personal information of consumers under sixteen (16) years of age. We have no actual knowledge of any such sale or sharing, and children never have accounts on the Platform.

3.4 Sensitive Personal Information — Limited Use

We use and disclose sensitive personal information only for the purposes permitted by Section 7027(m) of the CCPA regulations — principally, performing the services you request (activity matching and accommodations, insurance verification you initiate, showing activities near your approximate location when you ask for that, and account security), maintaining safety and quality, and complying with law. We do not use sensitive personal information to infer characteristics about you, and we do not use or disclose it for advertising. Accordingly, we are not required to offer, and do not offer, a separate "Limit the Use of My Sensitive Personal Information" link. If our practices ever change, we will provide the required link and choices before the change takes effect.

3.5 Opt-Out Preference Signals

We do not sell or share personal information, so there is no sale or sharing for an opt-out preference signal to stop. We nonetheless honor an opt-out preference signal (such as Global Privacy Control) as a valid opt-out request: on the website it is treated as a choice of "Essential Only", and the analytics described in Section 1.4 does not load even if you choose "Accept All" on the cookie banner.

ARTICLE 4 — YOUR CCPA RIGHTS

Subject to legal limits and verification, California residents have the right to:

4.1 Know and Access — request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes, and the categories of recipients.

4.2 Delete — request deletion of personal information we collected from you, subject to statutory exceptions (which parallel the carve-outs in the ORYN QUEST — DATA RETENTION POLICY).

4.3 Correct — request correction of inaccurate personal information. You can also correct most information directly in account settings.

4.4 Portability — receive the information described in Section 4.1 in a portable and readily usable format.

4.5 Opt Out of Sale or Sharing — we do not sell or share personal information, so there is nothing to opt out of; if that ever changes, we will provide the required "Do Not Sell or Share My Personal Information" mechanism first.

4.6 Limit Sensitive Personal Information — addressed in Section 3.4.

4.7 Non-Discrimination — we will not deny you services, charge different prices, or provide a different level or quality of service because you exercised any CCPA right.

ARTICLE 5 — HOW TO EXERCISE YOUR RIGHTS

5.1 Submission Methods

You may submit a request by:

• emailing support@orynquest.com with the subject line "CALIFORNIA PRIVACY REQUEST";
• using your in-app account settings (for access, correction, personalization opt-out, and deletion controls); or
• following the deletion instructions at https://orynquest.com/legal/data-deletion.

5.2 Verification

We verify requests by matching the request to the email address and account information we hold, and, where appropriate, by requiring you to confirm the request while signed in to your account. If you signed in with Apple using Hide My Email, or otherwise cannot write from the address on your account, tell us so: we will verify you by replying to the address on file (Apple's private relay forwards our reply to you) or by asking you to confirm the request from inside your account while signed in. If we cannot verify a request with reasonable certainty, we will ask for additional information limited to what verification requires, or explain why we cannot comply. Requests concerning Child profile information are honored only for the verified account-holding Parent or Guardian.

5.3 Authorized Agents

You may use an authorized agent to submit a request. We will require the agent to provide your signed written permission, and we may also require you to verify your identity directly with us or confirm that you granted the agent permission.

5.4 Timing

We will confirm receipt of a request within ten (10) business days and respond within forty-five (45) calendar days, extendable once by an additional forty-five (45) days with notice, as the CCPA permits.

5.5 Household and Child Data

Because accounts are individual and child information is provided by the account-holding Parent, requests concerning a Child's information must come from that Parent or Guardian.

5.6 No Fee

We do not charge a fee to process verifiable consumer requests. If requests from a single consumer are manifestly unfounded or excessive, the CCPA permits us to charge a reasonable fee or decline the request; if we ever rely on that provision, we will explain why in writing.

ARTICLE 6 — REQUEST METRICS

The CCPA regulations require businesses that buy, sell, or share the personal information of ten million (10,000,000) or more California residents in a calendar year to publish annual request metrics. We do not meet that threshold. If we ever do, we will publish the required metrics in this Addendum.

ARTICLE 7 — CALIFORNIA "SHINE THE LIGHT"

Under Cal. Civ. Code Section 1798.83, California residents may request information about disclosures of personal information to third parties for those parties' direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

ARTICLE 8 — CHANGES AND RELATED POLICIES

8.1 This Addendum should be read together with the ORYN QUEST — PRIVACY POLICY, the ORYN QUEST — CHILDREN'S PRIVACY POLICY, the ORYN QUEST — DATA RETENTION POLICY, and the ORYN QUEST — COOKIE POLICY.

8.2 We may update this Addendum from time to time. When we do, we will revise the "Last Updated" date and version above, and material changes will be presented through the Platform's versioned consent system and, where appropriate, by notice through the Platform or by email.

ARTICLE 9 — CONTACT

ORYN Quest, Inc. Email: support@orynquest.com Website: https://orynquest.com

Please include "CALIFORNIA PRIVACY REQUEST" in the subject line of rights requests. You may also exercise access, correction, deletion, and personalization opt-out controls directly in your account settings at any time.

The current version of this Addendum and every other Platform policy is available at https://orynquest.com/legal.

END OF CALIFORNIA PRIVACY ADDENDUM