State Privacy Addenda

These State Privacy Addenda ("Addenda") supplement the ORYN QUEST — PRIVACY POLICY for residents of U.S. states with comprehensive consumer privacy laws other than California, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and states with similar laws. California residents should read the ORYN QUEST — CALIFORNIA PRIVACY ADDENDUM.

ORYN Quest, Inc. ("ORYN Quest," "we," "our," or "us") currently operates first in the Los Angeles area, and some state laws may not yet apply to us at our present scale or resident counts. We extend the rights below to residents of these states regardless, as a matter of practice, while reserving statutory defenses where a law does not in fact apply.

ARTICLE 1 — YOUR RIGHTS

Subject to verification and legal limits, residents of covered states may:

1.1 Confirm and Access — confirm whether we process your personal data and access it.

1.2 Correct — correct inaccuracies in your personal data. Most account and profile information can be corrected directly in account settings.

1.3 Delete — request deletion of personal data provided by or obtained about you, subject to the legal and safety carve-outs described in the ORYN QUEST — DATA RETENTION POLICY.

1.4 Portability — obtain a copy of personal data you provided to us in a portable and readily usable format.

1.5 Opt Out of Targeted Advertising — we do not engage in targeted advertising, so there is no targeted-advertising processing to opt out of. If that ever changes, we will provide a compliant opt-out mechanism before the change takes effect.

1.6 Opt Out of Sale — we do not sell personal data.

1.7 Opt Out of Certain Profiling — we do not use profiling in furtherance of decisions that produce legal or similarly significant effects (such as decisions about lending, housing, insurance underwriting, education enrollment, or employment). Our profiling consists of an interest profile associated with your account and family-facing developmental insights — weekly per-child skill scores across eight developmental domains with trends over time, and behavioral signals such as a preferred activity category and typical session frequency, computed from Vendor session feedback and the child's activity history. These power activity recommendations and your family's own Progress page (where they are visible to you and used by your family's AI assistant), and nothing else. You may switch off this personalization entirely in account settings; doing so also stops these computations and deletes stored developmental insight scores and behavioral signals.

1.8 Controller

For purposes of these laws, the controller of personal data processed through the Platform is ORYN Quest, Inc., a Delaware corporation reachable at support@orynquest.com.

1.9 State-Specific Notes

• (a) Virginia (VCDPA), Colorado (CPA), and Connecticut (CTDPA): all of the rights in Sections 1.1 through 1.7 apply, together with the sensitive-data consent practices in Article 2 and the appeal process in Section 4.4.

• (b) Utah (UCPA): Utah's law provides access, deletion, portability, and opt-out rights; it does not mandate a correction right or an appeal process, but we extend both to Utah residents anyway as a matter of practice.

• (c) Other states: as additional state privacy laws take effect (including laws in states such as Texas, Oregon, Montana, Delaware, New Jersey, and others), we apply the same rights framework described in this document to their residents to the extent those laws require, and as a courtesy where they do not.

ARTICLE 2 — SENSITIVE DATA AND CHILDREN'S DATA

2.1 Sensitive Data We Process

As described in the ORYN QUEST — PRIVACY POLICY, a Parent may voluntarily record sensitive information in a Child profile (accessibility and support needs, behavior notes) and optional insurance identifiers for insurance-based activities.

2.2 Consent Basis

We process this sensitive data only because, and only after, the Parent deliberately provides it for the stated, purpose-limited uses (activity matching, accommodations, and insurance verification the Parent initiates). That deliberate provision, together with recorded acceptance of the ORYN QUEST — PRIVACY POLICY under the Platform's versioned consent system, constitutes the consent these laws contemplate. A Parent may withdraw consent at any time by removing the information, deleting the Child profile, or deleting the account.

2.3 Data Concerning a Known Child

Where state law treats personal data collected from a known child as sensitive data requiring processing in accordance with COPPA, our practices are described in the ORYN QUEST — CHILDREN'S PRIVACY POLICY: children never have accounts, the kid zone collects nothing, and child data comes from the Parent, supplemented only by the Vendor session feedback about booked sessions described in the ORYN QUEST — PRIVACY POLICY. We never collect personal data online directly from a child.

2.4 De-identified Data

Where we maintain de-identified data, we maintain it without attempting to re-identify it and require the same of our service providers.

2.5 Device Location (Rounded Before Use)

If you grant your device's location permission, the Platform receives coordinates rounded to a neighborhood-level area of roughly one hundred ten (110) meters before storage or any transmission, used only to show activities near you, as described in the ORYN QUEST — PRIVACY POLICY, Article 2; your exact (unrounded) coordinates are never retained. Most state privacy laws define precise geolocation as location within a radius of 1,750 feet (about 533 meters); coordinates rounded to roughly 110 meters fall within that definition, so we treat them as precise geolocation — sensitive data under most of those laws — and your affirmative grant of the device permission is the consent for that processing. You may withdraw the permission at any time in your device or browser settings and instead search by typing or selecting a city, neighborhood, or map area.

ARTICLE 3 — UNIVERSAL OPT-OUT SIGNALS

Where state law requires recognition of universal opt-out mechanisms (such as Global Privacy Control), we honor them. The Platform contains no targeted advertising, no sale of personal data, and no cross-site tracking technology, so a browser sending a universal opt-out signal already receives the outcome the signal requests for those practices; in addition, on the website such a signal is treated as a choice of "Essential Only" and the consent-based analytics described in the ORYN QUEST — COOKIE POLICY does not load.

ARTICLE 4 — HOW TO EXERCISE YOUR RIGHTS; APPEALS

4.1 Submitting a Request

Submit requests by emailing support@orynquest.com with the subject line "STATE PRIVACY REQUEST" (please state your state of residence), through your in-app account settings, or via the deletion instructions at https://orynquest.com/legal/data-deletion.

4.2 Verification

We verify requests against the email address and account information we hold, and may ask you to confirm the request while signed in. Requests concerning a Child's information must come from the verified account-holding Parent or Guardian.

4.3 Timing

We will respond within the time required by your state's law (generally forty-five (45) days, extendable once where the law permits, with notice).

4.4 Appeals

If we decline all or part of your request, you may appeal by replying to our decision or emailing support@orynquest.com with the subject line "PRIVACY APPEAL" within a reasonable period after our decision. We will respond to appeals within the time your state's law requires and will explain the reasons for our decision. If your appeal is denied, we will provide a method for you to contact your state Attorney General or other authority designated by your state's law.

4.5 No Discrimination

We will not discriminate against you for exercising these rights.

4.6 No Fee

We process rights requests free of charge. If requests from a single resident are manifestly unfounded, excessive, or repetitive, applicable law may permit a reasonable fee or refusal; if we ever rely on that provision, we will explain why in writing.

4.7 Portability Format

Where you request a portable copy of your personal data, we will provide it in a commonly used, readily usable format to the extent technically feasible.

ARTICLE 5 — NEVADA RESIDENTS

Under Nevada law (NRS Chapter 603A), Nevada residents may direct operators not to sell certain covered information. ORYN Quest does not sell covered information as defined by Nevada law. Nevada residents may nonetheless submit a verified no-sale request to support@orynquest.com with the subject line "NEVADA PRIVACY REQUEST," and we will honor it if our practices ever change.

ARTICLE 6 — RELATED POLICIES AND CHANGES

6.1 These Addenda should be read together with the ORYN QUEST — PRIVACY POLICY, the ORYN QUEST — CALIFORNIA PRIVACY ADDENDUM, the ORYN QUEST — CHILDREN'S PRIVACY POLICY, and the ORYN QUEST — DATA RETENTION POLICY. Users outside the United States should read the ORYN QUEST — INTERNATIONAL PRIVACY ADDENDUM.

6.2 We may update these Addenda from time to time, including as new state privacy laws take effect. When we do, we will revise the "Last Updated" date and version above, and material changes will be presented through the Platform's versioned consent system and, where appropriate, by notice through the Platform or by email.

ARTICLE 7 — CONTACT

ORYN Quest, Inc. Email: support@orynquest.com Website: https://orynquest.com

END OF STATE PRIVACY ADDENDA