Privacy Policy

ORYN Quest, Inc. ("ORYN Quest," "Company," "we," "our," or "us"), a Delaware corporation, operates an online marketplace that helps Parents and Guardians discover, book, and manage children's activities offered by independent Vendors. This Privacy Policy ("Policy") explains what personal information we collect, how we use it, with whom we share it, and the rights and choices available to you when you access or use the ORYN Quest platform, including our websites, mobile applications, artificial intelligence features, communications systems, and related services (collectively, the "Platform").

By creating an account, accessing, or using the Platform, you acknowledge that you have read and understood this Policy. Where the Platform asks you to accept this Policy, your acceptance is recorded together with the version of the Policy you accepted.

Capitalized terms used but not defined in this Policy have the meanings given to them in the ORYN QUEST — TERMS OF USE and the ORYN QUEST — PARENT & GUARDIAN TERMS AND CONDITIONS.

ARTICLE 1 — SCOPE, ROLES, AND RELATED POLICIES

1.1 Who This Policy Covers

This Policy applies to all users of the Platform, including Parents and Guardians, Vendors, and administrative users, as well as visitors who browse public areas of the Platform without an account.

1.2 Children Do Not Have Accounts

Accounts may be created only by adults eighteen (18) years of age or older. Children never have accounts on the Platform. Information about a Child that appears on the Platform is provided by that Child's Parent or Guardian within the Parent's own account, supplemented only by the Vendor session feedback described in Article 3. Our practices concerning children are described in detail in the ORYN QUEST — CHILDREN'S PRIVACY POLICY, which supplements this Policy.

1.3 The Kid Zone Pledge

The Platform includes a dedicated children's play area at /play (including games and the ORYN Town experience) (the "Kid Zone"). The Kid Zone collects no personal information: no accounts, no advertising, no tracking technologies, and no error-monitoring sessions. See Article 7 for the full Kid Zone commitment.

1.4 Related Policies

This Policy is supplemented by, and should be read together with, the following documents, each of which is incorporated into the Platform's legal framework:

• ORYN QUEST — CHILDREN'S PRIVACY POLICY (children's information and COPPA practices);
• ORYN QUEST — COOKIE POLICY (cookies and similar technologies);
• ORYN QUEST — DATA RETENTION POLICY (how long information is kept);
• ORYN QUEST — CALIFORNIA PRIVACY ADDENDUM (rights of California residents);
• ORYN QUEST — STATE PRIVACY ADDENDA (rights under other U.S. state privacy laws);
• ORYN QUEST — INTERNATIONAL PRIVACY ADDENDUM (users located outside the United States);
• ORYN QUEST — AI FEATURES TERMS (terms governing AI Services);
• ORYN QUEST — CHILD SAFETY POLICY (safety expectations and reporting).

If this Policy conflicts with the ORYN QUEST — TERMS OF USE, the Terms of Use control as to contractual matters; this Policy controls as to descriptions of our information practices.

1.5 Our Approach

We describe in this Policy what the Platform actually does today. Where we reserve the right to introduce a new practice in the future (for example, analytics cookies), we say so expressly, and we will update the relevant policy and any associated consent mechanisms before the practice begins. The current version of every Platform policy is always available at https://orynquest.com/legal.

ARTICLE 2 — INFORMATION WE COLLECT FROM PARENTS AND GUARDIANS

2.1 Account Information

When a Parent or Guardian creates an account, we collect the information needed to establish and secure it, including name, email address, and password credentials. Authentication is operated by our identity provider, Clerk. If you sign in using a supported social sign-in provider (such as Google or Facebook, and additional providers as offered), we receive basic profile information from that provider (such as your name, email address, and profile image) in order to create and authenticate your account. We do not receive your social account password.

2.2 Profile and Household Information

You may add optional information to your account, such as a phone number, a street address you type yourself (address suggestions are fetched from the OpenStreetMap Foundation's Nominatim service as you type, as described in Section 9.2), a profile photo or avatar, and preferences that help us tailor the Platform to your family.

2.3 Membership, Credits, and Transactions

We collect records of your Memberships, Credit balances and Credit transactions, Bookings, waitlist activity, cancellations, refunds, referral activity and rewards, and related transaction history.

2.4 Communications

We collect the messages you send and receive through the Platform's in-app messaging (including messages between Parents and Vendors), your posts and comments in community features, your reviews and ratings, your support requests, and your responses to Platform emails.

2.5 Calendar Information (Optional)

If you choose to connect a Google Calendar to the Platform's family calendar feature, we request only the Google OAuth scopes needed for that feature: the calendar events scope (to create and manage activity events on your calendar) and your email address (to identify the connected account). We do not request access to your wider Google account, contacts, or files. You may disconnect calendar access at any time, including through your Google account security settings.

2.6 Approximate Device Location (Optional)

If you allow your device or browser to share your location with the Platform (for example, to find Activities near you), the coordinates your device reports are rounded to about three decimal places — a neighborhood-level area of roughly one hundred ten (110) meters — before they are stored and before they are transmitted to any service. We retain no precise geolocation. The rounded coordinates are used to center your search and map results and are sent to the OpenStreetMap Foundation's Nominatim reverse-geocoding service to identify a nearby city, state, and ZIP code; that request contains no name or account information. We do not derive or save a street address from your device location (you may type your own address if you choose), and we do not collect location in the background. You may decline or withdraw location permission at any time in your device or browser settings and instead search by typing or selecting a city, neighborhood, or map area.

2.7 Push Notification Subscriptions (Optional)

If you enable push notifications in your browser or on your device, we store the push subscription endpoint or device token needed to deliver them. Push notifications carry the same kinds of service notices as our emails, such as booking reminders. You can disable push notifications at any time in your browser or device settings, which stops delivery to the stored subscription.

2.8 Automatically Collected Information

When you use the Platform, we and our infrastructure providers automatically receive technical information such as device type, browser type, operating system, IP address, and log information about requests to the Platform. We also record in-app activity events (such as searches performed, listings and Vendor pages viewed, filters and favorites used, bookings made, and interactions with recommendations) as described in Article 5; you may opt out of that activity-event collection as described in Section 5.4. Cookies and similar technologies are described in the ORYN QUEST — COOKIE POLICY; the Platform currently uses essential cookies only.

2.9 Payment Information

Payments on the Platform are processed by Stripe. Your full payment card number is provided directly to Stripe and is never stored on ORYN Quest systems. We retain limited payment-related records, such as the fact and amount of a transaction, subscription status, and non-sensitive payment identifiers needed to manage your Membership, process refunds, and meet our legal obligations.

2.10 What We Do Not Collect

We do not collect biometric identifiers or facial-recognition data. We do not retain precise geolocation: when you allow device location, coordinates are rounded to a neighborhood-level area of roughly one hundred ten (110) meters before they are stored or transmitted anywhere, as described in Section 2.6. We do not maintain medical records. We do not purchase data about you from data brokers, and we do not embed third-party advertising technology in the Platform.

ARTICLE 3 — CHILD PROFILE INFORMATION PROVIDED BY PARENTS

3.1 Sources and Control

Child profiles are records created and maintained by a Parent or Guardian inside the Parent's own account. Child profile information is provided by the Parent, who controls what is entered, may edit it at any time, and may delete it. Children do not enter information into the Platform themselves.

One additional, limited source of information about a Child exists. After a session a Child attended, the Vendor who delivered it may submit session feedback about that Child: ratings on a one-to-five scale for engagement, focus, social interaction, and confidence; strength and challenge tags; and a short note. We use this feedback only to operate the family-facing developmental insights described in Section 5.4, where it is visible to the Child's Parent; it is not published to other users and is never used for advertising. The personalization opt-out described in Section 5.4 stops the computation of developmental insights from this feedback and deletes stored insight scores and behavioral signals.

3.2 Child Profile Contents

A Child profile may include, at the Parent's option: the Child's name, date of birth or age, gender (optional; used to personalize the Child's avatar and as one signal for activity recommendations), an avatar, interests, school type, goals, behavior traits and notes, and accessibility and support information.

3.3 Sensitive Accessibility and Support Information

To help match a Child with suitable Activities and communicate Accommodation needs, a Parent may choose to record accessibility and support information in a Child profile, such as: an autism-friendly preference, a neurodivergence indicator, sensory support needs and tags, general support needs, vision or hearing impairment indicators, and wheelchair accessibility needs. This information is sensitive. It is optional, provided solely by the Parent, and used only for the purposes described in Section 3.5.

3.4 Insurance Information (Optional)

For Activities that may be covered by insurance (such as certain therapy-related services offered by qualified Vendors where legally permitted), a Parent may optionally provide insurance details for a Child, including the insurance provider, policy number, and group code. This information is used solely to support insurance verification for such Activities, is shared only in connection with that verification process, and is never used for advertising or unrelated purposes.

3.5 Purpose Limitation for Child Profile Information

We use Child profile information only to:

• help discover, match, and recommend Activities suitable for the Child (including through the AI Services described in Article 5);
• communicate Accommodation and support needs in connection with Bookings;
• support insurance verification for insurance-based Activities where the Parent initiates it;
• operate Bookings, attendance, and waivers;
• compute the family-facing developmental insights described in Section 5.4, subject to the personalization opt-out; and
• comply with legal obligations and enforce our agreements.

We do not use Child profile information for advertising. We never engage in behavioral advertising directed at children. Child profile information is never displayed in the Kid Zone.

3.6 Further Detail

The ORYN QUEST — CHILDREN'S PRIVACY POLICY describes our children's-information practices, including our approach to the Children's Online Privacy Protection Act (COPPA), in detail.

ARTICLE 4 — INFORMATION WE COLLECT FROM VENDORS

4.1 Vendor Business Information

Vendors provide business information to join and operate on the Platform, including business name and description, contact details, listing content, scheduling information, pricing in Credits, and the categories of services offered. Our Vendor approval process reviews business information; as described in the ORYN QUEST — VENDOR AGREEMENT and our help resources, ORYN Quest does not run criminal background checks and does not independently verify certifications, insurance, or accommodation capabilities that Vendors self-report.

4.2 Vendor Credentials and Attestations

Vendors may self-report credentials, qualifications, and insurance types. These attestations are stored and may be displayed to Parents as Vendor-provided information.

4.3 Vendor Financial Information

We maintain records needed to calculate and administer Vendor payouts (including payout rates and payout-basis records), and tax-related information required for reporting obligations (for example, information required for IRS Form 1099 reporting where legal thresholds are met). Payout payments are processed through Stripe.

ARTICLE 5 — AI FEATURES, PERSONALIZATION, AND ACTIVITY SIGNALS

5.1 The ORYN Quest Assistant

The Platform includes an AI assistant available by text chat and by voice, designed both as a convenience and as a primary accessibility surface for users who prefer or require conversational control of the Platform. When you use the assistant, your messages, the assistant's responses, and the actions you ask it to take are processed to provide the service.

5.2 Voice Processing

When you use voice features, your audio is captured and processed in real time by our AI provider (Google's Gemini models) to understand your speech and respond. Voice interactions are part of your assistant conversation history.

5.3 Conversation Summaries and Assistant Memory

To make the assistant more helpful over time, conversations are summarized and stored as personalization memory associated with your account. Memory items lose confidence when they go unreferenced for thirty (30) or more days and are deprioritized over time; short-lived AI response caches are cleaned daily. You may request deletion of your data, including assistant memory, as described in Article 12.

5.4 Activity Signals, Interest Profiles, and Developmental Insights

To power recommendations, the Platform records in-app activity events — such as searches, listing and Vendor-page views, filters, favorites, bookings, and interactions with recommendations — and computes them into an interest profile associated with your parent account (for example, your top activity categories, your recent searches, and Activities you viewed but did not book). Child profiles may also include an AI embedding (a numerical representation generated from profile information using Google Gemini embedding models) used for recommendation matching.

The Platform also computes family-facing developmental insights. A weekly process derives, for each Child profile, skill scores across eight developmental domains, with trends over time — drawing on the session feedback Vendors submit (Section 3.1) and the Child's activity history — together with behavioral signals such as a preferred activity category and typical session frequency. These insights are visible only within your account: to you on your family's Progress page, and to your family's AI assistant so it can personalize its help. They are never used for advertising, and they are not medical, psychological, developmental, or educational evaluations (Section 5.6).

You may opt out of this personalization at any time in your account settings. When you opt out, activity events are not stored, interest profiles are not computed for your account, developmental insight scores and behavioral signals are no longer computed for the Children in your account — and any previously stored scores and signals are deleted no later than the next weekly processing run — and the assistant stops storing new personalization memories from your conversations (existing memories remain until deleted on request). Opting out does not affect your ability to use the Platform.

5.5 AI Providers

AI features are powered by third-party model providers acting on our behalf: Google (Gemini models, including voice audio processing, embeddings, and place-data enrichment) and additional large-language-model providers accessed through OpenRouter. These providers process the content of your AI interactions to generate responses for you. Our Google Gemini processing runs on Google's paid API service tier, under terms providing that Google does not use the content we submit to train its models.

5.6 Nature of AI Outputs

AI outputs are recommendations and assistance only. The AI Services do not provide medical, psychological, developmental, educational, legal, or diagnostic conclusions, and no AI output should be treated as professional advice. The ORYN QUEST — AI FEATURES TERMS govern your use of AI Services.

ARTICLE 6 — MESSAGING, COMMUNITY, AND AUTOMATED MODERATION

6.1 Automated Message Moderation

To protect families and maintain marketplace integrity, in-app messages are automatically scanned by moderation logic at the time of sending. Messages containing offensive language are blocked, and messages that attempt to steer payments off the Platform or improperly disclose costs outside the Credits system are flagged or blocked. Vendors are also subject to limits on unsolicited outreach to Parents.

6.2 Community Content Moderation

Posts and comments in community features are subject to automated and human moderation consistent with the ORYN QUEST — COMMUNITY GUIDELINES. Comments are screened automatically at the moment of submission: comments containing offensive content are refused, and comments containing personal contact details (phone numbers, email addresses, or street addresses) are refused. Posts are additionally screened and may be flagged for review where they appear to contain personal information.

6.3 Moderation Records

Moderation events and safety reports are logged and may be reviewed by authorized administrators. We retain moderation and safety records as described in the ORYN QUEST — DATA RETENTION POLICY, including where needed to investigate conduct, enforce our policies, or cooperate with law enforcement under the ORYN QUEST — CHILD SAFETY POLICY.

6.4 Public Content

Reviews and ratings you publish, community posts you share to public groups, and public share pages (such as referral pages and listing share cards) are visible to others. Do not include information in public content that you do not want to be public. Child profile information is not published on public pages by the Platform.

ARTICLE 7 — THE KID ZONE (ORYN PLAY AND ORYN TOWN)

7.1 Zero-Collection Commitment

The Kid Zone at /play and all pages beneath it is designed for children to enjoy without any data collection:

• no accounts and no sign-in;
• no advertising of any kind;
• no analytics and no tracking technologies;
• no cookie banner, because no non-essential cookies are used there;
• error monitoring (Sentry) is fully disabled for sessions that begin in the Kid Zone and is stopped when a session navigates into the Kid Zone; and
• game progress is stored only in the browser's local storage on the device (keys "oryn-play" and "oryn-play-art") and is never transmitted to our servers.

One thing is sent to our servers from the Kid Zone, stated here so the list above can be read literally. ORYN Town keeps two town-wide counters for the current calendar day: how many times the town was opened, and how many sparks all visitors collected together. This is what lets the town show a child playing alone that others are playing too. These counters are plain numbers in a single shared daily record. No account, device identifier, session identifier, cookie, or IP address is stored with them; nothing is written per visitor; and nothing about them can be attributed to any person or device. They are never used for advertising, recommendations, or profiling of any kind. The same disclosure appears in the ORYN QUEST — CHILDREN'S PRIVACY POLICY, Article 3.

7.2 Main Street and Vendor Doors

The ORYN Town "Main Street" experience displays Vendor business names (and a city line on a door card) only. It displays no child data and no personal information. Vendor doors open ORYN Quest's own games. The only link from the Kid Zone to a Vendor page sits behind a grown-up gate requiring a deliberate press-and-hold confirmation. Vendor placement in the Kid Zone is never paid.

ARTICLE 8 — HOW WE USE INFORMATION

8.1 We use the information described in this Policy to:

• (a) operate the Platform, including accounts, Memberships, Credits, Bookings, waitlists, waivers, attendance, completion certificates, and Vendor payouts;

• (b) match families with Activities, including surfacing Accommodation-compatible options and supporting insurance verification the Parent initiates;

• (c) provide AI Services and personalization as described in Article 5, honoring your opt-out choices;

• (d) enable communications between Parents and Vendors and operate community features, subject to moderation as described in Article 6;

• (e) send service communications by email and, if you enable them, by web or mobile push notifications, including booking confirmations and reminders (typically about twenty-four hours before an Activity), receipts, waitlist and waiver notices, policy notices, weekly digest emails, and re-engagement emails if your account has been inactive; every digest and re-engagement email carries a visible unsubscribe link and supports one-click unsubscribe in your email client, unsubscribed accounts are skipped from those mailings, and you may unsubscribe from non-essential email at any time;

• (f) protect the safety and integrity of the Platform, including fraud prevention, enforcement of our policies, quality monitoring of Vendors, and responses to safety reports;

• (g) debug, secure, and improve the Platform, including error monitoring through Sentry (disabled in the Kid Zone); and

• (h) comply with legal obligations, including tax reporting, and establish, exercise, or defend legal claims.

8.2 No Sale; No Behavioral Advertising

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. The Platform contains no third-party advertising technology. We never direct advertising of any kind at children.

8.3 Push Notifications; No Text Messaging

If you enable push notifications, we deliver service notices through your browser or device as described in Section 2.7, and you may disable them there at any time. We do not send SMS text messages; providing a phone number remains optional.

ARTICLE 9 — HOW WE SHARE INFORMATION

9.1 With Vendors, to Deliver Booked Activities

When you book an Activity, the Vendor receives the information reasonably necessary to deliver it: the Child's name and age, relevant participation details from the Child profile, Accommodation and support information the Parent has provided for matching and participation, required waiver acknowledgment status, and the Parent's name and profile avatar together with the Parent's messaging channel on the Platform. Vendors do not receive the Parent's email address or phone number. (Where a Parent signs a waiver, the waiver signature record retains the signing Parent's email address as part of the legal record of signature.) For insurance-based Activities, insurance verification details the Parent submits are shared with the relevant Vendor and reviewing administrators solely for verification. Vendors are contractually required to use this information only to deliver the booked Activity.

9.2 With Service Providers (Processors)

We share information with service providers that process it on our behalf, under contracts limiting their use to providing services to us:

• Convex — application database and backend infrastructure; stores and processes Platform data in real time.
• Clerk — identity and authentication; manages account credentials, sign-in (including social sign-in), and sessions.
• Stripe — payment processing for Memberships, purchases, and Vendor payouts; handles payment card data (we never store card numbers).
• Resend — delivery of transactional and relationship email.
• Sentry — error monitoring and diagnostics so we can find and fix defects; disabled entirely in the Kid Zone; error reports are configured not to include IP addresses or request headers; on non-Kid-Zone surfaces, session-replay diagnostics capture a sample of sessions (currently about ten percent) plus sessions in which an error occurs, to help reproduce defects — replay begins for a session only after the visitor has responded to the cookie banner, and recordings mask text and media content; Sentry is not used to set advertising or cross-site tracking cookies.
• Google — AI model processing (Gemini chat, voice, embeddings, and place-data enrichment), on Google's paid API service tier under terms providing that Google does not use the submitted content to train its models; Google Calendar synchronization when you connect it (limited to calendar events and email scopes); and social sign-in if you choose Google sign-in.
• OpenRouter — additional AI model processing for assistant responses.
• Foursquare — place and venue data used to power discovery and maps; we send place queries, not your profile.
• OpenStreetMap Foundation — geocoding through its Nominatim service, a public service that the Foundation operates rather than a contracted processor of ours. It receives two kinds of requests: (1) if you use device location, the rounded, neighborhood-level coordinates (roughly 110-meter precision) needed to return a nearby city, state, and ZIP code; and (2) if you use an address search box — for example, to type your own street address or a Vendor business address — the text you have typed, sent as you type so matching addresses can be suggested. Each request carries the technical information any web request carries (such as an IP address) but no name or account information, and it may be processed on servers outside the United States.
• Vercel — web hosting and content delivery.

9.3 With Other Users and the Public

Information you choose to publish — reviews, ratings, community posts in public groups, and public share pages — is visible to other users and, for public pages, to anyone with the link.

9.4 For Legal, Safety, and Enforcement Reasons

We may disclose information where we believe in good faith that disclosure is required or permitted by law, including: to comply with a subpoena, court order, or lawful request; to protect the safety of a child or any person, consistent with the ORYN QUEST — CHILD SAFETY POLICY (including cooperation with law enforcement and child protective agencies); to detect, prevent, or address fraud, security, or technical issues; and to enforce our agreements and policies.

9.5 Corporate Transactions

If ORYN Quest is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy or to a successor policy with notice of material changes.

9.6 With Your Direction or Consent

We share information in other ways when you direct us to or otherwise consent — for example, when you connect your Google Calendar or share a referral page.

ARTICLE 10 — COOKIES AND SIMILAR TECHNOLOGIES

10.1 The Platform currently uses essential cookies only — those required for authentication, session security, and core operation, set through our identity provider, Clerk. We do not use advertising cookies and we do not engage in cross-site tracking. No third-party analytics library is currently installed on the Platform. Certain preferences (such as your light/dark theme) and Kid Zone game progress are stored in your browser's local storage and are not transmitted as cookies.

10.2 Full details, including the consent banner's choices and our commitment to update the ORYN QUEST — COOKIE POLICY and the banner before introducing any analytics, appear in the ORYN QUEST — COOKIE POLICY.

10.3 Do Not Track and Opt-Out Signals

Because the Platform does not track users across third-party sites or services, browser "Do Not Track" and universal opt-out preference signals (such as Global Privacy Control) do not change our practices — our default treatment already matches the state such signals request. Where a law requires us to treat such a signal as a formal opt-out request, we honor it.

ARTICLE 11 — DATA RETENTION AND SECURITY

11.1 Retention

We retain personal information while your account is active and as needed for the purposes described in this Policy, and we honor deletion requests as described in Article 12. Certain records are retained longer where required for legal, tax, safety, or dispute purposes (for example, payment and payout records, policy acceptance records, waiver signature history, and moderation and safety records). Specific automated retention windows that exist today (such as the 24-hour place-data cache, daily AI cache cleanup, 24-hour waitlist claim windows (with expired holds swept about every 15 minutes), and 30-day assistant memory confidence decay) are described in the ORYN QUEST — DATA RETENTION POLICY.

11.2 Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including role-based access separation between parent, vendor, and administrative surfaces, authentication through a dedicated identity provider, payment handling isolated to Stripe, and managed infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by Applicable Law.

ARTICLE 12 — YOUR RIGHTS AND CHOICES

12.1 Access and Correction

You may access and update your account information and Child profiles at any time through your account settings.

12.2 Deletion

You may request deletion of your account and associated personal information — including Child profiles and data associated with social sign-in — at any time:

• through the instructions at https://orynquest.com/legal/data-deletion;
• through your in-app account settings; or
• by emailing support@orynquest.com from the email address on your account.

We will act on verified deletion requests and will explain any information we must retain under the legal and safety carve-outs described in the ORYN QUEST — DATA RETENTION POLICY.

12.3 Personalization Opt-Out

You may opt out of behavioral activity-event collection, interest profiling, and developmental insights at any time in your account settings, as described in Section 5.4. The opt-out is honored end-to-end: while it is enabled, no new activity events are stored, no interest profiles are computed, no developmental insight scores or behavioral signals are computed — and any previously stored insight scores and behavioral signals are deleted no later than the next weekly processing run — and no new assistant personalization memories are saved.

12.4 Email Choices

You may unsubscribe from digest, re-engagement, and other non-essential email using the visible unsubscribe link in each message or your email client's one-click unsubscribe. We may still send messages necessary to operate your account, such as booking confirmations, safety notices, and legal notices.

12.5 Calendar Disconnection

You may disconnect Google Calendar access at any time in the Platform or through your Google account settings.

12.6 State and International Rights

Residents of California should read the ORYN QUEST — CALIFORNIA PRIVACY ADDENDUM. Residents of other U.S. states with privacy laws should read the ORYN QUEST — STATE PRIVACY ADDENDA. Users located outside the United States should read the ORYN QUEST — INTERNATIONAL PRIVACY ADDENDUM. Where those documents grant rights beyond this Article, the addenda control for covered residents.

12.7 No Retaliation

We will not deny you services, charge you different prices, or provide a different level of quality because you exercised a privacy right.

12.8 Accessible Formats

The AI assistant is designed as a primary accessibility surface for the Platform, and our accessibility commitments are described in the ORYN QUEST — ACCESSIBILITY & INCLUSION POLICY. If you need this Policy or a privacy process in an alternative accessible format, contact support@orynquest.com and we will accommodate you.

ARTICLE 13 — CHANGES TO THIS POLICY; CONSENT VERSIONING

13.1 We may update this Policy from time to time. When we do, we will revise the "Last Updated" date and version above.

13.2 The Platform maintains a versioned consent system. Your acceptance of each version of this Policy is recorded with the version number and time of acceptance. When we make material changes, the Platform will present the updated Policy for your review and re-acceptance on your next visit, and we may also provide notice by email or through the Platform. Continued use of the Platform after an updated Policy takes effect constitutes acceptance of the updated Policy to the extent permitted by Applicable Law.

ARTICLE 14 — CONTACT

Questions, concerns, or requests regarding this Policy or your personal information may be directed to:

ORYN Quest, Inc. 1501 Lynglen Drive Glendale, CA 91206, USA Phone: +1 (818) 439-9127 Email: support@orynquest.com Website: https://orynquest.com

We aim to acknowledge privacy inquiries promptly and to resolve them within the timeframes required by Applicable Law.

END OF PRIVACY POLICY