PRIVACY POLICY

SUPPLEMENTAL PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

This Privacy Notice for California Residents supplements the information contained in the Steve AI.com Privacy Policy (above), and applies only to California residents.

Personal Information Collection and Purposes of Use

• We collect and use information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you or your devices when you visit this website, provide us your personal information, or have a contractual or business relationship with us or any of our affiliates, (“Personal Information”). Such Personal Information includes direct identifiers like a name, postal address, email address, social security number or other government identifier, and indirect identifiers that may identify, relate to, or be associated with a particular individual, such as a telephone number, device identifier, IP address and browsing history, credit card information, or inferences about consumer preferences or characteristics.
• We collect this Personal Information for the following purposes:
• to respond to your inquiries and to fulfill your requests;
• to send you important information regarding our relationship with you or regarding this website, changes to our terms, conditions, and policies and/or other administrative information;
• for audits, to verify that our internal processes function as intended and are compliant with legal, regulatory, or contractual requirements;
• for fraud or crime prevention, and for technical security monitoring purposes;
• to facilitate the development of new products and services;
• to enhance, improve or modify our website or products and services;
• for data analysis that will allow us to understand website usage trends;
• to determine the effectiveness of our promotional campaigns, so that we can adapt our campaigns to the needs and interests of our users;
• to better understand you, so that we can personalize our interactions with you and provide you with information and/or offers tailored to your interests;

Our Personal Information Handling Practices in 2021

In the preceding 12 months, we have collected the following categories of Personal Information from California residents who have visited this website, provided us their Personal Information, or had or have a contractual or business relationship with us or any of our affiliates:

• Direct identifiers as described above;
• Indirect identifiers as described above.
• We have collected such Personal Information from one or more of the following categories of sources:
• Information that you submit or share directly with us, through registrations, surveys, applications, or telephone calls, and email and postal communications;
• Information passively collected from cookies and other website analytics;
• Information collected through third parties or from your browsing activity on other sites, such as on social media platforms, and public databases;
• From one or more of our affiliates with which you have a business relationship;
• Service providers with which we have a contractual relationship and to which you have provided your Personal Information.

We collected such Personal Information for the purposes noted above (see “Personal Information Collection and Purposes of Use”) and in the Steve AI.com Privacy:

• We may have shared such Personal Information with the following categories of third parties:
• Service providers that help us to run our business, such as call centers and order fulfillment and distribution companies, credit card processing companies, web hosting and development companies, and direct marketing agencies.
• Vendors that help us track the effectiveness of advertisements on our Sites.
• Vendors that help us to provide you with program, services, or educational information we believe may be of interest to you.
• third parties with which we jointly market a product.
• Affiliates and subsidiaries that may have or may want to seek a business relationship with you.

We collected one or more of the following specific pieces of personal information:

• Legal name, nickname, signature, email address, postal address, social security number, date of birth, driver’s license number, physical characteristics or description, educational level, current employment or employment history, biometric information, and/or geolocation data.
• Account name, bank account number, credit card number, debit card number, or any other financial information, medical information and/or health insurance information.
• Online identifier, Internet Protocol address, Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.

Unless specifically stated, we do not share, disclose or sell personal information to third parties for their own use, but we do share your personal information with our affiliates and trusted partners in arrangements that may meet the broad definition of “sale” under California law. In these arrangements, use of the information we share is limited by policies, contracts, or similar restrictions.

SUPPLEMENTAL PRIVACY NOTICE FOR NEVADA RESIDENTS

This Supplemental Privacy Notice for Nevada Residents adds to the information contained in the Steve AI.com Privacy Policy (above), and applies only to Nevada residents.

Personal Information Collection and Purposes of Use

We collect certain personal information of Nevada consumers through our Internet websites or other online service. This information includes one or more of the following elements of personally identifiable information:

• A first and last name.
• A home or other physical address that includes the name of a street and the name of a city or town
• An electronic mail address.
• A telephone number.
• A Social Security Number.
• An identifier that allows a specific person to be contacted either physically or online.
• Any other information concerning a person collected from the person through the Internet website or online service of the operator, and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable.

We collect this personal information for the following purposes:

• to respond to your inquiries and to fulfill your requests;
• to send you important information regarding our relationship with you or regarding this website, changes to our terms, conditions, and policies and/or other administrative information;
• for audits, to verify that our internal processes function as intended and are compliant with legal, regulatory, or contractual requirements;
• for fraud or crime prevention, and for technical security monitoring purposes;
• to facilitate the development of new products and services;
• to enhance, improve or modify our website or products and services;
• for data analysis that will allow us to understand website usage trends;
• to determine the effectiveness of our promotional campaigns, so that we can adapt our campaigns to the needs and interests of our users.
• to better understand you, so that we can personalise our interactions with you and provide you with information and/or offers tailored to your interests.

Right to access and/or correct your personal information, or opt out of sale of personal information

If you would like to review, correct, or update your personal information, you or your authorized representative may submit your request via email at legal@animaker.com, or through this Form. We will respond to your verified request as soon as reasonably practicable, but no later than sixty (60) days after receipt. If circumstances cause any delay in our response, you will be promptly notified and provided a date for our response.

We generally do not disclose or share personal information for profit. Under Nevada law, you have the right to direct us to not sell or license your personal information to third parties. To exercise this right, if applicable, you or your authorized representative may submit a request via email to legal@animaker.com or this privacy request form. We will respond to your verified request as soon as reasonably practicable, but no later than sixty (60) days after receipt. If circumstances cause any delay in our response, you will be promptly notified and provided a date for our response.

You can contact us with questions about this Privacy Notice for Nevada Residents or to exercise your rights as described in this Notice at legal@animaker.com.

What Data is Covered by the GDPR?

The GDPR applies to personal data and special categories of personal data, i.e., sensitive personal data. The GDPR's definition of personal data is more detailed and expansive than in the pre-GDPR regime, e.g.:

• A wide range of personal identifiers (such as IP address) can constitute personal data;
• The GDPR applies to automated personal data and manual filing systems where personal data are accessible according to specific criteria—this could include chronologically ordered sets of manual records;
• Personal data that has been pseudonymized (e.g., key-coded) can fall within the scope of the GDPR.

The GDPR applies to the processing of personal data:

• Wholly or partly by automated means (e.g., personal data held in electronic form on a computer or other such device) –or–
• Other than by automated means, where that personal data forms part of, or is intended to form part of, a filing system (e.g., this could include chronologically ordered sets of manual records containing personal data).

However, despite its potentially wide material scope, the GDPR does not apply to:

• Anonymous data. This includes data “which does not relate to an identified or identifiable natural person” or “personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.”
• Data relating to deceased persons. Member States are permitted to provide their own rules relating to the processing of personal data of deceased individuals.
• Data relating to legal persons. This includes the name, form, and contact details of a company or another legal entity, which might have a legal personality separate to its owners or directors, does not constitute personal data and does not fall within the scope of the GDPR.
• Personal data contained within files or sets of files which are not structured according to specific criteria (e.g., manual/physical files which do not, and are not intended to, form part of a filing system).
• The processing of personal data in the course of an activity which falls outside the scope of EU law. This includes activities involving national security, or immigration issues relating to third-country nationals on humanitarian grounds.
• The processing of personal data by Member States when carrying out activities in relation to the common foreign and security policy of the EU.
• The processing of personal data by an individual for purely personal or household activities with no connection to a professional or commercial activity.
• The processing of personal data by competent authorities for the purposes of the prevention, investigation, detection, or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
• The processing of personal data by EU institutions, bodies, offices and agencies.

Where Your Personal Information is Held

Information may be held at our offices and those of our affiliated companies, third-party agencies, service providers, representatives, and agents; any of which may be based outside the European Economic Area. For more information, including on how we safeguard your personal information when this occurs, see below: “Transferring your personal information out of the EEA.”

How Long Your Personal Information Will Be Kept

We will keep your personal information while you have an account with us or while we are providing products and/or services to you. Thereafter, we will keep your personal information for as long as is necessary:

• To respond to any questions, complaints, or claims made by you or on your behalf;
• To show that we treated you fairly;
• To keep records required by law.

We will not retain your personal information for longer than necessary for the purposes set out in this policy. Different retention periods may apply for different types of personal information.

Transferring Your Personal Information Out of the EEA

To deliver services to you, it is sometimes necessary for us to share your personal information outside the European Economic Area (EEA), for example:

• With our offices outside the EEA;
• With your and our service providers located outside the EEA;
• If you are based outside the EEA;

These transfers are subject to special rules under European and UK data protection law.

If you would like further information, please contact us (see ‘How to contact us' below).

Rights of the Data Subject

As noted above, the GDPR provides for new and extended data subject rights. These are set out in Chapter 3 of the GDPR, Regulation (EU) 2016/679, GDPR and they include:

• The right to be informed (Articles 13 and 14);
• The right of access (Article 15) is the right to be provided with a copy of your personal information;
• The right of rectification (Article 16) is the right to require us to correct any mistakes in your personal information;
• The right to erasure, also known as the "right to be forgotten" (Article 17) is the right to require us to delete your personal information—in certain situations;
• The right to restrict processing (Article 18) is the right to require us to restrict processing of your personal information—in certain circumstances, e.g. if you contest the accuracy of the data;
• The right to data portability (Article 20) is the right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations;
• The right to object (Article 21) —at any time to your personal information being processed for direct marketing (including profiling)—in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests;
• The right to not to be subject to automated individual decision-making (Article 22) is the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.

All of these rights are underpinned by Article 12 of the GDPR, which sets out general rules on transparency which are applicable to, among other things, the provision of information to data subjects and communications with data subjects concerning the exercise of their rights.

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner's Office (ICO) on individuals’ rights under the General Data Protection Regulation.

If you would like to exercise any of those rights, please:

• Email—see below: “How to contact us” –and–
• Let us have enough information to identify you (e.g., your full name, address and customer or matter reference number);
• Let us have proof of your identity and address (a copy of your driving license or passport and a recent utility or credit card bill);
• Let us know what right you want to exercise and the information to which your request relates.

EU -US Data Privacy Program Framework

Steve AI complies with the EU-U.S. Data Privacy program Framework (EU-U.S. DPF) and the Swiss-U.S. Data Privacy program Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Animaker has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework program Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF. Animaker has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework program Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/

Complaints:

In compliance with the EU-US Data Privacy Framework Principles, Steve AI commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union and Swiss individuals with DPF inquiries or complaints should first contact

Steve AI has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2