Hunnid Privacy Policy

Effective date: [PLACEHOLDER]

Operator: TKM Ventures LLC, doing business as Hunnid Mailing address: [PLACEHOLDER: mailing address] Privacy requests: privacy@hunnid.app Privacy request form: [PLACEHOLDER: URL of web form]

This Privacy Policy explains how Hunnid collects, uses, discloses, and protects personal information when you use the Platform, including the website at hunnid.app, the mobile web pages you reach by scanning a DJ's QR code, the Hunnid apps for iOS and Android, Fan and DJ accounts, the Booth Screen, and our communications. It also serves as our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"). Capitalized terms such as Fan, DJ, Gift, Booth Screen, Hype Score, Live Set, Connected Account, and Stripe have the meanings given in Section 2 of our Terms of Service.

1. Summary (Notice at Collection)

In short: we collect what we need to send Gifts, run the Booth Screen, pay DJs, prevent fraud, and show local rankings. We do not sell or share your personal information, and we do not run third-party advertising pixels.

• What we collect: identifiers (such as display name, email, IP address, device identifiers), limited payment metadata (not your full card number), Gift and account activity, approximate location (and precise location only if you opt in), device and fraud signals, content you submit (display names, messages, profile photos, bios), and, for DJs, business and tax-related information collected mostly by Stripe.
• Why: to process Gifts and payouts, run the Booth Screen and rankings, send receipts and notifications, prevent fraud, provide support, comply with law, and improve the Platform.
• Sold or shared? No. We do not sell personal information and we do not share it for cross-context behavioral advertising.
• Sensitive personal information: precise geolocation (only if you opt in) and account login credentials. We use sensitive personal information only for the purposes permitted without a right to limit under the CCPA regulations, such as providing the service you request and preventing fraud.
• How long: see the retention table in Section 3 and Section 12.
• Your rights: California residents can request to know, delete, and correct their information, and will not be discriminated against for doing so. See Section 9.

2. Who This Policy Covers

In short: it covers Fans (with or without an account), DJs, and anyone whose information appears on the Platform.

This policy covers:

• Guest Fans: people who scan a QR code and send a Gift without an account.
• Fans with accounts: people who create an optional Fan account.
• DJs: performers with DJ accounts and Stripe Connected Accounts.
• Visitors: anyone who browses the Platform, views a Booth Screen, or receives our emails.

It does not cover Stripe's independent processing of your payment or identity information (see Section 4), a DJ's use of information you choose to share with them (see Section 7.4), or Venues.

3. What We Collect, From Where, Why, and For How Long

In short: the table below is our CCPA notice at collection. Retention periods are our targets; we keep some records longer when the law or a dispute requires it.

We do not collect Social Security numbers, biometric information, health information, racial or ethnic origin, religious beliefs, sexual orientation, or contents of private mail, and we do not knowingly collect information from anyone under 18.

4. Payments: Stripe Handles Card Data

In short: Stripe collects your payment details directly. We receive only limited payment metadata.

4.1 When you pay for a Gift, your card or wallet details are entered into a payment form served by Stripe and are sent directly to Stripe. Stripe processes them under its own privacy policy (https://stripe.com/privacy) and, for some purposes such as fraud prevention across its network and legal compliance, Stripe acts as an independent business rather than as our service provider. Apple Pay and Google Pay are provided by Apple and Google under their own policies.

4.2 If you choose to save your payment details with Stripe Link, Link is a Stripe service, and your information is stored by Stripe, not by us.

4.3 We receive limited payment metadata (card brand, last four digits, expiration date, payment method type, billing postal code if provided, Stripe identifiers, and payment outcome), which we use to process Gifts, refunds, and disputes and to prevent fraud.

4.4 For DJs: when you provide personal data in connection with Hunnid's Stripe onboarding or your Connected Account, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy (https://stripe.com/privacy). Stripe performs identity verification and know-your-customer checks and collects your legal name, date of birth, address, tax identification number, bank account details, and, where requested, government identification. We receive verification status, payout status, and limited profile information, and we may receive your tax identification number for tax reporting if you provide it through Stripe's tax forms tool.

5. How We Use Personal Information

In short: to run the Platform, pay DJs, prevent fraud, and comply with the law. Not to build advertising profiles.

We use personal information for these business purposes:

(a) Providing the Platform: processing Gifts, running the Booth Screen, showing profiles and Live Sets, computing Hype Scores and rankings, showing local DJs, and maintaining accounts. (b) Payments and payouts: working with Stripe to charge Fans, credit DJs' shares of Gift Amounts to their Connected Accounts, process DJ withdrawals, process refunds and disputes, and manage holds and reserves. (c) Receipts and communications: sending receipts, account and security notices, policy updates, Live Set notifications you request, and marketing emails you opt in to. (d) Fraud prevention and security: detecting self-gifting, bots, stolen cards, rank manipulation, and abuse; protecting the Platform and users; enforcing our Terms, DJ Agreement, and Community Guidelines. (e) Moderation: filtering and reviewing display names and messages. (f) Support: responding to your questions, refund requests, and privacy requests. (g) Legal compliance: tax information reporting, responding to lawful requests, maintaining records, and meeting card network and Stripe requirements. (h) Improving the Platform: debugging, analyzing usage in aggregate, testing features, and developing new ones. (i) Business operations: accounting, audits, and, if it happens, a merger or sale (see Section 7.6).

We do not use personal information to build profiles for targeted advertising, and we do not use automated decision-making that produces legal or similarly significant effects about you, other than fraud screening that may block or delay a Gift or payout (you can contact support@hunnid.app to have a person review any such decision).

6. Public Display Information

In short: your display name, Gift, and message are shown publicly, including on screens at the Venue. Choose them accordingly.

6.1 When you send a Gift, the Gift, your display name (or "Anonymous," where that option is available), your message, and any song request or shoutout may appear on the Booth Screen at the Venue, on the DJ's profile, and in leaderboards such as "Top Supporters tonight." The Booth Screen is in a public place and may be photographed, filmed, or streamed by the Venue, the DJ, or other people. We cannot control what others do with what they see.

6.2 We never publicly display your legal name, email address, payment details, precise location, or a DJ's earnings.

6.3 If you have a Fan account you can change your display name at any time, and you can ask us at privacy@hunnid.app to remove or anonymize your display name from past Gifts on the Platform.

7. How We Disclose Personal Information

In short: to service providers who work for us, to Stripe, to a DJ only when you direct it, and when the law requires. Never for sale or advertising.

7.1 Service providers. We disclose personal information to companies that process it on our behalf under contracts that restrict their use to our instructions, including: Stripe (payments and payouts, also acting independently as described in Section 4); cloud hosting and database providers; email delivery providers; first-party analytics tooling [PLACEHOLDER: name provider or "self-hosted"]; IP geolocation services; content moderation tooling; customer support tooling; and tax reporting tools. Current providers: [PLACEHOLDER: list; known at drafting: Stripe (payments and payouts), Supabase (database and authentication), Vercel (hosting), Resend (email delivery), Expo / 650 Industries, Inc. (app push notification delivery and app updates); Airwallex pays DJs in Korea (Section 19)]. App notifications are relayed to your device by Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging), which receive the notification's content and your device's token.

7.2 DJs. DJs see the display names, messages, Gift tiers, and aggregate statistics associated with Gifts sent to them. A DJ receives your email address only if you opt in to share it with that DJ (see Section 7.4).

7.3 Venues and the public. Booth Screen content (display names, messages, Gifts, leaderboards) is displayed publicly at the Venue and on the DJ's profile, as described in Section 6.

7.4 Email sharing at your direction. If you have a Fan account and follow a DJ, you can turn on email sharing for that DJ. When you do, we disclose your email address and display name to that DJ so they can contact you about their gigs and music. This disclosure is made at your direction and is not a sale. The DJ is an independent business responsible for its own use of your email address; our DJ Agreement requires DJs to use it only for their own communications with you, to honor unsubscribes, and not to sell it. You can turn sharing off at any time in your account settings, which stops future disclosures; to have the DJ delete your address, contact the DJ directly (we will also notify the DJ when you withdraw).

7.5 Legal, safety, and enforcement. We disclose personal information when we believe it is necessary to comply with law, regulation, legal process, or a governmental request; to enforce our Terms, DJ Agreement, and Community Guidelines; to respond to fraud, security, or technical issues; to respond to chargebacks and disputes (for example providing Stripe and card networks with evidence of your Gift authorization); or to protect the rights, property, or safety of Hunnid, our users, Venues, or the public.

7.6 Business transfers. If Hunnid is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy or a successor policy with notice to you.

7.7 Aggregated or de-identified information. We may disclose aggregated or de-identified information (for example the number of Gifts sent in a city) that cannot reasonably be linked to you. We will not attempt to re-identify de-identified information.

7.8 Categories disclosed in the past 12 months. For business purposes, we have disclosed (or, at launch, expect to disclose) identifiers, personal information under § 1798.80(e), commercial information, payment metadata, internet activity, geolocation data, audio and visual information, professional information, inferences, and User Content to the categories of recipients above. We have not sold or shared any category of personal information.

8. No Sale or Sharing; Sensitive Information; Signals

In short: we do not sell or share your information, we do not use ad pixels, we honor Global Privacy Control, and we use sensitive information only as permitted without a "limit" right.

8.1 No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in Cal. Civ. Code § 1798.140. We have not done so in the preceding 12 months. We have no actual knowledge that we sell or share the personal information of anyone under 16. Because we do not sell or share, we do not offer a "Do Not Sell or Share My Personal Information" link. If we ever change this practice, we will update this policy, post the required link, and honor opt-out requests.

8.2 No third-party advertising trackers. At launch we do not use Meta, Google, TikTok, or other third-party advertising pixels or SDKs. We use privacy-friendly first-party analytics [PLACEHOLDER: name tool] that does not track you across other sites.

8.3 Opt-out preference signals and Do Not Track. We honor the Global Privacy Control (GPC) signal as a request to opt out of sale and sharing; since we do not sell or share, honoring it has no additional effect, but we record it. We respond to browser "Do Not Track" signals the same way. Our practices do not change based on these signals because we already do not sell, share, or track you across sites.

8.4 Sensitive personal information. The only sensitive personal information we process is precise geolocation (only if you opt in) and account login credentials. We use it solely for purposes for which the CCPA regulations (Cal. Code Regs. tit. 11, § 7027(m)) do not require a right to limit: to provide the service you request (local results and Live Set association), to prevent fraud and ensure security, to verify and maintain the quality of the Platform, and for short-term transient use. We do not use it to infer characteristics about you. Because of this, we do not offer a "Limit the Use of My Sensitive Personal Information" link.

8.5 No financial incentives. We do not offer financial incentives or price or service differences in exchange for personal information.

9. Your California Privacy Rights

In short: you can ask what we have, ask us to delete or correct it, and use an authorized agent. We will not treat you differently for asking.

If you are a California resident, you have these rights under the CCPA, subject to exceptions in the law:

9.1 Right to know. You can request the categories and specific pieces of personal information we have collected about you, the categories of sources, our purposes, and the categories of third parties to whom we disclosed it.

9.2 Right to delete. You can request that we delete personal information we collected from you. We may keep information where the law allows, for example to complete a transaction, detect fraud, comply with legal obligations (such as tax records), or exercise legal rights. Gift transaction records are kept for tax and dispute purposes even after deletion of an account.

9.3 Right to correct. You can request that we correct inaccurate personal information. Account holders can correct most information directly in settings.

9.4 Right to opt out of sale or sharing and right to limit. We do not sell or share personal information and do not use sensitive personal information beyond permitted purposes, so there is nothing to opt out of or limit. If that changes, we will provide the required links.

9.5 Right to non-discrimination. We will not deny you service, charge different prices, or provide a different level of service because you exercised your rights.

9.6 How to submit a request. Because we operate exclusively online and have a direct relationship with you, you may submit requests by email to privacy@hunnid.app or through our web form at [PLACEHOLDER: URL]. Account holders can also use the privacy tools in account settings.

9.7 Verification. We will verify your identity before responding. For account holders, we may ask you to confirm through your logged-in account or account email. For guests, we may ask for information matching our records, such as the email address on your Gift receipt, the approximate date and amount of a Gift, and the last four digits of the card used. We will not ask for your full card number. If we cannot verify you, we will tell you and may deny the request or provide only category-level information.

9.8 Authorized agents. You may use an authorized agent to submit a request. We will ask the agent for signed written permission from you or a power of attorney, and we may ask you to verify your identity directly with us or confirm that you gave the agent permission, except where the agent holds a valid power of attorney. We will not require you to resubmit the request yourself.

9.9 Timing. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to 45 additional days), we will tell you why. We provide responses free of charge unless requests are manifestly unfounded or excessive.

9.10 Appeals and complaints. If we deny your request, you can ask us to reconsider by replying to our response. You may also contact the California Privacy Protection Agency or the California Attorney General.

9.11 Scope note. The CCPA applies to businesses that meet certain thresholds (for example annual gross revenues above the inflation-adjusted amount, which is $26,625,000 as of January 1, 2025, or handling personal information of 100,000 or more consumers). We honor the rights described in this Section 9 for all California residents regardless of whether we currently meet those thresholds.

10. Other U.S. State Privacy Rights

In short: residents of other states with privacy laws can use the same request methods.

If you live in a state with a comprehensive consumer privacy law (for example Colorado, Connecticut, Oregon, Texas, or Virginia) and that law applies to us, you may have rights to access, delete, correct, and obtain a portable copy of your personal information, and to opt out of targeted advertising, sales, and certain profiling. We do not engage in targeted advertising, sales, or profiling that produces legal or similarly significant effects. You can exercise your rights using the methods in Section 9.6, and you may appeal a denial by replying to our response; if we uphold the denial, we will tell you how to contact your state attorney general.

11. California "Shine the Light"

In short: we do not disclose your personal information to third parties for their own direct marketing.

California Civil Code § 1798.83 lets California residents ask certain businesses whether they disclosed personal information to third parties for the third parties' direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing. Disclosures to a DJ at your direction under Section 7.4 are made at your request. You may confirm this by emailing privacy@hunnid.app with "Shine the Light" in the subject line.

12. Retention

In short: we keep information only as long as needed for the purposes above, then delete or anonymize it.

Our retention periods are in the table in Section 3. In general: Gift transaction and tax records are kept for [PLACEHOLDER: 7] years; account information is kept while your account is active and deleted or anonymized within [PLACEHOLDER: 90] days after you close it, except for records we must keep; raw server logs are kept about [PLACEHOLDER: 90] days; fraud and enforcement records are kept [PLACEHOLDER: 3] years or longer if needed for an investigation, dispute, or legal claim; and records of privacy requests are kept at least 24 months. When retention ends we delete or de-identify the information.

13. Security

In short: we use reasonable safeguards, Stripe handles card data, and we will notify you of breaches as the law requires.

We use reasonable administrative, technical, and physical safeguards appropriate to the nature of the information, including encryption in transit, encrypted storage for sensitive fields, access controls, logging, and the use of Stripe so that card data never touches our systems. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information in a way that triggers notification obligations (for example under Cal. Civ. Code § 1798.82), we will notify you and regulators as the law requires. Please use a unique password and keep your email account secure.

14. Children

In short: the Platform is for adults. We do not knowingly collect information from anyone under 18.

The Platform is not directed to anyone under 18, and you must be 18 or older to create an account or send a Gift (19 or older in Korea; see Section 19). We do not knowingly collect personal information from anyone under 18, and we have no actual knowledge of selling or sharing personal information of consumers under 16. If you believe a minor has provided us personal information, contact privacy@hunnid.app and we will delete it.

15. International Users

In short: we operate from the United States and the Platform is intended for U.S. use.

We are based in California and store and process information in the United States. The Platform is intended for use in the United States. If you use it from another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live. If you are in the European Economic Area, the United Kingdom, or another jurisdiction with data protection laws that apply to us, you may have additional rights (such as access, rectification, erasure, restriction, portability, and objection), which you can exercise using the contact details below, and you may lodge a complaint with your local supervisory authority. Our legal bases for processing in those jurisdictions are performance of our contract with you, our legitimate interests in operating and securing the Platform, compliance with legal obligations, and your consent where we ask for it (for example precise location and email sharing). Users in Korea are covered by our Korean-language Privacy Policy instead (Section 19).

16. Cookies and Similar Technologies

In short: we use essential cookies and first-party analytics only.

We use cookies and similar technologies that are necessary to operate the Platform (for example to keep you logged in, remember your display name, complete a Gift, and prevent fraud) and first-party analytics cookies or identifiers that measure how the Platform is used [PLACEHOLDER: describe tool and whether cookieless]. Stripe sets cookies in its payment form for fraud prevention under its own policy. We do not use third-party advertising cookies. You can control cookies in your browser settings; disabling essential cookies may prevent you from sending Gifts.

16.1 The Hunnid app and notifications

If you use the Hunnid app for iOS or Android:

(a) Push notifications. If you allow notifications, your device gives us a push token. We store it with your device type, app language, and (for DJs) your DJ account, and use it only to send the alerts you asked for: Gift alerts for DJs, and "now live" alerts for DJs a Fan follows. Notification text can include a Fan's display name, the Gift tier, the DJ's earnings from that Gift, and a short message, so it may appear on your lock screen. You can turn notifications off at any time in your device settings or in the app; the token is deleted when it stops working or when you delete your account.

(b) Follows. Follows you make in the app are saved on your device. If you allow notifications, we also store them on our servers with your push token, so we can tell you when that DJ goes live. Unfollowing removes them.

(c) App updates and diagnostics. The app downloads updates from Expo's update service, which receives your device type, app version, and IP address to deliver them. We do not use advertising identifiers, and the app does not track you across other companies' apps or websites.

(d) Camera. The app uses your camera only to scan QR codes, when you open the scanner. Images are processed on your device and are not sent to us.

17. Changes to This Policy

In short: we will tell you when this policy changes materially.

We may update this policy from time to time. We will post the updated policy with a new effective date and, for material changes, give notice by email to account holders or a notice on the Platform at least 30 days before the change takes effect where practicable. We will not use previously collected personal information in materially new ways without notice and, where the law requires, your consent.

18. Contact Us

Privacy requests and questions: privacy@hunnid.app Web form: [PLACEHOLDER: URL] Support: support@hunnid.app Mail: TKM Ventures LLC, doing business as Hunnid, Attn: Privacy, [PLACEHOLDER: mailing address]

If you have a disability and need this policy in an alternative format, contact privacy@hunnid.app.

19. Users in Korea

In short: if you buy Korean Gifts, are a DJ in Korea, or otherwise use Hunnid in Korea, our Korean-language Privacy Policy (개인정보처리방침) applies instead of this one.

19.1 Which policy applies. For Fans who buy Gifts priced in Korean won, DJs whose region is Korea, and anyone else using the Platform in Korea, we handle personal information under Korea's Personal Information Protection Act as described in our Korean-language Privacy Policy (legal/ko/privacy-policy.md), which controls for those users.

19.2 Main differences. In summary (the Korean policy controls):

(a) Users in Korea must be 19 or older.

(b) We never collect Korean resident registration numbers. DJs in Korea complete a tax certification with their legal name, country of citizenship, permanent address, date of birth, and signature, and give us bank account details for payouts.

(c) DJ payouts in Korea are made through Airwallex (and its affiliates), which receives DJ bank details in the countries where Airwallex operates, including Australia, Singapore, and the United States.

(d) The Korean policy discloses, for each processor that receives data outside Korea (Supabase, Vercel, Stripe, Airwallex, and Resend), the items transferred, the country, the recipient and its contact, the timing and method of transfer, the purpose, the retention period, and how to refuse the transfer and what refusing means.

(e) Retention follows Korean law where it applies: 5 years for contract and payment records, 3 years for consumer complaint and dispute records, and 6 months for advertising records under Korea's e-commerce consumer protection law, and 3 months for website access logs under Korea's Protection of Communications Secrets Act.

(f) Before a Fan's nickname, message, or song request is passed to the DJ and shown publicly, we ask for separate consent; a Fan who declines can still send an anonymous Gift without a message.

(g) We do not collect precise device location from users in Korea.

(h) Our privacy officer is Jay An (privacy@hunnid.app). Users in Korea can also contact Korea's Personal Information Dispute Mediation Committee or the Personal Information Infringement Report Center (118), and we will designate a domestic representative in Korea when the law requires it.