BOLD ACTIVE INC. — PRIVACY POLICY

Effective Date: August 14, 2026

This Privacy Policy ("Policy") describes how Bold Active Inc., a Delaware corporation doing business as Boldbooty, with a registered address at 2810 N Church St #616247, Wilmington, DE 19802 ("Bold Active," "Boldbooty," "we," "us," or "our"), collects, uses, shares, and protects information across our website, mobile experiences, and related services (collectively, the "Services"). This Policy also applies to any current or future brand, product, or project owned or operated by Bold Active Inc. (each an "Affiliated Brand," and collectively the "Affiliated Brands").

By using any Service, creating an account, subscribing to email or SMS communications, or otherwise providing information to us, you agree to the collection, use, and sharing practices described in this Policy.

1. Who This Policy Covers

This is a single, shared Privacy Policy that applies across Boldbooty and any Affiliated Brand owned or operated by Bold Active Inc. Wherever this Policy refers to "we," "us," or "our," it means Bold Active Inc. and any of its current or future subsidiaries or Affiliated Brands, unless a specific brand publishes a separate supplemental notice for a practice unique to that brand.

Common ownership vs. commonly managed brands. Bold Active Inc. also works closely with, and shares marketing and operational resources with, a group of separately owned consumer brands (including Closed on Sunday, AlphaOmega, Goosebumps, and Wilson Avenue) that are operated under a distinct holding structure and are not owned by Bold Active Inc. Where this Policy refers to information being shared with those brands, it means shared under a data-sharing and marketing services arrangement between separately owned companies under common management, not that Bold Active Inc. owns or legally controls those brands. We disclose this relationship, and your related choices, in Section 4 below.

We may launch new Affiliated Brands after the Effective Date above. This Policy is written to apply to those future brands automatically, without requiring you to opt in again, provided the new brand's data practices are consistent with what is disclosed here. If a future brand's practices materially differ from this Policy, we will update this Policy and provide notice as described in Section 13.

2. Information We Collect

2.1 Information You Provide Directly

• Contact information: name, email address, mobile phone number, mailing address
• Account credentials and profile information, if you create an account
• Order and payment information when you make a purchase (processed via our payment processor; we do not store full payment card numbers)
• Communications you send to us, including through email, our contact form, or social media, and any customer support requests or survey responses
• Entries you submit for sweepstakes, contests, or giveaways we run, including on Instagram, and any information you provide after clicking through an automated Instagram direct message sent in response to your comment, as described in Section 2.4. Where required by law, we may be obligated to publicly disclose the identity of winners
• Information you provide if you apply for a job with us, or contact us about a business or partnership opportunity

2.2 Information Collected Automatically

• Device and usage data: IP address, device identifiers, browser type, operating system, pages viewed, referring URLs, and time spent on pages
• Cookies and similar tracking technologies used on our website, described in detail in Section 2.3 below

2.3 Cookies, Pixels, and Advertising Technologies

Our website uses the following third-party tracking technologies. Each is described below along with the type of information it collects and how it is used:

• Meta Pixel (Facebook/Instagram): collects browsing behavior, page views, and purchase events on our website, and may match this activity to your Facebook or Instagram account using hashed identifiers (such as a hashed email address), in order to measure ad performance and show you relevant Meta ads.
• TikTok Pixel: collects browsing behavior and purchase events on our website, and may match this activity to your TikTok account using hashed identifiers, in order to measure ad performance and show you relevant TikTok ads. This is used in connection with both our website and our TikTok Shop channel.
• Google Analytics: collects browsing behavior, session data, and device/browser information to help us understand site traffic and usage patterns, and may be used with Google Ads for conversion tracking and remarketing.

These tools may set cookies, collect device identifiers, and receive hashed versions of information you provide to us (such as your email address) so that Meta, TikTok, and Google can match your website activity to your accounts on their platforms for advertising purposes. This sharing is described further, including your opt-out rights, in Section 8.

Collectively, the information described in this Section 2 is referred to as "Customer Metadata."

2.4 Instagram Sweepstakes and Automated Direct Messages

When we run a sweepstakes, contest, or giveaway on Instagram, we may use a third-party Instagram direct message automation platform to automatically send a direct message ("DM") to anyone who comments on the relevant post. This automated DM contains a link inviting you to enter the sweepstakes by providing your email address and/or mobile phone number; no information is collected from your Instagram account itself without you clicking through and separately providing it. Any such tool connects to Instagram through Meta's official API and does not require or use your Instagram password.

If you click through and submit your information, the data flows as follows:

• Your email address and/or mobile phone number, and your sweepstakes entry, are captured and stored in Klaviyo, our marketing platform described in Section 3.
• If you provided a mobile phone number and separately opted in to SMS, that opt-in and number are synced to Postscript, our SMS platform described in Section 3, for delivery of any SMS communications you've consented to receive.

Commenting on the Instagram post alone does not opt you into email or SMS marketing. Only information you affirmatively submit after clicking through the automated DM link is captured, and SMS consent specifically requires the separate opt-in described in Section 6.

Any such automation tool functions solely as a delivery mechanism for the DM itself and the link it contains; it is not used to scrape or collect your Instagram profile information for our marketing lists.

3. How We Use Your Information

We use Klaviyo, a third-party marketing platform, to capture and store your contact information, including your email address and mobile phone number, along with related activity data (such as email opens, clicks, and purchase history) used to personalize communications and measure campaign performance. We use Postscript, a third-party SMS platform, to send SMS marketing messages; Postscript receives your mobile phone number and relevant opt-in and messaging activity data from Klaviyo or directly at the point of SMS opt-in, in order to deliver text messages on our behalf.

We use Customer Metadata, including your email address and mobile phone number, for purposes including:

• Operating, maintaining, and improving the Services
• Processing orders, payments, shipping, and returns
• Providing customer support
• Personalizing your experience, including product recommendations
• Sending transactional communications (order confirmations, shipping updates, account notices)
• Sending marketing and promotional communications by email and SMS, as described in Section 4
• Analytics, product development, and business planning
• Developing, training, and fine-tuning automation tools and features used to operate, personalize, and improve the Services, such as marketing personalization and customer support automation
• Administering sweepstakes, contests, or giveaways you enter, including verifying eligibility and, where legally required, publicly identifying winners
• Reviewing job applications, if you apply for a position with us
• Fraud prevention, security, and legal compliance

4. Use of Data Across Affiliated Brands and Commonly Managed Brands

A feature of this Policy is that your Customer Metadata, including your email address, mobile phone number, and purchase or behavioral metadata, may be used and shared for marketing purposes across:

• Bold Active Inc. and any current or future Affiliated Brand it owns or operates, and
• Separately owned, commonly managed brands, including Sigmas, AO Run and Signal, under a marketing and data-sharing arrangement between those companies, as described in Section 1.

This means, for example, that if you sign up with Boldbooty, we may also use your contact information to communicate with you about other Affiliated Brand or commonly managed brand products, launches, or projects, subject to the consent and opt-out mechanisms described below.

We rely on the following safeguards to make this sharing lawful and transparent:

• At the point of signup, you will be presented with clear disclosure that your information may be used across Affiliated Brands and commonly managed brands, not solely the brand through which you signed up.
• For email marketing, you may unsubscribe at any time using the unsubscribe link included in every marketing email. Unsubscribing from one brand's list will, at minimum, stop that brand's marketing emails; we will also provide a global preference option to opt out of all related-brand marketing where technically available.
• For SMS marketing, we will only send marketing text messages to numbers that have provided express written consent, captured through an unchecked, opt-in checkbox or equivalent affirmative action at signup, separate from any consent to email marketing.
• SMS opt-in consent is not shared as a condition of purchase, and is not required to use the Services.

5. Information from Third-Party Sources

We may receive information about you from:

• Our e-commerce and fulfillment platform (Shopify), related to your orders and shipping, and the Shopify Enhanced Services described in Section 8.2
• TikTok Shop, if you purchase through that channel
• The analytics and advertising partners described in Section 2.3

6. SMS / Text Messaging Terms

SMS marketing consent is collected separately from any other consent or signup on our Services (such as email signup, account creation, or checkout). Checking a box or submitting a form for one does not opt you into the other. Where you affirmatively opt in to receive SMS messages from us:

• You will receive messages related to your account, orders, and, if you separately opt in, marketing messages from Bold Active Inc. and, where disclosed at opt-in, other Affiliated Brands or commonly managed brands.
• Message and data rates may apply. Message frequency varies.
• You may reply STOP at any time to opt out of SMS messages, and HELP for assistance.
• Consent to receive SMS messages is not shared, sold, or used for purposes other than those disclosed at the time of opt-in, and will not be used to send marketing messages on behalf of unrelated third parties.
• We do not share your text messaging opt-in status or consent records with third parties, other than the SMS platform we use to deliver messages on our behalf.

Our SMS program is administered through Postscript, our third-party SMS platform, under a registered messaging campaign. If you have questions about our SMS practices, contact us using the information in Section 16.

7. How We Share Information

Beyond sharing among Affiliated Brands and commonly managed brands described in Section 4, we may share Customer Metadata with:

• Service providers who perform functions on our behalf, including payment processing, order fulfillment, shipping, analytics, and app infrastructure. Service providers we currently use include Klaviyo (capturing and storing contact information and email marketing), Postscript (SMS message delivery), any Instagram DM automation platform used for sweepstakes/giveaways as described in Section 2.4, and Shopify (order processing and, where applicable, the Shopify-enabled analytics, product recommendation, and advertising features described in Section 8.2)
• Advertising partners, including Meta, TikTok, and Google, as described in Section 2.3
• Professional advisors, including legal, accounting, and financial advisors
• Regulators, law enforcement, or other parties where required by law or to protect our rights, property, or safety, or that of our users
• A successor entity in connection with a merger, acquisition, financing, or sale of assets

We do not sell your personal information to unaffiliated third parties for their own independent marketing purposes outside the relationships described above.

8. Your Choices and Rights

• Email: unsubscribe via the link in any marketing email
• SMS: reply STOP to any marketing text
• Account information: update or request deletion of your account information by contacting us

Depending on your state or country of residence, you may have additional rights to access, correct, delete, or restrict processing of your personal information, or to opt out of certain sharing. Where applicable law (such as the California Consumer Privacy Act) grants these rights, we will honor verified requests submitted using the contact information in Section 16.

8.1 "Sale" and "Sharing" of Information Under State Privacy Laws

Our use of the Meta Pixel, TikTok Pixel, and Google Analytics, described in Section 2.3, involves sharing hashed identifiers and browsing/purchase activity with Meta, TikTok, and Google for purposes of advertising measurement and, in some cases, ad targeting. Under the California Consumer Privacy Act and similar laws in other states, this type of sharing may be considered a "sale" or "sharing" of personal information, even though we do not receive money in exchange for it.

You have the right to opt out of this sharing. You may do so by:

• Using the cookie preference tool available on our website (where implemented) to disable advertising cookies
• Adjusting your browser or device settings to block third-party cookies and tracking
• Using platform-level controls, such as Meta's, TikTok's, or Google's own ad settings, to limit ad personalization
• Enabling a recognized Opt-Out Preference Signal, such as the Global Privacy Control (GPC), in a supported browser. Where legally required to do so, we will treat a detected GPC signal from your browser as a valid request to opt out of the sale or sharing of your personal information for that browser or device
• Contacting us using the information in Section 16 to submit an opt-out request, which we will honor within the timeframe required by applicable law

Because the Services are not directed to and are not intended for use by individuals under 18, as described in Section 11, we do not knowingly sell or share the personal information of individuals we know to be under 18 years of age.

8.2 Shopify Enhanced Services

We use Shopify to power our online store. In addition to processing checkout and order information, Shopify may provide us with enhanced features that use your personal information for purposes such as store customization, analytics, product recommendations, and advertising services drawn from your interactions with our Services, other Shopify merchants, and Shopify itself ("Shopify Enhanced Services"). Your personal information may be shared with Shopify, and with third parties Shopify works with, in connection with these features, including parties located outside your country.

In some jurisdictions, use of the Shopify Enhanced Services may be considered "sharing" for "cross-context behavioral advertising" or "targeted advertising" under applicable privacy laws. To opt out of these activities, or to otherwise exercise your privacy rights in connection with the Shopify Enhanced Services, you may visit Shopify's privacy portal, or contact us using the information in Section 16.

8.3 "Do Not Track" Signals

Some browsers offer a "Do Not Track" (DNT) setting. Our Services do not currently respond to or honor DNT signals.

8.4 Automated Decision-Making

As described in Section 3, we use automated tools to personalize communications and recommend products. Where these tools produce automated decisions that have a legally or similarly significant effect on you, applicable law may give you the right to obtain human review, express your point of view, or contest the decision. You may exercise these rights by contacting us using the information in Section 16.

8.5 Notice at Collection

At or before the point we collect personal information from you directly, such as through a signup form, checkout page, or account creation screen, we intend to provide a short-form notice identifying the categories of personal information collected at that point and the purpose(s) for which it will be used, consistent with applicable law. This Policy serves as the comprehensive privacy notice for the Services; where a shorter point-of-collection notice is displayed, it supplements, and does not replace, this Policy.

9. Jurisdiction-Specific Privacy Rights

This Section describes additional rights that may apply to you depending on where you are located. Where a regional law described below requires a stricter standard of consent than the general opt-out model described elsewhere in this Policy (for example, opt-in consent for marketing or advertising cookies), we apply that stricter standard to users in that region. This Section is a general summary for informational purposes and does not constitute legal advice; where local law provides greater rights than described here, local law controls.

9.1 United States

Depending on your state of residence, you may have rights under state privacy laws including the California Consumer Privacy Act (CCPA/CPRA), and comparable laws in Virginia, Colorado, Connecticut, Utah, Oregon, Texas, and other states with similar statutes. These rights generally include the right to know what personal information we collect, to request deletion, to correct inaccurate information, to opt out of the "sale" or "sharing" of personal information (including for cross-context behavioral advertising, as described in Section 8.1), and to not be discriminated against for exercising these rights. Requests can be submitted using the contact information in Section 16.

9.2 Canada

If you are located in Canada, our processing of your personal information is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation. You have the right to access your personal information, request correction of inaccuracies, and withdraw consent for collection, use, or disclosure, subject to legal or contractual restrictions. Canada's Anti-Spam Legislation (CASL) governs our commercial electronic messages to Canadian residents; we obtain consent as required and provide a functional unsubscribe mechanism in every message.

9.3 European Union and European Economic Area

If you are located in the EU/EEA, we process your personal data in accordance with the General Data Protection Regulation (GDPR). Our lawful bases for processing include your consent, performance of a contract with you, our legitimate interests (such as improving the Services), and compliance with legal obligations, as applicable to each processing activity. For EU/EEA users, we obtain your affirmative opt-in consent before placing non-essential cookies (including the Meta Pixel, TikTok Pixel, and Google Analytics described in Section 2.3) or sending marketing communications, rather than relying on an opt-out model.

You have the right to access, correct, delete, or restrict processing of your personal data, to data portability, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your local data protection authority. Where we transfer personal data from the EU/EEA to the United States, we rely on appropriate safeguards such as Standard Contractual Clauses.

9.4 United Kingdom

If you are located in the UK, we process your personal data in accordance with the UK GDPR and the Data Protection Act 2018, which provide substantially similar rights to those described in Section 9.3 above. You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

9.5 Australia and New Zealand

If you are located in Australia, our handling of your personal information is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are located in New Zealand, our handling of your personal information is subject to the Privacy Act 2020. In both cases, you have the right to access and request correction of your personal information, and to complain to the relevant regulator (the Office of the Australian Information Commissioner, or New Zealand's Office of the Privacy Commissioner) if you believe we have mishandled your information.

9.6 Brazil

If you are located in Brazil, our handling of your personal data is subject to the Lei Geral de Proteção de Dados (LGPD). Our lawful bases for processing mirror those described for the EU/EEA in Section 9.3, and for Brazilian users we likewise obtain affirmative opt-in consent before placing non-essential cookies or sending marketing communications. You have the right to confirm the existence of processing, access your data, correct incomplete or inaccurate data, request anonymization, blocking, or deletion of unnecessary data, request data portability, and revoke consent. You may also lodge a complaint with Brazil's Autoridade Nacional de Proteção de Dados (ANPD).

9.7 Mexico

If you are located in Mexico, our handling of your personal data is subject to the Ley Federal de Protección de Datos Personales en Posesión de los Particulares. You have the right to access, rectify, cancel, or object to the processing of your personal data (collectively known as ARCO rights), and to withdraw consent at any time. Requests can be submitted using the contact information in Section 16, and you may also file a complaint with Mexico's Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) or its successor authority.

9.8 Other Jurisdictions

If you are located in a jurisdiction not specifically addressed above, we will honor privacy rights required under the law applicable to you to the extent required by that law. Contact us using the information in Section 16 with any request, and we will respond consistent with applicable legal requirements.

10. Data Retention and Security

We retain Customer Metadata for as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. We use commercially reasonable technical and organizational safeguards to protect your information, but no method of transmission or storage is completely secure.

11. Age Requirements and Children's Privacy

The Services are not directed to, and are not intended for use by, individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you are under 18, do not use the Services, create an account, or provide any personal information to us. If we learn that we have collected personal information from someone under 18, we will delete that information and, where applicable, terminate the associated account.

If you are a parent or guardian and believe your child under 18 has provided us with personal information, please contact us using the information in Section 16.

12. Biometric Data

Some jurisdictions, including Illinois (the Biometric Information Privacy Act), Texas, and Washington, have specific laws governing "biometric identifiers" or "biometric information," such as fingerprints, retina or iris scans, voiceprints, or scans of hand or face geometry. We do not currently collect biometric identifiers or biometric information as defined under these laws. If this changes in the future, we will update this Policy before doing so, and, where required by law, obtain your prior written consent and provide the additional disclosures required under applicable biometric privacy laws.

13. Changes to This Policy

We may update this Policy from time to time, including to reflect new Affiliated Brands, new commonly managed brand relationships, new data practices, or changes in law. We will post the updated Policy with a new Effective Date, and where changes are material, we will provide additional notice such as an email or on-site notification.

14. International Users and Cross-Border Data Transfers

The Services are operated from the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required by the laws described in Section 9 (including the GDPR, UK GDPR, and LGPD), we implement appropriate safeguards for these cross-border transfers, such as Standard Contractual Clauses or equivalent mechanisms recognized under applicable law.

15. California Shine the Light

California residents may request information once per calendar year regarding our disclosure of certain categories of personal information to third parties for their own direct marketing purposes, if any, under California Civil Code Section 1798.83. To make such a request, contact us using the information in Section 16.

16. Contact Us

Questions about this Policy or our data practices, or requests to exercise any of the rights described in Section 9, can be directed to:

Bold Active Inc. 2810 N Church St #616247 Wilmington, DE 19802 Email: privacy@boldbooty.com