California Consumer Notice

1. Notice to California Residents

Upmos Inc. (“Upmos,” “we,” “us,” or “our”) is a Delaware corporation (registered office c/o Republic Registered Agent LLC, 262 Chapman Rd Ste 240, Newark, DE 19702, New Castle County), with its principal place of business at 9896 Bissonnet St, Houston, TX 77036, United States. We operate an e-commerce marketplace at upmos.com.

This California Consumer Notice is provided pursuant to the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA). This notice supplements our general Privacy Policy and applies only to California residents.

Under California law, you have specific rights regarding the collection, use, disclosure, and sale of your personal information. This notice explains those rights and how to exercise them.

2. Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information from California consumers:

2.1. Identifiers

• Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers
• Examples: Your name, shipping address, email address, phone number, account username, IP address

2.2. California Customer Records (Cal. Civ. Code § 1798.80(e))

• Name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information
• Examples: Payment card information, billing address, purchase history

2.3. Protected Classification Characteristics

• Age (18 years or older), date of birth, citizenship status, marital status
• Examples: Date of birth for age verification, gender for product recommendations

2.4. Commercial Information

• Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
• Examples: Purchase history, shopping cart contents, product reviews, wish lists

2.5. Internet or Network Activity

• Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement
• Examples: Pages viewed, links clicked, time spent on site, device information, cookies

2.6. Geolocation Data

• Physical location or movements
• Examples: Approximate location based on IP address, precise location if you enable location services

2.7. Sensory Data

• Audio, electronic, visual, thermal, olfactory, or similar information
• Examples: Call recordings with customer service, profile photos

2.8. Professional or Employment-Related Information

• Current or past job history or performance evaluations
• Examples: Information provided in seller or vendor applications

2.9. Inferences

• Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes
• Examples: Product preferences, likelihood to purchase, customer segment classification

2.10. Biometric Information

• Physiological, biological, or behavioral characteristics used to establish identity (e.g., fingerprints, faceprints, voiceprints)
• Examples: Upmos does not directly collect or retain biometric information. Where identity verification involves biometrics, it is performed by third-party providers (e.g., ID.me) under their own privacy notices.

2.11. Education Information

• Information that is part of an education record governed by the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g)
• Examples: We do not collect education information.

3. Sources of Personal Information

We collect personal information from the following sources:

• Directly from you: When you create an account, make a purchase, contact customer support, or interact with our services
• Automatically: Through cookies, web beacons, and similar technologies when you use our website or mobile app
• Third-party sources: From identity verification services (ID.me, Wise), payment processors, advertising networks, social media platforms, data analytics providers, and business partners
• Third-party sellers: When you purchase from marketplace sellers on our platform
• Public sources: Publicly available databases and information you make publicly available

4. Purposes for Collecting Personal Information

We collect and use personal information for the following business and commercial purposes:

• Order Processing and Fulfillment: To process your orders, arrange shipping, handle returns and refunds
• Account Management: To create and manage your account, authenticate your identity, and provide customer support
• Payment Processing: To process payments, prevent fraud, and maintain transaction records
• Marketing and Communications: To send promotional offers, newsletters, and personalized recommendations (with your consent)
• Personalization: To customize your shopping experience and provide relevant product recommendations
• Analytics and Improvement: To analyze website usage, improve our services, and develop new features
• Security and Fraud Prevention: To detect, prevent, and respond to fraud, unauthorized access, and other illegal activities
• Loyalty Programs: To administer membership programs, including All Access (which encompasses Go memberships, Honors, Liberty, Double Up Fridays, and Cash Back Rewards)
• Legal Compliance: To comply with applicable laws, regulations, and legal processes
• Business Operations: To operate our marketplace, manage vendor relationships, and perform internal business operations

5. Disclosure of Personal Information

We may disclose your personal information to the following categories of third parties:

5.1. Service Providers

• Payment processors (Stripe, PayPal, Square)
• Shipping and fulfillment partners (USPS, FedEx, UPS, DHL)
• Cloud storage and hosting providers (Microsoft Azure, AWS)
• Email and communication services
• Customer relationship management (CRM) platforms
• Data analytics and marketing services

5.2. Identity Verification Partners

• ID.me (U.S. residents)
• Wise (international residents)

5.3. Advertising and Marketing Partners

• Google Ads, Facebook Ads, other advertising networks
• Affiliate marketing platforms
• Social media platforms

5.4. Third-Party Sellers

• Marketplace sellers to fulfill your orders

5.5. Business Partners

• Gift card providers and loyalty program partners
• Co-branded or joint marketing partners

5.6. Legal and Regulatory Authorities

• Law enforcement, government agencies, and courts when required by law

5.7. Business Transfers

• Potential buyers or investors in the event of a merger, acquisition, or sale of assets

6. Your CCPA/CPRA Rights

As a California resident, you have the following rights regarding your personal information:

6.1. Right to Know

You have the right to request that we disclose:

• The categories of personal information we have collected about you
• The categories of sources from which the personal information is collected
• Our business or commercial purpose for collecting, selling, or sharing personal information
• The categories of third parties to whom we disclose personal information
• The specific pieces of personal information we have collected about you

6.2. Right to Delete

You have the right to request that we delete your personal information, SUBJECT TO CERTAIN EXCEPTIONS under California law (e.g., to complete transactions, detect security incidents, comply with legal obligations).

6.3. Right to Correct

Under Cal. Civ. Code § 1798.106, you have the right to request that we correct inaccurate personal information we maintain about you.

6.4. Right to Opt-Out of Sale/Sharing

You have the right to opt out of the sale or sharing of your personal information. See Section 7 for details.

6.5. Right to Limit Use of Sensitive Personal Information

You have the right to limit our use of sensitive personal information to purposes necessary to perform our services. See Section 8 for details.

6.6. Right to Data Portability

When you exercise your Right to Know, you have the right to receive your personal information in a structured, commonly used, machine-readable format that allows you to transmit it to another entity without hindrance. We will provide your data in a portable format (such as CSV or JSON) upon request, free of charge, up to twice per 12-month period.

6.7. Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising your CCPA/CPRA rights. See Section 12 for details.

6.8. Rights Regarding Automated Decision-Making & Profiling

California is implementing rules (CPRA § 1798.185(a)(16) and the California Privacy Protection Agency’s automated decision-making technology (“ADMT”) regulations) that give consumers the right to access meaningful information about, and to opt out of, the use of automated decision-making technology and profiling for decisions that produce legal or similarly significant effects. Upmos uses automated systems for purposes such as fraud detection and personalized recommendations; significant account actions are subject to human review. For details about how we use automated systems, the logic involved, and how to exercise any applicable access or opt-out rights as these requirements take effect, see our AI & Algorithmic Disclosure or contact privacy@upmos.com.

7. Sale and Sharing of Personal Information

7.1. What Constitutes “Sale” or “Sharing”

Under the CCPA/CPRA, “SALE” (Cal. Civ. Code § 1798.140(ad)) means disclosing personal information to a third party for monetary or other valuable consideration. “SHARING” (Cal. Civ. Code § 1798.140(ah)) means disclosing personal information to a third party for cross-context behavioral advertising.

7.2. Categories We Sell or Share

In the past 12 MONTHS, we have sold or shared the following categories of personal information for advertising and marketing purposes:

• Identifiers: Email addresses, device IDs, cookie IDs, IP addresses
• Internet or Network Activity: Browsing history, search history, interactions with advertisements
• Geolocation Data: Approximate location based on IP address
• Inferences: Consumer preferences, likelihood to purchase, interests

7.3. Third Parties to Whom We Sell or Share

• Advertising networks (Google Ads, Facebook Ads)
• Social media platforms
• Data analytics providers
• Marketing technology partners

7.4. How to Opt-Out

To opt out of the sale or sharing of your personal information:

• Website Footer: Click “Do Not Sell or Share My Personal Information” link in the website footer
• Email: Send a request to privacy@upmos.com
• Online: Use the “Do Not Sell or Share My Personal Information” link in the website footer, or see the CCPA/CPRA Compliance page for request instructions
• Phone: Call us at 1-855-637-2433

7.5. We Do Not Sell Personal Information of Minors

Pursuant to Cal. Civ. Code § 1798.120(c), we do not knowingly sell or share personal information of consumers under 16 years of age without the affirmative authorization (“opt-in”) required by that section.

For children under the age of 13, we require verifiable parental consent before collecting, selling, or sharing their personal information, in compliance with both CCPA and COPPA. Parents or legal guardians may exercise rights on behalf of their minor children. See our COPPA Policy for additional details.

7.6. Global Privacy Control (GPC)

We honor Global Privacy Control (GPC) browser signals as a valid opt-out of sale/sharing request pursuant to Cal. Civ. Code § 1798.135 and 11 CCR § 7025. When we detect a GPC signal from your browser, we will automatically treat it as a request to opt out of the sale and sharing of your personal information for that browser and device. You do not need to take any additional action. To enable GPC, visit globalprivacycontrol.org for compatible browsers and extensions.

We also recognize other opt-out preference signals as they become industry-standard. We do not respond to generic “Do Not Track” (DNT) browser signals, as no uniform standard for DNT has been adopted. However, GPC and similar legally recognized signals will always be honored.

8. Sensitive Personal Information

8.1. Categories of Sensitive Personal Information

For purposes of Cal. Civ. Code § 1798.140(ae), we may collect the following categories of sensitive personal information:

• Social Security Number, Driver’s License, Passport Number: For identity verification when required (e.g., high-value transactions, fraud prevention)
• Account Login Credentials: Username and password for your Upmos account
• Precise Geolocation: Only if you explicitly enable location services
• Financial Account Information: Bank account or payment card numbers for processing payments

8.2. Purposes for Using Sensitive Personal Information

We use sensitive personal information only for the following purposes:

• Identity verification and fraud prevention
• Processing payments and financial transactions
• Complying with legal and regulatory obligations
• Providing customer service and support
• Maintaining security and integrity of our systems

8.3. Right to Limit Use

You have the right to direct us to limit our use of your sensitive personal information to purposes necessary to perform our services. To exercise this right, contact us using the methods in Section 9.

9. How to Exercise Your Rights

9.1. Methods to Submit Requests

You may exercise your CCPA/CPRA rights by submitting a verifiable consumer request through any of the following methods:

• Online: Via the “Do Not Sell or Share My Personal Information” footer link or the CCPA/CPRA Compliance page
• Email: privacy@upmos.com
• Phone: 1-855-637-2433 (toll-free)
• Mail: Upmos Inc., Attn: Privacy Team, 9896 Bissonnet St, Houston, TX 77036, United States

9.2. Information to Include in Your Request

To help us process your request efficiently, please provide:

• Your full name
• Email address associated with your account
• Phone number
• Account username (if applicable)
• Specific right you wish to exercise (know, delete, correct, opt-out, limit)
• Description of your request

9.3. Response Timeline

We will acknowledge receipt of your request within 10 BUSINESS DAYS and respond substantively within 45 DAYS of receiving your request. If we need additional time (up to 90 DAYS total), we will notify you of the reason and extension period.

9.4. Annual Request Metrics

In accordance with 11 CCR § 7102, we publish the following metrics for consumer requests received in the preceding calendar year:

Metrics are updated annually by July 1 for the preceding calendar year. Dashes indicate no reportable data for the current period.

10. Verification Process

10.1. Why We Verify

To protect your privacy and prevent unauthorized access to your personal information, WE MUST VERIFY YOUR IDENTITY before fulfilling your request.

10.2. Verification Requirements

The verification process depends on the type of request:

For “Right to Know” (Categories):

• We will match at least two data points you provide with information we maintain (e.g., name and email address)

For “Right to Know” (Specific Pieces) or “Right to Delete”:

• We will match at least three data points you provide with information we maintain
• We may require a signed declaration under penalty of perjury
• For account holders: We may verify through your existing account credentials

For “Right to Correct”:

• Similar verification as “Right to Know” (Specific Pieces)

10.3. If We Cannot Verify

If we cannot verify your identity, we will notify you and explain why. We may provide you with additional opportunities to verify your identity or offer alternative methods of exercising your rights.

11. Authorized Agents

11.1. Using an Authorized Agent

You may designate an authorized agent to submit requests on your behalf. The authorized agent must:

• Be registered with the California Secretary of State to conduct business in California, OR
• Have written permission signed by you authorizing the agent to act on your behalf

11.2. Verification for Authorized Agents

We require authorized agents to provide:

• Proof of registration with the California Secretary of State (if applicable)
• Signed written authorization from you permitting the agent to submit the request
• Verification of your identity directly from you (we may contact you to confirm)

11.3. Power of Attorney

If you have provided the authorized agent with a valid power of attorney pursuant to California Probate Code sections 4000 to 4465, the verification requirements in Sections 11.1 and 11.2 above do not apply (11 CCR § 7063(c)): we will not require proof of the agent’s authorization beyond the power of attorney, will not require you to verify your identity directly with Upmos, and will not require you to confirm with us that you authorized the agent to submit the request.

12. Non-Discrimination

12.1. Your Right to Non-Discrimination

WE WILL NOT DISCRIMINATE against you for exercising any of your CCPA/CPRA rights. Specifically, we will not:

• Deny you goods or services
• Charge you different prices or rates for goods or services, including through the use of discounts or other benefits, or imposing penalties
• Provide you a different level or quality of goods or services
• Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services

12.2. Financial Incentive Programs

We may offer financial incentives or price differences if they are reasonably related to the value of your personal information. Any such programs will be described in separate terms, and you may opt in or opt out at any time.

12.3. Current Loyalty Programs

Our loyalty and membership programs — All Access (which encompasses Go memberships, Honors, Liberty, Double Up Fridays, and Cash Back Rewards) — are available to all eligible customers and are not dependent on the collection of personal information beyond what is necessary to administer the programs.

13. Data Retention

13.1. Retention Periods

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including:

• Account Information: For the duration of your account plus 7 YEARS after account closure for legal and tax compliance
• Transaction Records: 7 YEARS from the date of transaction for accounting, tax, and legal purposes
• Marketing Data: Until you opt out or 2 YEARS of inactivity, whichever comes first
• Customer Support Records: 3 YEARS from last interaction
• Security and Fraud Prevention Data: 5 YEARS or AS REQUIRED BY LAW

13.2. Deletion After Retention Period

After the applicable retention period, we will delete or anonymize your personal information in accordance with our data retention policies and applicable law.

13.3. Legal Holds

We may retain personal information for longer periods if required by law, regulation, legal process, or to establish, exercise, or defend legal claims.

14. Additional California Rights

14.1. California’s “Shine the Light” Law (Cal. Civ. Code § 1798.83)

Under California Civil Code Section 1798.83 (“Shine the Light”), California residents who provide personal information to a business for personal, family, or household purposes may request information about whether the business has disclosed personal information to third parties for their direct marketing purposes. Upmos does not share personal information with third parties for their direct marketing purposes. If our practices change, we will update this notice and provide you with the ability to opt out.

To make a Shine the Light request, please contact us at privacy@upmos.com with the subject line “Shine the Light Request.”

14.2. Deidentified and Aggregated Data

Upmos may use deidentified data (data that cannot reasonably identify, relate to, describe, or be linked to a particular consumer) for internal analytics, service improvement, and research purposes. When we use deidentified data, we:

• Take reasonable measures to ensure the data cannot be associated with a consumer or household
• Commit to maintaining and using the data in deidentified form and not attempting to reidentify the data
• Contractually obligate any recipients of the data to comply with the same requirements

We may also use aggregated consumer information (data that relates to a group or category of consumers from which individual consumer identities have been removed) for research, statistical analysis, and business purposes. Aggregated data is not considered personal information under the CCPA/CPRA.

14.3. Proposition 65 Notice

California’s Proposition 65 (Safe Drinking Water and Toxic Enforcement Act of 1986, codified at Cal. Health & Safety Code § 25249.5 et seq., with warning content prescribed by 27 CCR § 25603) requires businesses to provide warnings about significant exposures to listed chemicals that cause cancer, birth defects, or other reproductive harm. Product-specific Prop 65 warnings, where applicable, are provided on individual product pages at the point of sale in accordance with California law. For Prop 65 inquiries, contact legal@upmos.com.

15. General Provisions

15.1. Severability

If any provision of this California Consumer Notice is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such invalidity shall not affect the validity of the remaining provisions, which shall continue in full force and effect. The invalid provision shall be modified to the minimum extent necessary to make it valid and enforceable while preserving the original intent.

15.2. Survival

The provisions of this Notice relating to data retention, your rights, intellectual property, limitation of liability, and dispute resolution shall survive the termination or expiration of any business relationship between you and Upmos.

15.3. Accessibility

Upmos is committed to ensuring this California Consumer Notice is accessible to all users, including those with disabilities. This notice is designed to comply with WCAG 2.1 Level AA guidelines. If you experience any difficulty accessing the information in this notice, please contact us at accessibility@upmos.com or call 1-855-637-2433 and we will provide the information in an alternative format. For our full accessibility commitment, please see our Accessibility Statement.

15.4. Governing Law

This California Consumer Notice is governed by and construed in accordance with the laws of the State of California, including but not limited to the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), as amended by the California Privacy Rights Act. Any disputes arising under this notice shall be subject to the exclusive jurisdiction of the state and federal courts located in California. Nothing in this section limits your right to file a complaint with the California Attorney General or exercise any rights under applicable law.

15.5. Private Right of Action

Under Cal. Civ. Code § 1798.150, California residents whose nonencrypted and nonredacted personal information is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of Upmos’s failure to implement and maintain reasonable security procedures may institute a civil action to recover damages of not less than $100 and not greater than $750 per consumer per incident, or actual damages, whichever is greater. Before initiating an action for statutory damages, you must provide Upmos 30 days’ written notice identifying the specific provisions violated. Pursuant to Cal. Civ. Code § 1798.150(b)(2), no advance notice is required for actions seeking solely actual pecuniary damages.

15.6. Entire Agreement

This California Consumer Notice, together with our Privacy Policy, Terms of Use, and any referenced policies, constitutes the entire agreement between you and Upmos regarding the collection, use, and disclosure of your personal information under California law.

15.7. Operational Continuity

Where circumstances beyond our reasonable control — such as natural disasters, government actions, pandemics, or cyber incidents — materially affect our ability to meet the response timelines in this notice, we will continue to use reasonable efforts to comply with the statutory deadlines set by the CCPA/CPRA, notify affected consumers of any extension permitted under Cal. Civ. Code § 1798.130(a)(2), and resume normal performance as soon as practicable. Nothing in this section purports to extend, waive, or contract around any deadline or right that California law makes non-waivable.

Related Links and Helpful Topics

For more information about our policies, guidelines, and help resources, please visit the following pages:

Frequently Asked Questions (FAQ)

Below are answers to common questions about this California Consumer Notice, organized by topic. For questions not covered here, contact privacy@upmos.com or call 1-855-637-2433.

CCPA/CPRA Basics

Your Rights

Sale & Sharing of Data

Verification & Timing

Sensitive Information

Contact & Support