Privacy Policy

Effective Date: July 24, 2026

Introduction

This Privacy Policy (“Policy”) describes how DealMachine Operations, Inc. (“DealMachine,” “Company,” “we,” “our,” or “us”) collects, uses, discloses, and protects personal information in connection with the DealMachine mobile and web application (the “App”), our website located at www.dealmachine.com (the “Site”), and related services (collectively, “DealMachine” or the “Services”).

DealMachine’s core service allows subscribers (“Users,” “you,” “Subscribers”) to identify real property of interest, locate the owner of that property, and contact that owner directly, including by mail. Providing this service necessarily involves collecting and processing personal information about two distinct groups of people: (1) our Users, who create accounts and subscribe to DealMachine, and (2) property owners and other individuals who are identified through DealMachine but who are not DealMachine Users and have no account with us (“Non-User Individuals”). This Policy addresses both, separately, below, because the rights and obligations that apply to each group differ.

Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify Users by email and by prominent notice within DealMachine before the change takes effect. Your continued use of DealMachine after a change becomes effective constitutes your acceptance of the revised Policy.

Account and Contact Information

When you register for DealMachine, we collect your name, email address, phone number, and mailing address. Your address and phone number are also used as the return address associated with mail you send through DealMachine.

Payment Information

If you register for a paid subscription, our payment processor collects your name, billing address, card type, card number, CVV, and expiration date. We do not store full payment card numbers or CVV on our own servers; payment processing is handled by PCI-compliant third parties. We retain limited transaction metadata (such as a payment token, purchase date, and plan tier) necessary to administer your subscription.

User Contributions

If you submit a testimonial, review, or other content for publication, that content may be displayed publicly. You are responsible for the content you choose to submit for publication.

Support, Device, and Usage Information

When you contact customer support or live chat, we may collect information about your device, operating system, app version, and the nature of your inquiry in order to troubleshoot and respond. We also automatically collect IP address, device identifiers, app usage data (such as screens viewed and features used), and approximate location through standard analytics tools.

A central function of DealMachine is to help Users identify the owner of a given property and provide contact information for that owner. To do this, we collect, license, or generate personal information about property owners and, in some cases, their known associates, including names, mailing addresses, phone numbers, and property/ownership records. These individuals are not DealMachine Users, have not created an account, and in the ordinary course have not been asked for consent to this collection. We use this information solely to enable Users to identify property ownership and to facilitate User-initiated outreach (such as mailed letters) to property owners. We do not use this information to send marketing communications from DealMachine itself to property owners, and we do not sell property-owner contact lists as a standalone product independent of the Services.

Rights of Non-User Individuals

If you are a property owner or other individual whose information appears in DealMachine and you are not a DealMachine User, you may request to know what information we hold about you, request its correction, or request its deletion, subject to the exceptions described in Section 8. To make such a request, contact us through the following mechanism: https://privacyrequest.dealmachine.com/remove. We will honor verified requests within the timeframe required by applicable law.

Use of User Information

• Create, maintain, and secure your account;
• Provide the core functionality of DealMachine, including property search, owner lookup, and mail-send features;
• Process payments and manage your subscription;
• Respond to support inquiries;
• Send transactional communications, such as receipts and account notices;
• Send product updates or marketing communications, where you have not opted out;
• Monitor, maintain, and improve the performance and security of DealMachine;
• Detect and prevent fraud; and
• Comply with legal obligations.

Use of Non-User (Property Owner) Information

• Match a property address searched by a User to its owner of record;
• Display owner name and contact information to the User who conducted the search;
• Facilitate mail sent by a User to the property owner through DealMachine’s mail-send feature; and
• Maintain the accuracy of our property/ownership database.

We do not use Non-User Individuals’ information for our own advertising or marketing purposes, and we do not use it to build advertising profiles.

DealMachine operates in the United States, and this Policy is designed to comply with U.S. federal and state law. International users should refer to Section 13 of this Policy. Under U.S. state law, we process personal information as reasonably necessary to provide the Services you request, to comply with legal obligations, and, for certain uses such as marketing, based on your consent or your ability to opt out as described in Section 9.

We disclose information in the following circumstances:

• Service providers. We share information with vendors who perform services on our behalf, such as hosting, payment processing, customer support, and mail fulfillment. These vendors are contractually restricted to using the information only to provide services to us.
• Affiliate partners. If you sign up using a promo code from a DealMachine affiliate, we share your name and email address with that affiliate for tracking purposes.
• Analytics and advertising partners. As described in Section 7 (Cookies and Tracking Technologies), certain identifiers and online activity information may be disclosed to analytics and advertising partners, including in a manner that constitutes a “sale” or “share” of personal information under some state laws. This disclosure relates to User account and website-activity data — it is separate from, and does not apply to, property-owner data described in Section 2, which we do not sell.
• Legal and safety. We may disclose information where required by law, to enforce our terms, or to protect the rights, property, or safety of DealMachine, our Users, or others.
• Business transfers. If DealMachine is acquired, merged, or sells substantially all of its assets, personal information may be transferred as part of that transaction, subject to this Policy or a successor policy.

Financial information you provide is used to bill you for paid Services. We do not store full credit card numbers or CVV codes on our own servers. Card and billing data is collected and stored by our PCI-compliant payment processors, who provide us with limited information necessary to administer your subscription, such as a payment token and the last four digits of your card. If you purchase through the Apple App Store or Google Play Store, that purchase is also governed by Apple’s or Google’s respective privacy policy.

When you visit our Site, we and certain third-party service providers use cookies, pixels, and similar technologies to operate the Site, analyze traffic, remember preferences, power live chat, and measure advertising performance.

• Analytics and product experience: Google Analytics, Google Tag Manager, HubSpot, and Hotjar. Hotjar captures how visitors interact with our pages (clicks, mouse movement, scrolling, navigation) to help us improve the site; it may record session activity but masks sensitive input fields.
• Live chat: Intercom, which may record and store the contents of chat conversations.
• Advertising and measurement: Meta (Facebook) Pixel, TikTok, LinkedIn Insight Tag, (when enabled) Microsoft Advertising and podcast/connected-TV measurement partners, and Hyros. These partners may receive device and activity information — including identifiers, pages viewed, form submissions, and hashed contact information — to measure and deliver advertising. This sharing may constitute a “sale” or “share” of personal information under some state laws; see Section 9.

Our cookie banner lets you accept or decline non-essential cookies, and you may withdraw consent at any time. We honor the Global Privacy Control (“GPC”) signal and other recognized universal opt-out signals as an opt-out of sale, sharing, and targeted advertising — not merely as a cookie-consent preference — for residents of states that recognize such signals.

Absent a proper request for removal of data, we retain personal information only for as long as reasonably necessary for the purposes described in this Policy, taking into account the following:

• User account data: not destroyed or deleted unless requested through https://privacyrequest.dealmachine.com/remove.
• Transaction and billing records: retained for a minimum of six years to comply with tax and accounting record-keeping obligations.
• Property-owner data: property data is not destroyed or deleted, but is refreshed on a daily basis; owner and contact data is refreshed monthly and matched with property data monthly.
• Marketing/email list data: retained until you unsubscribe or request removal, as described in Section 9.

This Policy does not rely on retention schedules designed for physical or digital consumer product sales, which do not reflect how DealMachine’s subscription and data-lookup services actually operate.

Depending on your state of residence, you may have the right to access, correct, delete, or port your personal information; opt out of the sale or sharing of your personal information; opt out of targeted advertising; opt out of certain profiling; and appeal a decision on your request. These rights, and how to exercise them on a state-by-state basis, are set out in DealMachine’s State-Specific Privacy Rights Addendum, which is incorporated into and forms part of this Policy. You may also exercise any of these rights, or opt out of the sale/sharing of your personal information generally, by:

• Emailing privacy@dealmachine.com with the subject line “Privacy Rights Request”; or https://privacyrequest.dealmachine.com/remove

We will not discriminate against you for exercising any privacy right.

Because DealMachine provides Users with contact information for property owners with whom DealMachine has no direct relationship, DealMachine may meet the statutory definition of a “data broker” in certain states, which can carry independent registration and disclosure obligations beyond those described in this Policy. Currently, the Company is registered as a data broker in the following states: California and Texas.

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information from loss, misuse, and unauthorized access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

DealMachine is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from individuals under the age of 13. If you believe a child has provided us with personal information, contact us at privacy@dealmachine.com and we will take appropriate steps to delete it.

DealMachine is headquartered in the United States, and personal information we collect is generally processed and stored in the United States. If you access DealMachine from outside the United States, your personal information will be transferred to, and processed in, the United States and other countries that may not have data protection laws providing the same level of protection as your home jurisdiction.

Users in the European Economic Area, United Kingdom, or Switzerland

Where we transfer personal information originating in the EEA, UK, or Switzerland to the United States or another country not subject to an adequacy decision, we rely on the following safeguards, rather than on your consent alone, because such transfers are ongoing and repeated in the normal course of providing the Services:

• the Standard Contractual Clauses approved by the European Commission, incorporated into our agreements with DealMachine and the service providers who process this data on our behalf; and
• for transfers of personal data originating in the United Kingdom, the UK International Data Transfer Addendum to the Standard Contractual Clauses.

Where no transfer mechanism listed above is yet in place for a specific, limited transfer, we will seek your explicit, informed, and freely given consent to that particular transfer before it occurs, consistent with Article 49(1)(a) GDPR. We do not rely on consent as our general or ongoing transfer mechanism, and your use of DealMachine alone does not constitute this consent.

Users in Canada

If you access DealMachine from Canada, your personal information will be transferred to and processed in the United States. Under Canada’s federal Personal Information Protection and Electronic Documents Act (“PIPEDA”), we remain accountable for personal information we transfer to service providers, including those located outside Canada, and use contractual and other means to require a comparable level of protection. Because your information may be accessible to U.S. government authorities under U.S. law once transferred, we are providing this disclosure so that you are aware of that possibility before using DealMachine.

Users in Australia

If you access DealMachine from Australia, your personal information will be disclosed to an overseas recipient (DealMachine, in the United States). Under Australian Privacy Principle 8 (“APP 8”) of the Privacy Act 1988 (Cth), before making this disclosure we take reasonable steps to ensure the overseas recipient will not handle your information in a way that would breach the Australian Privacy Principles, primarily through contractual terms with DealMachine and its service providers that require APP-equivalent handling and give you access to a complaint-handling process. We remain accountable under APP 8 for our own handling of your information as the Australian-facing disclosing party.

Other International Users

If you access DealMachine from a jurisdiction other than the United States, EEA, UK, Switzerland, Canada, or Australia, you acknowledge that your information will be transferred to and processed in the United States as described above.

If DealMachine is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. Any acquiring party will be required to honor the commitments made in this Policy with respect to previously collected information, or to provide notice of any material change.

Questions about this Policy or DealMachine’s data practices may be directed to: privacy@dealmachine.com.

The mailing address for DealMachine Operations, Inc. is 456 North Meridian Street, Suite 44050, Indianapolis, Indiana 46204.

This State-Specific Privacy Rights Addendum (“Addendum”) is incorporated into and forms part of DealMachine’s Privacy Policy, as referenced in Section 9 above. It describes the additional or clarifying rights available to residents of the states listed below under each state’s comprehensive consumer privacy law. It applies to Users acting in an individual or household capacity who qualify as “consumers” under the applicable state law; it does not extend rights to Non-User Individuals beyond those already described in Section 2, whose rights are instead addressed under Section 2 and, where applicable, this Addendum’s state-specific sections.

You may exercise the rights described in this Addendum using the methods identified in Section 9 (emailing privacy@dealmachine.com with the subject line “Privacy Rights Request,” or through https://privacyrequest.dealmachine.com/remove. We will verify your request using information reasonably necessary to confirm your identity before acting on it, and we will not discriminate against you for exercising any right described below.

California

Applicability. This section applies to California residents and supplements the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to know what personal information we collect, use, disclose, and sell or share, and to receive a portable copy of it;
• Right to delete personal information we have collected from you, subject to statutory exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of your personal information, including cross-context behavioral advertising, and to limit our use of sensitive personal information to purposes permitted under the CCPA;
• Right to non-discrimination for exercising any of these rights; and
• Right to designate an authorized agent to submit requests on your behalf.

California residents may also submit requests through the California Privacy Protection Agency’s centralized deletion mechanism (“DROP”), to the extent applicable to DealMachine as a data broker under Section 10. We honor the Global Privacy Control signal as a valid opt-out of sale and sharing, as described in Section 7.

In 2025, we received no requests for removal from California residents. As such there were no request that were approved and no requests that were denied.

Colorado

Applicability. This section applies to Colorado residents and supplements the Colorado Privacy Act (“CPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects;
• Right to opt-in consent before we process sensitive data concerning you; and
• Right to appeal a decision we make in response to your request, as described below.

We recognize the Universal Opt-Out Mechanism (including the Global Privacy Control) as a valid method of exercising your opt-out rights, as described in Section 7. If we decline to act on your request, you may appeal our decision by replying to our denial notice or by emailing privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Colorado.” We will respond to your appeal within 45 days (extendable by 60 days where reasonably necessary). If your appeal is denied, you may contact the Colorado Attorney General at https://coag.gov/data-protection-complaint-form/.

Connecticut

Applicability. This section applies to Connecticut residents and supplements the Connecticut Data Privacy Act (“CTDPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects concerning you;
• Right to opt-in consent before we process sensitive data concerning you, including the sale of any known child’s (13–15) personal data; and
• Right to appeal an adverse decision on your request.

We recognize the Global Privacy Control as a valid opt-out mechanism, as described in Section 7. To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Connecticut.” We will respond within 60 days. If we decline to reverse our decision, you may contact the Connecticut Attorney General at https://portal.ct.gov/AG/Sections/Privacy/The-Connecticut-Data-Privacy-Act.

Delaware

Applicability. This section applies to Delaware residents and supplements the Delaware Personal Data Privacy Act (“DPDPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling; and
• Right to opt-in consent before we process sensitive data concerning you, including a known child’s data.

We recognize the Global Privacy Control as a valid opt-out mechanism, as described in Section 7. To appeal a decision on your request, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Delaware.” We will respond to your appeal within 60 days. If we decline to reverse our decision, you may contact the Delaware Department of Justice at https://attorneygeneral.delaware.gov/fraud/cpu/dpdpa/.

Indiana

Applicability. This section applies to Indiana residents and supplements the Indiana Consumer Data Protection Act (“ICDPA”), effective January 1, 2026.

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling;
• Right to opt-in consent before we process sensitive data concerning you; and
• Right to appeal an adverse decision on your request.

To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Indiana.” We will respond within 45 days (extendable by 60 days). If we decline to reverse our decision, you may contact the Office of the Indiana Attorney General.

Iowa

Applicability. This section applies to Iowa residents and supplements the Iowa Consumer Data Protection Act (“ICDPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access and delete personal data we hold about you, and to obtain a portable copy of it; and
• Right to opt out of the sale of personal data or its use for targeted advertising.

Iowa law does not provide a right to correct inaccurate personal data, does not require opt-in consent before processing sensitive data (clear notice and an opportunity to opt out applies instead), and does not require us to offer an internal appeal process for denied requests. If you have concerns about how we handled your request, you may contact the Iowa Attorney General’s Consumer Protection Division.

Kentucky

Applicability. This section applies to Kentucky residents and supplements the Kentucky Consumer Data Protection Act (“KCDPA”), effective January 1, 2026.

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling;
• Right to opt-in consent before we process sensitive data concerning you; and
• Right to appeal an adverse decision on your request.

To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Kentucky.” We will respond within 45 days (extendable by 45 days). If we decline to reverse our decision, you may contact the Kentucky Office of the Attorney General.

Maryland

Applicability. This section applies to Maryland residents and supplements the Maryland Online Data Privacy Act (“MODPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling; and
• Right to appeal an adverse decision on your request.

Maryland law imposes a prohibition on the sale of sensitive personal data (such as precise geolocation, health, and certain other sensitive categories), regardless of consent. We do not sell sensitive personal data of Maryland residents. We collect only the personal data reasonably necessary and proportionate to provide the specific product or service requested. To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Maryland.” We will respond within 60 days. If we decline to reverse our decision, you may contact the Maryland Attorney General’s Consumer Protection Division.

Minnesota

Applicability. This section applies to Minnesota residents and supplements the Minnesota Consumer Data Privacy Act (“MCDPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling;
• Right to opt-in consent before we process sensitive data concerning you;
• Right to question and appeal the results of profiling that produces legal or similarly significant effects, including, where technically feasible, an explanation of the reasons for the profiling decision; and
• Right to obtain documentation of our internal policies regarding our collection, use, and disclosure of personal data.

We recognize the Global Privacy Control as a valid opt-out mechanism, as described in Section 7. To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Minnesota.” We will respond within 45 days (extendable by 60 days). If we decline to reverse our decision, you may contact the Minnesota Attorney General’s Office.

Montana

Applicability. This section applies to Montana residents and supplements the Montana Consumer Data Privacy Act (“MCDPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling;
• Right to opt-in consent before we process sensitive data concerning you; and
• Right to appeal an adverse decision on your request.

We recognize the Global Privacy Control as a valid opt-out mechanism, as described in Section 7. To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Montana.” We will respond within 45 days (extendable by 60 days). If we decline to reverse our decision, you may contact the Montana Department of Justice.

Nebraska

Applicability. This section applies to Nebraska residents and supplements the Nebraska Data Privacy Act (“NDPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling; and
• Right to opt-in consent before we process sensitive data concerning you.

Nebraska’s law applies to any business that conducts business in the state or targets its residents, without a minimum consumer-volume threshold, unless the business qualifies as a small business under federal Small Business Administration guidelines. We recognize the Global Privacy Control as a valid opt-out mechanism, as described in Section 7. To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Nebraska.” We will respond within 60 days. If we decline to reverse our decision, you may contact the Nebraska Attorney General’s Office.

New Hampshire

Applicability. This section applies to New Hampshire residents and supplements New Hampshire Senate Bill 255 (“NHDPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling;
• Right to opt-in consent before we process sensitive data concerning you; and
• Right to appeal an adverse decision on your request.

We recognize the Global Privacy Control as a valid opt-out mechanism, as described in Section 7. To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – New Hampshire.” We will respond within 60 days. If we decline to reverse our decision, you may contact the New Hampshire Attorney General’s Office.

New Jersey

Applicability. This section applies to New Jersey residents and supplements the New Jersey Data Privacy Act (“NJDPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling;
• Right to opt-in consent before we process sensitive data concerning you; and
• Right to appeal an adverse decision on your request.

New Jersey requires opt-in consent, rather than an opt-out right, before we process the personal data of a known child aged 13 to 17 for the purposes of targeted advertising, sale, or certain profiling. We recognize the Global Privacy Control as a valid opt-out mechanism, as described in Section 7. To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – New Jersey.” We will respond within 45 days (extendable by 60 days). If we decline to reverse our decision, you may contact the New Jersey Division of Consumer Affairs.

Oregon

Applicability. This section applies to Oregon residents and supplements the Oregon Consumer Privacy Act (“OCPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to know the specific third parties (not merely categories of third parties) to which we have disclosed your personal data, or to receive a list of categories of third parties if we cannot reasonably identify specific third parties;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling;
• Right to opt-in consent before we process sensitive data concerning you; and
• Right to appeal an adverse decision on your request.

Oregon’s law contains heightened protections for precise geolocation data and the personal data of minors. We recognize the Global Privacy Control as a valid opt-out mechanism, as described in Section 7. To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Oregon.” We will respond within 45 days (extendable by 60 days). If we decline to reverse our decision, you may contact the Oregon Department of Justice.

Rhode Island

Applicability. This section applies to Rhode Island residents and supplements the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”), effective January 1, 2026.

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling;
• Right to opt-in consent before we process sensitive data concerning you; and
• Right to know the categories of third parties to which we have disclosed your personal data.

Rhode Island does not provide a statutory cure period before enforcement. To exercise these rights, email privacy@dealmachine.com with the subject line “Privacy Rights Request – Rhode Island,” or use the method described in Section 9. Rhode Island’s statute does not require us to offer an internal appeal process for denied requests; if you have concerns about how we handled your request, you may contact the Rhode Island Attorney General’s Office.

Tennessee

Applicability. This section applies to Tennessee residents and supplements the Tennessee Information Protection Act (“TIPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling;
• Right to opt-in consent before we process sensitive data concerning you; and
• Right to appeal an adverse decision on your request.

To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Tennessee.” We will respond within 60 days (extendable by 45 days). If we decline to reverse our decision, you may contact the Tennessee Attorney General’s Office.

Texas

Applicability. This section applies to Texas residents and supplements the Texas Data Privacy and Security Act (“TDPSA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or certain profiling;
• Right to opt-in consent before we process sensitive data concerning you, including biometric and precise geolocation data; and
• Right to appeal an adverse decision on your request.

The TDPSA applies to any business that conducts business in Texas or produces products or services consumed by Texas residents and is not a small business under federal guidelines. We recognize the Global Privacy Control as a valid opt-out mechanism, as described in Section 7. To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Texas.” We will respond within 60 days (extendable by 45 days). If we decline to reverse our decision, you may contact the Texas Attorney General’s Office.

Utah

Applicability. This section applies to Utah residents and supplements the Utah Consumer Privacy Act (“UCPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access and delete personal data we hold about you, and to obtain a portable copy of it; and
• Right to opt out of the sale of personal data or its use for targeted advertising, or of profiling in furtherance of decisions that produce legal or similarly significant effects.

Utah’s law does not provide a right to correct inaccurate personal data, does not require opt-in consent before processing sensitive data (notice and an opportunity to opt out applies instead), and does not require us to offer an internal appeal process for denied requests. If you have concerns about how we handled your request, you may contact the Utah Division of Consumer Protection.

Virginia

Applicability. This section applies to Virginia residents and supplements the Virginia Consumer Data Protection Act (“VCDPA”).

Subject to the exceptions and conditions set out in the applicable law, you have the following rights:

• Right to access, correct, and delete your personal data, and to obtain a portable copy of it;
• Right to opt out of targeted advertising, the sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects;
• Right to opt-in consent before we process sensitive data concerning you; and
• Right to appeal an adverse decision on your request.

To appeal a decision, email privacy@dealmachine.com with the subject line “Privacy Rights Appeal – Virginia.” We will respond within 60 days (extendable by 45 days). If we decline to reverse our decision, you may contact the Office of the Virginia Attorney General at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.