Privacy Policy

Update to this policy: From November 30, 2026, we will keep security and system logs for up to 400 days (Section 5.1). Until then, they are kept on our current, shorter schedule. See what changed and why

Midnight Logic, Inc. ("Company," "we," "us," or "our") operates the bartendersNow™ platform, a marketplace connecting professional bartenders with event hosts. We are committed to protecting your privacy and being transparent about how we collect, use, and share your personal information.

This Privacy Policy explains how we handle personal information when you use our progressive web application, website, and related services (collectively, the "Platform").

California Residents: This policy includes specific information about your rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). See Section 12 for details.

---

Account Information:

• Name, email address, phone number
• Date of birth (used to confirm you meet the minimum age for the services you request and, for bartenders, to verify your identity with our payments and identity-verification provider)
• Residential or mailing address, and the ZIP code you provide at sign-up
• Profile photo and biography
• Location and service area information
• Professional credentials and certifications
• Payment information (processed securely through Stripe)

For Bartenders:

• Identity verification documents (via Stripe Identity)
• Professional licenses and certifications (RBS, etc.)
• Business information and tax identification
• Service rates, availability, and preferences
• Professional experience and references

Documents you upload (Documents Hub): Bartenders may upload documents to their Documents Hub, including certificates of insurance (which may contain a policy number and, in some cases, a business or home address), professional certifications, and background-check or fingerprinting-clearance records (for example, a California LiveScan clearance letter or result). We store these documents so that you can keep them in one place and choose to share them with specific hosts. We do not ask for, and you should not upload, a raw fingerprint image or fingerprint card. bartendersNow does not review, verify, endorse, or independently confirm any document you upload.

Identity Verification & Biometric Processing: Identity verification is conducted by our third-party service provider (Stripe, Inc.), which may collect and process biometric verification data pursuant to Stripe's Privacy Policy. As part of that verification, Stripe uses its own automated face-matching technology to compare a selfie you take with the photo on your identity document. Midnight Logic, Inc. does not receive, store, or have access to raw biometric templates. Authorized members of our team may view the identity-document and selfie images, and the details Stripe displays with them, in Stripe's dashboard to compare them with your profile photo, for identity-verification and fraud-prevention purposes, and we may require that comparison before a Bartender can send or accept booking requests. That comparison is made by eye: we do not use facial-recognition or face-matching technology to compare your profile photo with those images, and we do not create a faceprint or any other biometric template from your profile photo or from those images. We view those images only within Stripe's dashboard; we do not copy, download, screenshot, or store them, and we keep a record of the outcome of the comparison and of who made it and when, but not the images. This government-issued ID and biometric verification data is classified as Sensitive Personal Information under the California Privacy Rights Act; see Section 12.2 (Categories of Personal Information) for the detailed disclosure.

For Hosts:

• Event details (date, location, guest count, duration)
• Beverage preferences and service requirements
• Property and venue information
• Special requests and accessibility needs
• Safety notes you choose to add to an event for the bartenders booked for it (such as allergies, service instructions, whether guests under 21 will attend, venue access and timing), which may include health-related information about your guests

Communications:

• Messages sent through our platform
• Customer service interactions
• Feedback and survey responses
• Review and rating content

Platform Usage:

• IP address, browser type, and device information
• Platform navigation and interaction patterns
• Feature usage and preferences
• Session duration and frequency of use

Marketing Attribution:

• The campaign parameters (source, medium, and campaign name) carried by the link you used to reach us, so we can understand which channels bring people to bartendersNow™. They describe the link you used, not you: we discard any value shaped like an email address, phone number or account identifier, and we do not use these parameters to identify you.

Location Information:

• Geographic location for service matching
• GPS coordinates when using mobile features
• Service area and travel preferences

Performance Data:

• Algorithm performance and optimization data
• Search queries and filtering preferences
• Booking success rates and completion data
• The Stock List usage and effectiveness metrics

First-Party Analytics (Firebase Analytics / GA4): We use Firebase Analytics (Google Analytics 4) as first-party product measurement (session tracking, booking funnels, and sign-ins) strictly for internal platform operation. This first-party operational analytics falls under the CCPA/CPRA Business Purpose Exception (Cal. Civ. Code § 1798.140(e)) and does not require a consent gate or opt-out.

This measurement includes coarse location: the state, the city, and the first three digits of a ZIP code. We use it to understand where our services are being requested — including areas where we are not yet available — so that we can plan where to operate. We do not send Google Analytics your full ZIP code, your street address, or precise device location such as GPS coordinates. We do not use this measurement for advertising or for cross-context behavioral advertising, and Google processes it for us as our service provider.

Free Planning Tools. When you use one of our free planning tools, such as the bartendersNow™ Stock List, we record a de-identified summary of what you entered and what the tool produced — for example the guest counts, the service duration, the occasion, the drinks you selected, any event date you gave us, the quantities the tool recommended, and the state and first three digits of the ZIP code for the area you told us about. We use these summaries to understand regional and seasonal demand, to plan where we operate, and to improve the tool. They contain no name, email address, account identifier, device identifier, session identifier, or IP address; we do not link them to you or to your device; and we do not attempt to re-identify anyone from them. We never store a full ZIP code, a city name, a street address, or a precise device location in them. We keep an individual summary for no longer than twenty-four (24) months. We record one only if you have accepted the Performance and Analytics cookie category; if you have not, or if your browser sends a Global Privacy Control signal, we record no such summary of your calculation. That choice does not affect the event details we keep when you make one of the optional choices described in Section 2.4 while asking us to email you a copy of a Stock List; those are kept only as Sections 2.4 and 5.1 describe.

Identity Verification (Stripe Identity):

• Government-issued ID verification
• Identity verification results
• The date of birth printed on your government-issued identity document
• Financial account verification
• Risk assessment data

The date of birth from your identity document. When you complete identity verification, Stripe reads the date of birth printed on your identity document and returns that date to us. Stripe does not send your identity document number, or images of your document or of your face, to our systems, and we do not store them. As described in Section 2.1, authorized members of our team may view those images, which can show your identity document number, in Stripe's dashboard to compare them with your profile photo. We use the date from your document to confirm that you meet the minimum age of 21 described in Section 9.1, and it replaces the date of birth you entered yourself, so that the date we hold for you is the one on your government-issued identity document. We record the result of that check, and we keep a record of the change, as described in Section 5.1. Your date of birth is never shown to Hosts and never appears on your public profile.

Payment Processing:

• Transaction history and payment methods
• Fraud prevention and security data
• Financial verification information

Integration Partners:

• Google Maps: Location and mapping data
• Twilio: SMS delivery and communication data
• SendGrid: Email delivery and engagement data

Some people give us personal information without ever creating an account. If you send us a copyright complaint, a trademark concern, a child-safety report, or another legal or abuse report, we collect the information you provide in that report. Depending on the type of report, this can include your name, the organization you represent, your email address, your postal address, your telephone number, your electronic or physical signature, and the contents of your report. For copyright complaints, federal law (17 U.S.C. § 512(c)(3)) requires us to collect several of these items before we can act on your notice.

How we use this information. We use information from non-user reports only to evaluate the report, take any action it calls for, notify the people affected by it (see Section 4.3), administer our repeat-infringer policy, keep the records the law requires us to keep, comply with our legal obligations, and establish, exercise, or defend legal claims.

Your rights still apply. If you are a California resident, you have the privacy rights described in Section 12 with respect to the personal information in your report, even though you do not have an account with us. Section 12.5 explains how to make a request and how we verify it when you have no account. Please note that some of this information is subject to the retention periods and legal exceptions described in Sections 5.1 and 12.1.

Launch-Notification Requests. If you do not have an account and you ask us to notify you when bartendersNow™ becomes available in your area — for example, by using the "Notify me" option we show when no bartenders are available near you — we collect the email address you provide and the city or area you asked about. We use this information solely to send you a notification when we launch bartending services in that area, and for related email-deliverability and abuse-prevention purposes. We do not add this address to any other marketing or promotional list, and we do not use it for any other purpose, without your separate consent.

Stock List Copy Requests. If you do not have an account and you ask us to email you a copy of a Stock List you generated with one of our free planning tools on our marketing website — by using the "Send me a copy" option we show with your results — we collect the email address you provide and your confirmation that you are 21 or older. We use the event details you entered — such as the guest counts, the service duration, the occasion, the event date, and the drinks you selected — to produce the copy we send you. Unless you make one of the optional choices described in this Section, we do not keep those details together with your email address. If you choose to subscribe to bartendersNow™ news and updates (see below), we also keep those event details and the ZIP code or city you entered for your event together with your email address, and we use them only to fill them in for you if you create your event on bartendersNow™ and to decide which of our news and updates about that event to send you — for example, whether we serve its area, and not writing to you about an event whose date has passed. If you never confirm your subscription, we delete them with your request. We do not use them for any other purpose without your separate consent, and you can ask us to delete them at any time without unsubscribing. We use your address to send you that copy, and for related email-deliverability and abuse-prevention purposes. We do not add your address to any marketing or promotional list, and we do not use it for any other purpose, unless you separately choose to subscribe to bartendersNow™ news and updates by checking the optional box — which you do not have to check to receive your copy, and which we act on only after you confirm it (see Section 3.4) — or separately ask us to follow up with you after your event, as described below. We do not sell or share this information. How long we keep it is described in Section 5.1. If you are a California resident, the privacy rights described in Section 12 — including your right to ask us to delete your information — apply to you even though you do not have an account with us, and Section 12.5 explains how to make a request and how we verify it.

Stock List Follow-Up Requests. When you ask us to email you a copy of a Stock List, you may also choose, by checking a separate optional box, to let us email you once after your event to ask how the Stock List worked out. You do not have to make this choice to receive your copy, and it is separate from subscribing to news and updates. If you make it, we keep your email address together with the event details you entered and the Stock List we produced for you — such as the guest counts, the service duration, the occasion, the drinks you selected, and the quantities we recommended — keeping your event's date no more precisely than its month and its area no more precisely than the state and the first three digits of its ZIP code. We use them only to send you that one follow-up email and to improve our Stock List recommendations. We do not add your address to any other list, we do not use your address or these details for any other purpose without your separate consent, and we do not sell or share them. Before we use your feedback to improve our recommendations, we separate it from your email address, de-identify it, and combine it with information from others, and we do not attempt to re-identify anyone from the result. You can unsubscribe from the follow-up at any time, and you can ask us to delete your details. If you also subscribed to news and updates, the details kept for that purpose are kept only as described above. How long we keep them is described in Section 5.1.

---

Core Services:

• Facilitate connections between Hosts and Bartenders
• Process bookings and coordinate services
• Generate The Stock List recommendations
• Calculate optimal staffing with Smart Staffing Calculator
• Enable Captain Service coordination features
• Show a Bartender's profile photo to Hosts, including on the booking and on the day of the event, so the Host can recognize the Bartender who arrives
• Show a Host's event safety notes to the Bartenders booked for that event

Account Management:

• Create and maintain user accounts
• Verify identity and credentials
• Provide customer support
• Process payments and handle refunds

Platform Integrity:

• Verify user identities and prevent fraud
• Have an authorized member of our team compare a Bartender's profile photo, by eye, with the images from their identity verification, viewed in Stripe's dashboard (see Section 2.1)
• Monitor for suspicious activity
• Enforce platform policies and terms
• Review images you upload before they are displayed publicly — using automated tools to screen for explicit or violent content, and a person to check profile photos against our photo standard
• Investigate safety incidents and disputes

Legal Compliance:

• Comply with applicable laws and regulations
• Respond to legal requests and court orders
• Protect rights and interests of all parties
• Maintain records as required by law

Algorithm Enhancement:

• Improve The Stock List accuracy through feedback loops and usage data
• Optimize Smart Staffing Calculator recommendations
• Enhance matching algorithms for better connections
• Analyze platform performance and user satisfaction

Product Development:

• Develop new features and services
• Test and implement platform improvements
• Personalize user experience
• Conduct research and analytics

Platform Communications:

• Send booking confirmations and updates
• Provide service notifications and reminders
• Share important safety and policy information
• Deliver customer support messages

Product and Service Communications (sent on an opt-out basis):

• Share platform updates and new features
• Provide educational content, tips, and re-engagement reminders that help you set up, complete, or make fuller use of your account
• Send offers and incentives relating to the bartendersNow™ platform and our own services
• Conduct user surveys and feedback requests

We send these messages to registered account-holders by default, as part of the account relationship you started when you signed up. You can turn them off at any time — use the unsubscribe link included in every such message, or your account settings (see Section 7.2). Turning them off does not affect the transactional messages listed under "Platform Communications" above, which are necessary to provide the service and cannot be disabled.

Newsletter and Third-Party Promotional Communications (with your consent):

• A general-interest newsletter, where we offer one, which you may choose to subscribe to
• Any promotional message featuring a third party's products or services

We send these only if you have affirmatively opted in, and you can withdraw that consent at any time.

Launch-Notification Communications (non-users):

• If you asked us to notify you when we become available in your area, we use the email address you provided to send that notification. That is the only use we make of the address unless you later give us separate consent. Every such message includes a way to unsubscribe, and you may opt out at any time. Once you opt out, we suppress your address from further messages even if you do not have an account with us.

Stock List Copy and Subscription Communications (non-users):

• If you asked us to email you a copy of a Stock List you generated on our marketing website, we use the email address you provided to send you that copy. That is the only use we make of the address unless you also chose to subscribe to bartendersNow™ news and updates, or asked us to follow up after your event. If you did choose to subscribe, we do not add you to that list until you confirm it by clicking the link in a separate message we send you — you are not on the list until you confirm, and if you never confirm, we delete the request and send you nothing further. Every message we send to that list includes a way to unsubscribe, and you may opt out at any time. Once you opt out, we suppress your address from further messages even if you do not have an account with us.
• If you asked us to follow up after your event, we send you one email after your event to ask how your Stock List worked out. That is the only message we send you because of that choice; it does not ask you to sign up for or book anything, and it includes a way to unsubscribe. We do not add your address to any other list because of that choice.

---

Public Profile Information. Your bartender profile is public. The information below is visible to anyone who visits the Platform, including people who are not signed in and do not have an account, whether or not you choose to be featured in our marketing:

• Your first name and last initial, and your profile photograph once it has been screened
• The city and state you serve, and an approximate location, within about a mile and a half, that we use to show how far you are from an event. It is never your street address.
• Your listed rates and the services, equipment, and add-ons you offer
• Your skills, languages, bio, and experience
• Certifications you have entered on your profile, and any certification from your Documents Hub that you choose to show on your profile (its name, issuing organization, issue date and expiration date only), shown as self-reported; we do not review or confirm them, and we never show certificate numbers or document files

If you have not set a working location, the city, state, and approximate location we publish are based on the address you gave us. You can set a working location at any time if you would rather not have your home area shown.

Ratings, reviews, and the number of events you have completed on the Platform are shown only to signed-in users; they are not part of your public profile. When a Host rates and reviews a Bartender, the rating and review are shown on the Bartender's profile to signed-in users together with the reviewer's first name and last initial (for example, "Alex R."). We do not show a reviewer's full name or contact details with a review. When a Bartender leaves feedback about a Host after an event, only the Bartender who wrote it and our team can read it; it is not shown to the Host or to anyone else. A star rating the Bartender gives the Host counts toward the Host's overall rating, which other Bartenders can see. We do not publish your street address, email address, phone number, date of birth, or payment details.

Link Previews. If you have authorized us to feature your profile, a link to your profile may show a preview when it is posted in a messaging or social app (for example, Messages, WhatsApp, Facebook, LinkedIn, or Slack). You, or anyone else, can share that link. The preview shows your profile photograph, your first name and last initial, and the city and state you serve. Ratings, reviews, and rates are never part of the preview. Those apps, and the people who receive the link, may keep their own copies of a preview. When your profile is no longer featured, or no longer meets our requirements to be shown publicly, we stop serving your preview and ask the services that allow it to refresh their copy, but we cannot remove copies that other companies or people have already saved.

Completed Event Teams. After an event is completed, other identity-verified Bartenders who can see that event may also see the first name, last initial, and screened profile photograph of each Bartender who was booked for it, with a link to that Bartender's profile. We do not show this before or during an event, we never show rates or earnings with it, and it is not shown to Hosts or to the public. You can turn this off at any time in Settings ("Show me on completed event teams").

Booking Information:

• Contact details shared after booking confirmation
• Event logistics and coordination information
• Payment and service completion data

Event Safety Notes. If you are a host and you add safety notes to an event, we show them to each bartender while that bartender's booking for the event is confirmed. Bartenders who are browsing events, who have only applied, or whose booking was cancelled or has been completed cannot see them, and we do not include them in emails, push-notification text, public event listings, or analytics. Our support staff may view them only to investigate a safety incident, a dispute, or a report involving the event, or to respond to a privacy request. Please describe situations rather than people, and do not include your guests' names or contact details.

Bartender-Directed Document Sharing. Documents in a bartender's Documents Hub are private by default. A bartender may choose, one certification at a time, to show a summary of that certification on their public profile — its name, issuing organization, issue date and expiration date — which anyone can see as described above, including people who are not signed in. We show a summary only while the bartender's profile is public and only for certifications chosen from our list of certification types; we never show the certificate number or the document file. The bartender can turn this off at any time, and we then remove the summary from the profile, although we cannot remove copies that other people have already saved. The document itself is shared with a host only when the bartender expressly chooses to share that specific document with that specific host, and only with a host the bartender has a confirmed booking or an open booking request with. When a document is shared, the host can open it through a temporary link that expires after 15 minutes; we do not give the host a permanent copy or a downloadable link, and the host's access is re-checked against a live booking relationship each time the host opens the document. A bartender can stop sharing a document at any time. Once sharing is stopped, or the booking relationship ends, the host can no longer open the document — although a link the host already opened may keep working for up to 15 minutes. We do not make sharing decisions on a bartender's behalf, we do not verify any document, and we do not provide documents to hosts, background-check companies, or anyone else except at the bartender's direction or as described in Sections 4.2 and 4.3.

We share information with the third-party service providers ("Sub-processors") identified in the sub-processor table in Section 11.1, which names each provider, its function, the data categories it processes, and its role. The generic categories below correspond to that named table:

Payment Processing (see the named sub-processors in Section 11.1):

• Stripe: Payment processing, identity verification, fraud prevention
• Financial institutions: Transaction processing and verification

Communication Services (see the named sub-processors in Section 11.1):

• Twilio: SMS notifications and communication
• SendGrid: Email delivery and management
• Phone service providers: Voice communication support

Technology Services (see the named sub-processors in Section 11.1):

• Google Maps: Location services and mapping
• Automated content screening: Screening images you upload for explicit or violent content before public display
• Cloud hosting providers: Data storage and platform operation
• Analytics providers: Platform performance and optimization

Legal Compliance:

• Law enforcement: When required by law or court order
• Regulatory authorities: For compliance and investigation purposes
• Legal counsel: For legal advice and representation

Safety and Security:

• Emergency services: In case of safety incidents
• Insurance providers: Our insurers, in connection with an incident, dispute, or liability claim involving bartendersNow™
• Identity verification provider (Stripe Identity): Government-ID identity verification (we do not conduct background checks)

Copyright counter-notifications: If your content is removed after a copyright complaint and you send us a counter-notification to dispute the removal, the Digital Millennium Copyright Act (17 U.S.C. § 512(g)(2)(B)) requires us to send a copy of your counter-notification to the person who filed the original complaint. Your counter-notification must contain your name, address, and telephone number, and a statement consenting to the jurisdiction of a federal court. We are legally required to disclose that information to the complaining party, and we cannot redact it. Please read Section 5 of our DMCA & Copyright Policy before filing a counter-notification so that you understand what will be shared and with whom.

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity, subject to the same privacy protections.

---

Active Accounts:

• Personal and account information: Retained while account is active
• Transaction records: 7 years for financial and tax purposes
• Communications: 3 years for dispute resolution and support
• Analytics and product-usage records: Individual event records are linked to your account and device identifiers while we hold them — they are not anonymized — and are scheduled for deletion 90 days after they are recorded. Aggregated counts derived from them, which contain no account, device, or session identifier, are kept indefinitely.

Inactive Accounts:

• Personal information: Deleted after 2 years of inactivity
• Essential records: Retained as required by law
• Analytics data: The same 90-day schedule described above applies; whether your account is active does not change it

Documents you upload (Documents Hub). We keep a document you upload for as long as you keep it in your Documents Hub and your account is active. When you delete a document, we delete the document record and the underlying file. We also delete documents you have not removed yourself when you have had no interaction with your account for three (3) years, and we delete a document that has never been shared with a host, and that you have not updated, after twelve (12) months. We do not keep a deleted document except where a legal hold, audit, investigation, or legal claim requires us to.

Background-check and fingerprinting-clearance records (heightened sensitivity). Because these records are especially sensitive, we apply the schedule above to them without exception, we store them only so that you can share them with hosts you choose, and we never use them to identify you. This paragraph, together with Section 5.2, is our written retention-and-destruction schedule for these records. We permanently destroy such a record when you delete it, when you delete your account, when you have not shared it for twelve (12) months, or within three (3) years of your last interaction with us — whichever happens first — except where a law requires us to keep it longer.

Profile-photo review records. When you submit a profile photo, we review it before it appears on your public profile, and we keep a record of that review: the photo's review status (for example, awaiting review, approved, or declined), when you submitted it and when we made our decision, which stored image file the decision applies to, and, if we declined the photo, any reason we recorded. Together, these records are the moderation history of your account. We keep them, and any photo of yours that is awaiting review or that we declined, for as long as your account is open, so that we can show you the status of your photo, explain a decision, and respond to a safety report, dispute, or appeal about an image, and longer only where a safety report, investigation, legal hold, audit, or legal claim requires it. We do not show a photo on your public profile until it has been approved. We delete these records and photos as described in Section 5.2.

Profile-display choices. If you are a Bartender, each time you turn on or turn off the option to show a certification from your Documents Hub on your profile, we keep a record of that choice, linked to your account — which document, whether you turned it on or off, when, and which version of the notice you were shown — but not the certification's details. We keep these records while your account is active and for three (3) years after we delete your account, or longer where a legal hold, audit, investigation, or legal claim requires it. If you ask us to delete your personal information, we keep these records as proof of the choices you made, as permitted by California Civil Code Section 1798.105(d), and we include them when you ask for a copy of your information, as described in Section 12.

Event Safety Notes. We delete the contents of an event's safety notes thirty (30) days after the event ends or, if the event is cancelled, thirty (30) days after it is cancelled. After that we keep only a record that notes existed, when and by whom they were changed, and which kinds of notes were changed — not what they said. This shorter period applies to safety notes instead of the period for Communications above. We keep the contents longer only where a legal hold, investigation, dispute, or legal claim involving the event requires it.

Security and system logs. Our servers automatically record technical logs when the Platform is used, such as a request's IP address and browser information, the page, function, or database or file record requested, the time, and any email address entered to sign in, create an account, or reset a password, including when the attempt fails or no account exists for that address. If you are signed in, the logs also include your account identifier, your email address, and when and how you signed in. We use these logs only to secure and operate the Platform, detect and investigate security incidents and fraud, identify and notify anyone affected by an incident, and comply with the law. They are separate from the analytics records described above and are never used for analytics or advertising, and access to them is limited to the personnel responsible for securing the Platform. We keep them for up to 400 days, after which they are deleted automatically, unless a legal hold, investigation, or legal claim requires us to keep specific entries longer.

Legal Requirements:

• Tax records: 7 years as required by law
• Safety incidents: As required for legal proceedings
• Regulatory compliance: As mandated by applicable authorities
• Compliance and legal acknowledgment records: Where you accept a legal acknowledgment, attestation, or certification on the platform (for example, a bartender's independent-contractor and responsible-service acknowledgments, or a host's event-compliance attestation), we retain a record of that acceptance — the date and time, the identifier of the version of the terms you accepted, and the responses you gave — for eight (8) years following the end of your relationship with bartendersNow™, or longer where a legal hold, audit, investigation, or legal claim requires it. This retention is necessary for us to comply with our legal obligations and to establish, exercise, or defend legal claims.

Identity-verification and identity-change records. When you complete identity verification, we record the result of the age check we run against the date of birth on your identity document — the date of birth we verified, whether you met the minimum age of 21, the date and time of the check, the source of the date, and the identifier of the Stripe verification session. Where that check replaces the date of birth you entered yourself, we also keep a separate, unalterable record of the change, showing the previous value and the new value. If identity verification did not return a date of birth, we keep the date you entered and the result of the check on the same terms. We retain these records for eight (8) years following the end of your relationship with bartendersNow™, or longer where a legal hold, audit, investigation, or legal claim requires it. We keep them so that we can comply with our legal obligations, show whom we verified and what we relied on, and establish, exercise, or defend legal claims, including claims arising from alcohol service — as permitted by California Civil Code Sections 1798.105(d) and 1798.145(a). Where our support team corrects a verified legal name, date of birth, or address, the record of that correction, and any document you provide to support it, are held separately under restricted access and are destroyed twenty-four (24) months after the correction is made. None of the records described in this paragraph is shown to Hosts, to other Bartenders, or to you through the platform; you may request a copy, and we will tell you what we have retained and why, as described in Section 12.

Copyright, Trademark, and Abuse Reports: When someone sends us a copyright complaint, a trademark concern, or another abuse report, we retain that report and the reporter's identity and contact information for three (3) years from the date the matter is finally resolved. A matter is finally resolved on the latest of: the date we remove or restore the content; the close of the counter-notification waiting period; or the close of any appeal window and our decision on the appeal.

After that three-year period, we automatically redact the reporter's personal contact information and keep only a de-identified record of the report — for example, the date, the content involved, the work claimed, our determination, and the action we took. We keep this de-identified record for the life of the reported user's account and for three years after the account is closed or terminated.

Strikes do not expire. Retaining a copyright notice for three years is not the same as a strike expiring. A strike we issue under our repeat-infringer policy remains on the account for as long as the account is open. If we terminate an account under that policy, we keep a permanent, de-identified record of the termination — with no readable personal information — because federal law (17 U.S.C. § 512(i)) requires us to reasonably implement a policy for terminating repeat infringers, and we cannot do that if a terminated user can erase the record by deleting and re-registering.

All of the periods above are suspended, and no information is deleted or redacted, while a legal hold, subpoena, preservation request, audit, investigation, or legal claim requires us to keep it.

Launch-Notification Requests (non-users): We retain an email address submitted through a launch-notification request until 90 days after we send the launch notification, or 24 months from the date you submitted it if we have not yet launched in your area, whichever occurs first — after which we delete it. If you unsubscribe or ask us to delete it sooner, we honor that request and keep only the minimum suppression record needed to ensure you stay unsubscribed.

Stock List Copy Requests (non-users): If you asked us to email you a copy of a Stock List and you did not subscribe to anything or ask us to follow up after your event, we do not keep your email address: we use it to send you that copy and to check a short-lived abuse-prevention counter, which holds no readable email address and is deleted automatically. If you also chose to subscribe to bartendersNow™ news and updates, we keep your email address, your confirmation that you are 21 or older, and the record of the choice you made and when you made it, until you unsubscribe or ask us to delete them. If you do not complete the confirmation step, we delete the request once it is more than thirty (30) days old. If you unsubscribe or ask us to delete your address sooner, we honor that request and keep only the minimum suppression record needed to ensure you stay unsubscribed. The event details you entered are used to produce the copy we send you. If you did not subscribe and did not ask us to follow up after your event, they are not kept together with your address. If you subscribed, we keep them, and the ZIP code or city you entered for your event, together with your address only until the earliest of the day after the event date you entered, 90 days after the last message we send you about that event, twelve (12) months from when you entered them, or the date you unsubscribe or ask us to delete them; if you do not complete the confirmation step, we delete them with your request. Any de-identified summary of your calculation is kept only as described under "Free planning-tool summaries" below.

Stock List Follow-Up Requests (non-users): If you asked us to follow up after your event, we keep your email address, and the link between it and the event details described in Section 2.4, only as long as we need them to send that one follow-up — no more than 90 days after we send it, and no more than twelve (12) months from when you asked if we never send one — after which we delete them. If you also subscribed to news and updates, we keep your address for that subscription as described above, but we still delete the link to those event details on this schedule. If you unsubscribe or ask us to delete your address sooner, we honor that request and keep only the minimum suppression record needed to ensure you stay unsubscribed. What we keep to improve the tool after that link is deleted is de-identified and generalized: it contains no email address, it keeps your event's date no more precisely than its month and its area no more precisely than the state and the first three digits of its ZIP code, and it cannot be traced back to you. We do not attempt to re-identify anyone from it, and we require anyone who receives it from us to do the same. We keep it for no longer than twenty-four (24) months from when you asked for the follow-up. It is separate from the planning-tool summaries described in Section 2.2.

Free planning-tool summaries (no account required): We keep an individual de-identified planning-tool summary of the kind described in Section 2.2 for no longer than twenty-four (24) months from the date we record it, after which it is deleted automatically. We also keep aggregated counts derived from those summaries, which contain no account, device, or session identifier and cannot be traced back to you, on the same twenty-four (24) month schedule. Where this paragraph and the general statements about aggregated counts in this Section and in Section 5.2 differ, the shorter period in this paragraph is the one that applies to planning-tool summaries.

When information is deleted:

• Data is removed from active databases within 30 days and purged from disaster-recovery backups in accordance with our standard automated backup retention cycles
• Security and system logs are deleted on the schedule described in Section 5.1, not within 30 days of a deletion request.
• We keep aggregated analytics counts — totals that contain no account, device, or session identifier and cannot be traced back to you — after the underlying records are deleted. We do not otherwise keep an anonymized copy of information you asked us to delete.
• We maintain these aggregated counts only in aggregated form, we do not attempt to re-identify any individual from them, and we require anyone who receives them from us to do the same.
• Documents you upload. When you delete a document from your Documents Hub, we delete both the document record and the stored file. When you ask us to delete your account, or make a verified request to delete your personal information under Section 12, we delete the documents in your Documents Hub and the underlying files as part of fulfilling that request, within the response times described in Section 12.5. A temporary access link a host already opened may continue to work for up to 15 minutes after you stop sharing or delete a document.
• Profile photos. When you ask us to delete your account, or make a verified request to delete your personal information under Section 12, we delete your profile photo — the published photo, any photo still awaiting review, and any photo we declined — together with the stored image files and the profile-photo review records described in Section 5.1, as part of fulfilling that request, within the response times described in Section 12.5. We remove the photo from your public profile at the same time. We keep a photo or a review record only where a law, a legal hold, an audit, an investigation, or a legal claim requires us to, and if that happens we will tell you what we kept and why when we respond to your request, as described in Section 12.1.
• When we keep a document you asked us to delete. We will keep a document only where a law, a legal hold, an audit, an investigation, or a legal claim requires us to. If that happens, we will tell you which document we kept and why when we respond to your request, as described in Section 12.1.

---

Technical Safeguards:

• Encryption in transit: every connection to the Platform uses HTTPS with TLS, and we require it (HTTP Strict Transport Security)
• Encryption at rest: information stored in our cloud database and file storage is encrypted at rest using AES-256 keys managed by our cloud provider
• Payment cards: your card details are handled and tokenized by Stripe under the PCI Data Security Standard, and we never store your full card number
• Restricted access: access to systems holding personal information is limited by role, and access to the content of your messages additionally requires an open, linked abuse report and is written to an audit log

What this does not mean. The Platform is not end-to-end encrypted. Encryption in transit and at rest protects your information from outsiders and from other users; it does not put your information beyond our own reach. We can access the content of messages in the limited, role-restricted, logged circumstances described above, and we will do so where the law requires it — including our mandatory reporting obligations relating to suspected child sexual exploitation.

Administrative Safeguards:

• Access to personal information is limited to what a person needs to do their work
• Personnel and contractors with access to personal information are subject to confidentiality obligations and access controls, and we conduct background screening of such personnel where appropriate and permitted by law
• We keep a record of administrative access to message content, as described above

Infrastructure:

• The Platform runs on Google Cloud Platform. The physical security of the facilities where your information is stored — restricted access, environmental controls, and secure disposal of storage media — is provided by that cloud provider under its own security programme, not by us directly.

Account Protection:

• Use strong, unique passwords
• Enable two-factor authentication when available
• Immediately report suspected unauthorized access
• Keep your contact information current for security notifications

Safe Platform Use:

• Verify identity of other users before sharing personal information
• Report suspicious activity or safety concerns
• Follow platform safety guidelines and best practices

---

Profile Management:

• Update personal information and preferences
• Control visibility of profile information
• Manage communication preferences
• Ask us for a copy of your data in a portable format (see Section 12.5)

Privacy Controls:

• Opt-out of marketing communications
• Control sharing of certain information
• Manage cookie preferences via your browser and, for California residents, at /legal/do-not-sell
• Request account deletion

Email Communications:

• Transactional emails: Cannot be disabled (booking confirmations, safety notices)
• Product and service emails (platform updates, tips, re-engagement reminders, our own offers and incentives, and surveys): Sent by default; you can turn them off at any time via the unsubscribe link in any such message or in your account settings
• Newsletter: Optional — sent only if you subscribe, and you can unsubscribe at any time
• Third-party promotional emails: Sent only with your opt-in consent

SMS Communications (if we send you text messages):

• Booking notifications: Can be managed in account settings
• Security alerts: Cannot be disabled for safety reasons
• Marketing messages: Opt-in required, easy opt-out

Access Your Data:

• Ask us what personal information we have about you
• Ask us for a copy of your information in a portable, machine-readable format
• Request copies of specific categories of information

Data Portability:

• Ask us for a copy of your profile information
• Ask us for a record of your bookings and payments
• Receive the copy in a commonly used format, to the extent technically feasible

The app does not offer a download of your data. To make any of these requests, email us as described in Section 12.5.

---

Essential Cookies:

• Authentication and security
• Platform functionality and features
• Shopping cart and booking persistence
• Load balancing and performance

First-Party Analytics Cookies:

• First-party product measurement via Firebase Analytics (Google Analytics 4)
• Used strictly for internal platform operation under the CCPA/CPRA Business Purpose Exception
• No cross-context behavioral advertising trackers. On the marketing website only, a consent-gated first-party Google Ads conversion-measurement tag (advertising storage denied by default; measurement only, never ad personalization), with Google acting as our service provider — see Section 11.1

Marketing/Advertising Cookies:

• In the bartendersNow™ web application: none — no marketing or advertising cookies, advertising pixels, or cross-context behavioral advertising trackers. On our marketing website: a first-party Google Ads conversion-measurement tag, consent-gated with advertising storage denied by default (no advertising cookie or identifier without your affirmative opt-in), used solely for conversion measurement and never for ad personalization or cross-context behavioral advertising, with Google acting as our service provider. See Cookie Policy §2.3 and §11.1.

Browser Controls:

• Most browsers allow you to manage cookie preferences
• You can block or delete cookies, but this may affect platform functionality
• Private/incognito browsing modes limit cookie tracking

Platform Controls:

• California residents may exercise Do Not Sell or Share options at /legal/do-not-sell
• Browser-level Global Privacy Control (GPC) signals are honored by default
• Regular review and update of cookie policies

In the bartendersNow™ web application we use no third-party advertising pixels or cross-context behavioral advertising trackers. On our marketing website we use a first-party Google Ads conversion-measurement tag, consent-gated with advertising storage denied by default; it measures advertising effectiveness only and is never used for ad personalization, remarketing, or cross-context behavioral advertising, and no advertising cookie or identifier is set without your affirmative opt-in. The platform does not sell personal information or share personal data for cross-context behavioral advertising. First-party product analytics are provided by Firebase Analytics (Google Analytics 4) for internal platform operation, as described in Section 2.2.

The product-and-service (lifecycle) email we send you — for example platform updates, tips, and re-engagement reminders (see Section 3.4) — contains standard email-measurement technologies: a small, invisible image (a "pixel" or "web beacon") that tells us whether a message was opened, and links that route through our email provider so we can tell whether you clicked them. We use this only to measure whether our own messages are delivered, opened, and acted on, so that we can improve them. Our email provider (Twilio SendGrid) processes this information for us as a service provider (see Section 11.1); we do not use it for cross-context behavioral advertising, and we do not sell or share it. Turning off product-and-service email — through the unsubscribe link in any such message or in your account settings (see Section 7.2) — also stops this measurement for those messages. We also record technical delivery events (such as whether a message was delivered or bounced) for the email we send, including transactional messages, for operational and security purposes. The copy we email when you ask us for a Stock List, and the message we send to confirm a subscription, are delivered through the same provider and carry the same delivery, open, and click measurement, which we use only to confirm that the message you asked for was delivered and worked. The news and updates we send to people who subscribed through our Stock List tool, and the one follow-up email we send after an event to people who asked for it, are delivered through the same provider and may carry the same delivery, open, and click measurement, which we use only to measure whether those messages are delivered, opened, and acted on.

---

Platform Access:

• You must be at least 21 years old to create an account or use the platform, whether as a Host or as a Bartender. This is the eligibility requirement set out in Section 3.1 of our Terms of Service, and it applies to the whole platform, not only to alcohol service.
• We do not knowingly collect information from anyone under 13, and the platform is not directed to children.

If we discover we have collected information from a child under 13:

• We will delete the information immediately
• We will terminate the account
• We will notify parents if contact information is available

Parents can contact us to:

• Review information collected from their child
• Request deletion of their child's information
• Refuse further collection of their child's information

---

Primary Storage:

• United States (Google Cloud Platform)
• Subject to U.S. privacy laws and regulations
• Enhanced protection for California residents under CCPA/CPRA

Cross-Border Transfers:

• May occur for service provision and support
• Adequate safeguards implemented for international transfers
• Compliance with applicable international privacy frameworks

Transfer Mechanisms:

• Standard contractual clauses
• Adequacy decisions where applicable
• Binding corporate rules for service providers

---

To support delivery of our services, bartendersNow engages third-party service providers ("Sub-processors") that may access or process certain user data:

† Implemented for bot protection upon feature activation.

‡ Active on the marketing website only, governed by Google Consent Mode v2 with advertising storage denied by default. Advertising storage is enabled only after you accept the "Marketing & Advertising" category; ad personalization and ad-user-data remain denied in all states, and Google processes the data as our service provider under Restricted Data Processing. Not used in the bartendersNow™ web application.

§ Automated image screening classifies an image for explicit or violent content only. It does not identify anyone, does not analyze facial geometry, and does not create or store any biometric template. Under the provider's published terms, images sent for this screening are not used to train the provider's models and are deleted after processing; we retain only the screening outcome. A photo the automated screen flags is reviewed by a person before any decision is made.

We are not responsible for:

• Privacy practices of third-party services
• Data collection by external websites or applications
• User interactions outside our platform

We encourage you to review privacy policies of all services you use.

---

We Do Not Sell or Share Your Personal Information: We do not sell your personal information. We use a first-party Google Ads conversion-measurement tag on our marketing website solely to measure advertising effectiveness; we do not use it for ad personalization or remarketing, and Google processes this measurement data on our behalf as a service provider under Restricted Data Processing, not for its own cross-context behavioral advertising. On that basis we do not "share" personal information for cross-context behavioral advertising as defined by the CPRA, and we have not sold or shared personal information in the preceding twelve (12) months. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" opt-out mechanism, and none is required. You can still decline this tag at any time by rejecting the "Marketing & Advertising" category in our cookie banner or through the "Manage cookies" control, and we honor Global Privacy Control (GPC) signals by default. This statement is provided in accordance with the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations.

Right to Know:

• Categories of personal information collected
• Sources of personal information
• Business purposes for collection and sharing
• Categories of third parties who receive information

Right to Delete:

• Request deletion of personal information we have collected
• Exceptions for legal requirements and business operations, as permitted by California Civil Code Section 1798.105(d). In particular, we will retain records of legal acknowledgments, attestations, and certifications you accepted, and records of the profile-display choices described in Section 5.1, together with transaction and tax records, where retention is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims. We will tell you which categories we have retained and why when we respond to your request.
• Confirmation of deletion upon completion

Right to Opt-Out:

• We do not sell your personal information, so there is no sale for you to opt out of.
• We do not share your personal information for cross-context behavioral advertising — our Google Ads conversion tag is measurement-only and Google processes that data as our service provider — so there is no sharing for you to opt out of.
• We do not use automated decision-making technology to make decisions that produce legal or similarly significant effects concerning you. We do use automated tools to screen images you upload for explicit or violent content; a photo the automated screen flags is reviewed by a person before any decision is made, and no automated tool decides whether you may use the platform, appear in search, be booked, or how much you are paid. If we ever use automated decision-making for a decision of that kind, we will give you notice and a way to opt out before we do.

Right to Correct:

• Request correction of inaccurate personal information
• Update most of your information directly through account settings
• Your date of birth is locked in account settings once you complete identity verification, because the date we hold is the one on your government-issued identity document. To correct it, or to correct a verified legal name or address, contact us. We will verify both your request and the corrected detail — using a government-issued document where the detail is your name or date of birth — before we make the change. We will not change a verified identity detail on your statement alone.
• Contact us for assistance with any correction

Right to Limit:

• Limit use and disclosure of sensitive personal information
• Control sharing of sensitive categories of data
• Manage permissions for specific data uses

Right to Non-Discrimination:

• We will not discriminate against you for exercising your rights
• Same service quality regardless of privacy choices
• No denial of services for exercising rights

Limitation on Sensitive Personal Information: We collect Sensitive Personal Information (including government-issued ID and precise geolocation) solely for necessary platform operational purposes, identity verification via Stripe, fraud prevention, and service fulfillment. We do not use or disclose Sensitive Personal Information for purposes that require a "Right to Limit" opt-out under California law.

Identifiers:

• Name, email, phone number, IP address
• Date of birth
• Residential or mailing address and ZIP code
• Government-issued ID for verification
• Device identifiers and account numbers
• For non-account holders who submit a launch-notification request, the only personal information we collect is an email address, the general area (such as a city) you asked us to notify you about, your confirmation that you are 21 or older, and the record of when you gave it.
• For non-account holders who ask us to email a copy of a Stock List, the personal information we collect is an email address and your confirmation that you are 21 or older; we keep them only if you also chose to subscribe to news and updates or asked us to follow up after your event (see Section 5.1), and in that case we also keep the event details you entered, for the limited purposes and periods described in Sections 2.4 and 5.1.

Commercial Information:

• Transaction history and payment records
• Service preferences and booking history
• Reviews and feedback provided

Biometric Information:

• Identity verification is conducted by our third-party service provider (Stripe, Inc.), which may collect and process biometric verification data pursuant to Stripe's Privacy Policy. Stripe uses its own automated face-matching technology to compare a selfie you take with the photo on your identity document. Midnight Logic, Inc. does not receive, store, or have access to raw biometric templates.
• Authorized members of our team may view the identity-document and selfie images in Stripe's dashboard to compare them with a Bartender's profile photo, for identity-verification and fraud-prevention purposes. That comparison is made by eye; we do not copy, download, screenshot, or store those images, and we do not create any biometric template from them.

Internet/Network Activity:

• Platform usage and navigation data
• Search queries and interaction patterns
• Device and browser information
• Email delivery, open, and click activity for messages we send you

Geolocation Data:

• Current location for service matching
• Service area preferences
• Travel and availability patterns

Professional Information:

• Bartending licenses and certifications
• Professional experience and references
• Business information and credentials

Sensitive Personal Information:

• Government-issued ID for verification
• Biometric identity-verification data processed by Stripe Identity (see below)
• Identity-document and selfie images that authorized members of our team view in Stripe's dashboard to compare with a Bartender's profile photo (see below)
• Financial account information for payments
• Precise geolocation when using mobile features
• Information contained in background-check or fingerprinting-clearance records you choose to upload
• Health information, such as allergies, that a host chooses to include in an event's safety notes

Identity Verification and Biometric Sensitive Personal Information (Stripe Identity). For bartender onboarding and fraud prevention, our third-party provider Stripe, Inc. ("Stripe Identity") collects and processes government-issued identification and facial/biometric verification data. Under the California Privacy Rights Act (Cal. Civ. Code § 1798.140(ae)), this constitutes Sensitive Personal Information. We use and permit the processing of this information solely for identity verification, fraud prevention, and compliance with applicable legal and regulatory obligations. Stripe processes this data as an independent service provider and controller under its own privacy policy; Midnight Logic, Inc. does not receive, store, or have access to raw biometric templates, and we do not use, sell, share, or otherwise disclose this Sensitive Personal Information for any commercial purpose or for cross-context behavioral advertising. Authorized members of our team may also view the identity-document and selfie images in Stripe's dashboard, solely to compare them with the Bartender's profile photo for identity-verification and fraud-prevention purposes; we view them only within Stripe's dashboard, we do not copy, download, screenshot, or store them, and we keep a record of the outcome of the comparison and of who made it and when, but not the images. As described in Section 12.1, we do not use this information for purposes that would trigger a "Right to Limit" opt-out under California law.

Background-check and fingerprinting-clearance records (Documents Hub). If you upload a background-check or fingerprinting-clearance record to your Documents Hub, any government identification number, biometric identifier, or health information that record contains is Sensitive Personal Information under the California Privacy Rights Act (Cal. Civ. Code § 1798.140(ae)). We store the record solely to keep it available to you and to enable the sharing you direct, as part of the service you requested. We do not use it to identify you, we do not use or disclose it for any commercial purpose or for cross-context behavioral advertising, and, consistent with Section 12.1, we do not use it for purposes that would trigger a "Right to Limit" opt-out under California law. Sharing a document with a host you have chosen is a disclosure you direct and that is necessary to provide the sharing service you requested.

Event Safety Notes. Health information, such as an allergy, that a host includes in an event's safety notes is Sensitive Personal Information under the California Privacy Rights Act (Cal. Civ. Code § 1798.140(ae)). We use it solely to show it to the bartenders booked for that event and, where needed, to investigate a safety incident or dispute involving the event or to respond to a privacy request. We do not use or disclose it for any other purpose, we do not sell or share it, and, consistent with Section 12.1, we do not use it for purposes that would trigger a "Right to Limit" opt-out under California law. We delete it on the schedule in Section 5.1.

Service Provision:

• Facilitate marketplace connections
• Process bookings and payments
• Provide customer support and communication
• Respond to launch-notification requests from non-account holders by sending the availability notification they asked for
• Email a copy of a Stock List to a non-account holder who asked us for one, and add them to bartendersNow™ news and updates only if they separately chose that and confirmed it — and, for those subscribers, fill in the event details they entered if they create their event with us
• Email a non-account holder once after their event, if they asked us to, to ask how a Stock List worked out, and use what they tell us, in de-identified form, to improve our Stock List recommendations
• Store documents you upload to your Documents Hub and deliver them to hosts you choose to share them with
• Show a host's event safety notes to the bartenders booked for that event
• Show other identity-verified bartenders who was on the team of a completed event they can see, unless a bartender has turned this off in Settings
• Show a preview of a featured bartender's profile when a link to it is shared in a messaging or social app

Security and Fraud Prevention:

• Verify user identities and credentials
• Monitor for suspicious activity
• Protect platform integrity and safety
• Screen uploaded images for explicit or violent content before they are displayed publicly
• Compare a Bartender's profile photo, by eye, with the identity-document and selfie images viewed in Stripe's dashboard, to help confirm that the person in the photo is the person who verified

Internal Operations:

• Improve platform features and algorithms
• Conduct analytics and research
• Maintain and optimize platform performance
• First-party operational analytics via Firebase Analytics (Google Analytics 4) for session tracking, booking funnels, and sign-ins, under the CCPA/CPRA Business Purpose Exception (Cal. Civ. Code § 1798.140(e))

Legal Compliance:

• Comply with applicable laws and regulations
• Respond to legal requests and investigations
• Protect rights and interests of all parties

Direct from You:

• Account registration and profile creation
• Booking requests and service coordination
• Communications and feedback
• Launch-notification requests submitted by people who do not have an account
• Stock List copy requests submitted by people who do not have an account
• Documents you upload to your Documents Hub

From Your Platform Use:

• Device and browser information
• Usage patterns and preferences
• Location and interaction data

From Third Parties:

• Identity verification services (Stripe)
• Payment processing partners
• Government-ID identity verification via Stripe Identity (we do not use background check providers)

Submitting Requests: To exercise your Right to Know, Delete, Correct, or Opt-Out, please submit a verifiable consumer request to us via:

• Email: privacy@bartendersnow.com (Subject: "CCPA Privacy Request")
• In the app: Registered users can update much of their account information in the app. To request a copy of your information, email us as described above.

Verification Process: To protect your privacy, we must verify your identity before we act on your request. How we verify depends on whether you have an account with us.

• If you have an account: We verify your request by matching the email address and profile details you provide against the information in your account.
• If you do not have an account (for example, because you sent us a copyright, trademark, or abuse report): We verify your request by matching at least three data points you provide against the information in the report you sent us. For a request to access specific pieces of personal information, we will also ask you to provide a signed declaration, under penalty of perjury, that you are the person you claim to be. We apply this heightened standard because the personal information in a report could be sought by someone trying to identify the person who filed it.

We will never ask you to send us a government-issued identification document or a photograph of one to verify a privacy request.

Response Timeline: We will acknowledge receipt of your request within 10 business days and provide a substantive response within 45 calendar days of receipt. When reasonably necessary — for example, because of the complexity or volume of your request — we may extend that period by up to an additional 45 calendar days, for a total of up to 90 calendar days. If we need the additional time, we will notify you of the extension, and the reason for it, within the first 45-day period.

You may designate an authorized agent to exercise your rights on your behalf:

• Provide written authorization for the agent
• Verify your identity and the agent's authority
• Agent must follow our verification procedures

---

Nevada residents have the right to opt-out of the sale of their personal information. We do not currently sell personal information as defined by Nevada law. If our practices change, we will update this policy and provide opt-out mechanisms as required.

---

We may update this Privacy Policy to reflect:

• Changes in our information practices
• New features or services
• Legal or regulatory requirements
• Industry best practices and standards

Material Changes:

• Email notification to registered users
• Prominent notice on our platform
• 30 days' notice before changes take effect

Minor Changes:

• Updated policy posted on platform
• "Last Updated" date revised
• Continued use constitutes acceptance

We encourage you to review this policy periodically. Your continued use of our platform after policy updates constitutes acceptance of the changes.

---

For questions about this Privacy Policy or our privacy practices:

Email: privacy@bartendersnow.com
Subject: Privacy Policy Inquiry
Response Time: Within 5 business days

To exercise your California privacy rights:

Email: privacy@bartendersnow.com
Subject: CCPA Rights Request
Include: Full name, account email, specific request details

Email: privacy@bartendersnow.com
Role: Privacy compliance and data protection oversight

Midnight Logic, Inc.
650 Nuttman St, Ste 114
Santa Clara, CA 95054
Email: legal@bartendersnow.com
Phone (voicemail): (888) 548-9469

---

This Privacy Policy is effective as of July 20, 2026 and applies to all information collected from that date forward.

By using the bartendersNow™ platform, you acknowledge that you have read, understood, and agree to this Privacy Policy and the collection, use, and disclosure of your personal information as described herein.

---

This Privacy Policy was last updated on October 30, 2026 and reflects current California and federal privacy laws. We are committed to maintaining the privacy and security of your personal information and will continue to update our practices as laws and technologies evolve.