Privacy Policy

1.1 Platform Coverage

1.2 Relationship to Other Terms

1.3 Hosts and Other Third Parties

This Privacy Policy applies to personal information we collect through the Platform, through communications with you, through integrations and service providers, through payment and verification workflows, through marketing activities, and through other interactions that link to or reference this Privacy Policy. It applies whether you are a visitor, account holder, Host, Participant, voter, donor, purchaser, winner, judge, sponsor, administrator, team member, creator, payee, support contact, or other user.

This Privacy Policy is part of the overall terms that govern your use of the Platform. Some features, campaigns, subscriptions, promotions, integrations, or beta programs may include additional privacy disclosures. Campaign-specific rules may also describe how a Host or sponsor handles information that you provide for that campaign. If a supplemental privacy notice conflicts with this Privacy Policy, the supplemental notice controls only for the specific feature or transaction it describes, unless it states otherwise.

Many campaigns are created and managed by Hosts, not by ChallengeForge. Hosts may collect, view, export, download, use, or share information about participants, submissions, votes, judges, donors, sponsors, and campaign activity. A Host's handling of your information may also be governed by that Host's own privacy notices, campaign rules, terms, or policies. We are not responsible for the independent privacy practices of Hosts, sponsors, judges, vendors, websites, social networks, or other third parties that are not acting on our behalf.

2.1 Personal Information

2.2 Platform Data and User Content

2.3 Aggregated, De-Identified, Derived, and Statistical Data

2.4 Platform Intelligence

"Personal information" means information that identifies, relates to, describes, can reasonably be associated with, or could reasonably be linked to an identified or identifiable person, household, or device. Depending on applicable law, personal information may include account details, profile information, identifiers, contact information, payment information, verification documents, technical data, online activity, geolocation-related signals, content, communications, inferences, and other information described in this Privacy Policy.

"Platform Data" means information generated through your use of the Platform, including account activity, challenge participation, submissions, votes, rankings, leaderboards, payment activity, support requests, device data, usage analytics, referral activity, QR scans, and related records. "User Content" means content, information, data, text, images, videos, audio, code, designs, prompts, comments, votes, ratings, reviews, submissions, applications, biographies, profile information, campaign materials, files, documents, feedback, messages, and other materials that you or other users submit, upload, post, display, transmit, import, generate, provide, or make available through the Platform.

"Aggregated Data" means information combined with other information so it does not identify a particular person. "De-Identified Data" means information processed so it cannot reasonably be used to identify a person, subject to legal requirements that may apply. "Derived Data" means information, insights, scores, predictions, classifications, calculations, metadata, metrics, or analysis created from or about Platform activity. "Statistical Data" means numerical, trend, benchmark, performance, conversion, engagement, fraud, ranking, voting, campaign, market, product, or business intelligence data generated from Platform activity.

"Platform Intelligence" means aggregated, de-identified, derived, statistical, benchmarking, and analytical information created from Platform activity, including campaign performance metrics, voting analytics, referral analytics, QR analytics, conversion analytics, engagement analytics, fraud analytics, moderation analytics, payout analytics, donation analytics, industry benchmarking information, and related insights used for product development, research, security, fraud prevention, marketing, partnerships, and business operations.

3.1 Account Information

3.2 Profile Information

3.3 Communications and Support Information

When you create or manage an account, we may collect your name, email address, username, handle, display name, phone number, password, password reset information, authentication credentials, login methods, two-factor authentication settings, account recovery information, organization name, team name, role, permissions, administrator status, billing contact details, and other information you choose to provide. If you sign in with a third-party service, we may receive identifiers, profile details, authentication tokens, email verification status, and other information permitted by that service and your settings.

You may choose to provide profile information, including biographies, photos, avatars, logos, social media links, websites, portfolio links, professional descriptions, location, skills, interests, team affiliations, school or organization details, creator descriptions, sponsor information, public profile settings, and other information you want to display or use on the Platform. Some profile information may be public or visible to Hosts, participants, judges, sponsors, team members, voters, donors, or other users depending on your settings, campaign configuration, and Platform features.

When you contact us, respond to surveys, participate in research, submit feedback, request support, report abuse, dispute a transaction, appeal an enforcement action, communicate about verification, or otherwise communicate with us, we may collect the contents of your communications and related information. This may include your name, email address, phone number, account identifier, screenshots, attachments, device information, support history, call or chat records, issue details, dispute records, and any other information you provide.

4.1 Participation and Hosting Activity

4.2 Rankings, Leaderboards, Votes, and Results

4.3 Campaign Communications

We collect information about the campaigns you create, host, sponsor, manage, enter, view, follow, vote in, judge, donate to, purchase from, share, comment on, or otherwise interact with. This may include campaign names, descriptions, rules, deadlines, eligibility settings, entry requirements, judging criteria, prize information, registration records, entry timestamps, participation status, votes, ratings, scores, comments, reviews, judging assignments, moderation decisions, disqualification records, appeals, campaign settings, sponsor details, campaign pages, and administrative activity.

We collect and generate information related to votes, rankings, leaderboards, finalist lists, winner lists, badges, points, judging outcomes, engagement metrics, vote validity, voter eligibility, referral activity, fraud signals, campaign performance, and related results. This may include public and nonpublic records used to calculate, audit, display, adjust, invalidate, or preserve campaign outcomes. We may keep records showing how rankings, votes, and results changed over time for integrity, dispute, safety, legal, and operational purposes.

We may collect messages, announcements, notifications, reminders, invitations, updates, judging communications, host-participant communications, team communications, winner communications, sponsor communications, and other campaign-related communications sent through or connected to the Platform. We may process these communications to deliver messages, provide support, enforce rules, investigate abuse, protect users, prevent fraud, resolve disputes, and maintain campaign records.

5.1 Content You Upload or Submit

5.2 Metadata and File Information

5.3 Content Visibility

When you upload, submit, post, import, generate, or transmit User Content through the Platform, we collect the content itself and related information. This may include photos, videos, audio recordings, text, artwork, designs, code, datasets, documents, PDFs, presentations, prototypes, links, files, captions, transcripts, descriptions, metadata, tags, categories, prompts, AI outputs, comments, feedback, ratings, applications, entry forms, release forms, eligibility responses, and other materials.

Submissions and files may include metadata such as file names, file sizes, file types, creation dates, modification dates, upload dates, device information, camera or software information, location-related metadata, embedded tags, image dimensions, video duration, audio properties, checksum data, and technical information needed to store, display, process, transcode, moderate, analyze, search, rank, and secure content. You should review files before uploading them if you do not want embedded metadata to be processed or made available.

Some User Content may be public, some may be visible only to a Host, judges, sponsors, administrators, team members, donors, or selected participants, and some may be private to you. Visibility depends on Platform features, campaign rules, settings, submission status, moderation decisions, legal obligations, and how you or a Host configure the campaign. Even when content is not publicly displayed, we may access, process, preserve, analyze, disclose, or use it as described in this Privacy Policy and our terms.

6.1 Payment Activity

6.2 Creator Monetization and Payouts

6.3 Payment Risk and Compliance

When you make or receive payments through the Platform, we and our payment service providers may collect information about purchases, entry fees, hosting fees, service fees, donations, subscriptions, add-ons, upgrades, refunds, reversals, chargebacks, payouts, taxes, credits, promotions, coupons, invoices, receipts, billing addresses, shipping information, payment method details, transaction identifiers, processor responses, payment status, risk reviews, dispute records, and related communications. We generally rely on payment processors to handle full card numbers, bank account numbers, and similar sensitive payment credentials, although we may receive tokens, partial payment details, status information, and records needed to operate the Platform.

If you receive payouts, donations, prize-related payments, creator earnings, campaign proceeds, sponsorship payments, refunds, reimbursements, or other disbursements through Platform-supported flows, we may collect payout account information, tax information, legal name, business name, address, date of birth, ownership information, beneficial owner details, payout status, payout history, payout holds, reserve information, refund obligations, chargeback records, compliance records, and documentation required by payment networks, financial partners, tax authorities, or applicable law.

We may collect and use payment-related information to detect fraud, prevent abuse, review eligibility, verify identity, manage chargebacks, resolve disputes, comply with sanctions and anti-money-laundering expectations, apply reserves or holds, calculate fees, issue tax forms, support audits, and protect the Platform. These activities support operational payment administration and Platform integrity. They do not make ChallengeForge a bank, fiduciary, trustee, escrow agent, money transmitter, investment adviser, broker, insurer, or financial adviser to you.

7.1 Identity Verification

7.2 Tax and Business Documentation

7.3 KYC and Risk Reviews

We may ask you to provide verification information before or after you create an account, host a campaign, enter a campaign, vote, judge, receive a payout, access certain features, claim a prize, administer funds, use paid services, or continue using the Platform. Verification information may include government identification, driver's license, passport, national ID, selfies, facial images, liveness checks, proof of address, date of birth, phone verification, email verification, business registration documents, nonprofit documents, school or organization records, authority documentation, sanctions screening information, and other information needed to confirm identity, age, eligibility, location, authority, risk, or compliance.

We may collect tax forms, taxpayer identification numbers, withholding certificates, VAT or GST details, business documents, nonprofit status documentation, beneficial ownership information, payout recipient information, invoices, receipts, prize documentation, donation records, and other documentation needed for tax reporting, payment processing, legal compliance, audit support, fraud prevention, dispute resolution, and operational administration. We may share this information with payment processors, verification vendors, tax advisers, accountants, regulators, tax authorities, and other service providers or authorities as needed.

For some users and transactions, we or our service providers may conduct know-your-customer, sanctions, fraud, payment risk, age, eligibility, identity, business, or authority reviews. These reviews may use information you provide, Platform activity, public records, commercial databases, device signals, payment signals, behavioral signals, third-party risk data, and information from Hosts or other users. We may deny access, delay payouts, request more information, restrict features, preserve records, or take other actions based on these reviews.

8.1 Device and Network Information

8.2 Cookies, Sessions, and Similar Technologies

8.3 Usage Analytics and Events

8.4 Referral and QR Attribution

When you access the Platform, we may collect technical information such as IP address, device identifiers, advertising identifiers, browser type, operating system, device type, language settings, app version, screen size, referring and exit pages, network information, approximate location inferred from IP address, time zone, crash logs, diagnostic data, system activity, and other technical signals. We use this information to operate, secure, debug, personalize, analyze, and improve the Platform.

We may use cookies, pixels, local storage, session storage, software development kits, tags, web beacons, conversion APIs, device identifiers, and similar technologies to remember your settings, keep you signed in, secure your account, measure traffic, understand usage, attribute referrals, detect fraud, personalize experiences, deliver ads, retarget users, measure conversions, and improve the Platform. Some technologies are set by us, and some are set by service providers, analytics providers, advertising partners, social platforms, or other third parties.

We may collect information about how you use the Platform, including pages viewed, features used, buttons clicked, searches, scrolls, session duration, campaign impressions, campaign conversions, entry flows, vote flows, donation flows, purchase flows, sharing activity, referral links, QR code scans, invitation activity, error events, experiment exposure, onboarding progress, support interactions, notification interactions, and other events. We may combine this information with account, campaign, payment, verification, and advertising information.

If you arrive through a referral link, QR code, affiliate link, campaign invitation, social post, advertisement, influencer link, email link, sponsor link, embedded widget, or other tracked source, we may collect referral source, campaign parameters, QR scan data, click identifiers, conversion identifiers, device and browser signals, timestamp, approximate location, campaign attribution, and conversion events. We use this information to measure performance, attribute growth, compensate partners where applicable, prevent fraud, and improve marketing and product experiences.

9.1 Service Providers and Integrations

9.2 Hosts, Teams, Sponsors, and Other Users

9.3 Public and Commercial Sources

We may receive information from payment processors, identity verification vendors, fraud prevention vendors, analytics providers, advertising partners, communication providers, cloud providers, hosting providers, customer support tools, email providers, SMS providers, push notification providers, tax providers, data enrichment providers, and other service providers. This information may include transaction status, verification status, risk scores, delivery status, engagement data, account identifiers, fraud signals, and operational records.

Hosts, team administrators, organization owners, sponsors, judges, participants, voters, donors, and other users may provide information about you. For example, a Host may upload a participant list, invite judges, identify winners, report suspected fraud, provide prize fulfillment details, export campaign records, submit dispute evidence, or provide eligibility documentation. A team administrator may add your email address, assign permissions, change your access, or view your activity within the team or organization account.

We may collect information from public sources, commercial databases, social media, websites, public profiles, sanctions lists, business registries, government records, domain records, press coverage, and other sources where permitted by law. We may use this information to verify identity, confirm authority, detect fraud, review eligibility, support trust and safety, improve records, market the Platform, identify potential customers or partners, and protect users.

10.1 Platform Operations

10.2 Campaign Integrity, Fraud Detection, and Safety

10.3 Verification, Payments, and Creator Monetization

10.4 Analytics, Product Development, and Research

10.5 Advertising, Marketing, and Growth

10.6 Support, Legal, Compliance, and Enforcement

10.7 Platform Intelligence, Archives, and Historical Records

We use information to provide, operate, maintain, and improve the Platform. This includes creating and managing accounts, authenticating users, hosting campaigns, accepting submissions, displaying public pages, enabling voting and judging, processing donations and purchases, supporting subscriptions, facilitating payouts, sending notifications, providing customer support, troubleshooting issues, maintaining records, enforcing settings, and delivering features you request.

We use information to protect campaign integrity, voting integrity, rankings, payments, payouts, referrals, QR attribution, leaderboards, results, public trust, and user safety. This includes detecting fake accounts, duplicate entries, bot activity, vote manipulation, payment abuse, chargeback abuse, referral abuse, ranking manipulation, eligibility misrepresentation, identity fraud, suspicious devices, coordinated behavior, content abuse, security threats, and violations of campaign rules or Platform terms.

We use information to verify accounts, confirm age and eligibility, validate authority, support tax reporting, process payments, manage refunds, respond to chargebacks, issue receipts, calculate fees, support creator monetization, administer donations, facilitate payouts, apply reserves or holds, satisfy payment network requirements, and comply with legal obligations. We may also use information to determine whether a user may access certain payment, hosting, voting, judging, promotional, or monetization features.

We use information to understand how users interact with the Platform, measure campaign performance, evaluate feature adoption, improve onboarding, develop new features, debug errors, assess quality, run experiments, build dashboards, generate benchmarks, forecast demand, support business intelligence, conduct research, and improve the reliability, accessibility, usefulness, and performance of the Platform. We may use aggregated, de-identified, derived, and statistical data for these purposes without attempting to identify you.

We use information to market and advertise the Platform, personalize promotions, measure advertising performance, retarget users, attribute conversions, understand referral sources, optimize campaigns, build audiences, create lookalike or similar audiences where permitted, support sponsor and partner reporting, evaluate marketing channels, and communicate about products, features, campaigns, events, webinars, case studies, offers, and related services. We may combine Platform activity with cookies, pixels, SDKs, conversion APIs, referral data, QR attribution, and advertising partner data.

We use information to respond to support requests, investigate disputes, enforce our terms, preserve evidence, respond to legal requests, comply with law, prevent harm, protect rights, defend claims, audit compliance, manage corporate records, support insurance, maintain tax and accounting records, and communicate about security, payment, verification, legal, product, or campaign matters. We may use information after account closure where needed for these purposes.

We may use information to create, maintain, and improve Platform Intelligence, historical archives, benchmarking datasets, campaign performance reports, voting integrity records, referral and QR attribution analytics, fraud analytics, moderation records, and business intelligence described in Sections 14 and 18. We may use archived public campaign content, results, leaderboards, and winner information for platform operations, analytics, marketing, case studies, educational materials, and product improvement where legally permitted.

11.1 AI-Enabled Features

11.2 Moderation, Fraud, Classification, and Ranking Assistance

11.3 Automated Decisions and Human Review

11.4 Protection of Proprietary Systems

The Platform may include AI-enabled tools or automated systems that help with moderation, fraud detection, classification, recommendations, search, ranking assistance, personalization, analytics, summaries, accessibility, translation, support, content organization, quality review, workflow automation, and product development. These systems may process account information, profile information, campaign activity, submissions, User Content, votes, payment signals, verification signals, device signals, usage activity, communications, metadata, and derived data.

We may use automated processing to identify potentially harmful content, spam, plagiarism, manipulation, fake accounts, vote abuse, payment abuse, suspicious devices, prohibited activity, eligibility issues, duplicate submissions, coordinated behavior, or other integrity risks. We may also use automated processing to classify submissions, recommend campaigns, organize content, surface search results, assist judging workflows, support leaderboards, measure engagement, and help Hosts manage campaigns. Automated outputs may inform human review, platform actions, risk scoring, ranking assistance, or product experiences.

Some decisions or recommendations may be made or assisted by automated systems, including decisions related to account security, fraud prevention, payment risk, verification status, content moderation, voting validity, ranking integrity, recommendations, advertising audiences, and feature eligibility. Where required by law, you may have rights to request information about automated decisions, seek human review, express your point of view, contest a decision, or opt out of certain automated processing. We will honor those rights where they apply.

We are not required to disclose proprietary models, prompts, algorithms, training methods, scoring methods, fraud rules, moderation criteria, ranking methods, vote-weighting methods, thresholds, security signals, risk scores, vendor tools, internal notes, investigation methods, or technical details where disclosure could harm users, reveal trade secrets, enable abuse, compromise security, undermine Platform integrity, violate law, or expose confidential information. We may provide limited explanations when appropriate and legally required.

12.1 Public Profiles and Campaign Pages

12.2 Public Submissions, Results, and Announcements

12.3 Your Responsibility for Public Information

12.4 Archived Content and Historical Records

Your username, display name, avatar, profile, biography, social links, organization name, team name, campaign pages, public submissions, campaign descriptions, comments, votes where displayed, participation status, rankings, leaderboard placement, finalist status, winner status, badges, public donations where enabled, and other information you make public may be visible to other users and the public. Public information may be indexed by search engines, shared on social platforms, embedded on other websites, captured in screenshots, archived, or copied by others.

Campaigns may display submissions, entry titles, descriptions, images, videos, audio, files, names, handles, team members, votes, scores, rankings, judge comments, finalist lists, winners, prize status, donor counts, participation counts, sponsor references, and other campaign information. Hosts may use public campaign information in recaps, announcements, newsletters, social posts, press releases, sponsor reports, community highlights, and future promotions, subject to their own obligations and campaign rules.

You should not post information that you do not want others to see, save, copy, share, or use. Even if you later delete content, change settings, close an account, or ask us to remove public information, copies may remain in backups, archives, cached pages, search engine results, screenshots, exports, emails, analytics, legal records, or materials already shared by users, Hosts, sponsors, partners, or the public.

Where legally permitted, ChallengeForge may retain, archive, display, analyze, reproduce, excerpt, and use historical challenge pages, public submissions, rankings, leaderboards, campaign results, winner information, campaign performance metrics, public campaign content, moderation records, communications, and related records for platform operations, historical archives, case studies, educational content, marketing, analytics, product development, fraud prevention, dispute resolution, legal compliance, tax compliance, payment processing, business intelligence, investor materials, partnerships, platform showcases, and other business purposes.

Archiving or continued display of public campaign content does not mean ChallengeForge endorses, verifies, or guarantees the accuracy, safety, legality, or continued availability of that content. Account closure, campaign deletion, content removal requests, or privacy rights requests may not require removal of all archived, aggregated, de-identified, derived, backup, log, payment, tax, fraud, moderation, or public records, especially where retention is needed for legal compliance, dispute resolution, payment integrity, campaign integrity, safety, security, or legitimate business purposes described in this Privacy Policy.

13.1 Service Providers

13.2 Hosts, Teams, Judges, Sponsors, and Campaign Participants

13.3 Payment, Verification, Fraud, and Compliance Partners

13.4 Analytics and Advertising Partners

13.5 Professional Advisers, Regulators, and Legal Recipients

13.6 Business Successors

13.7 Data Sharing, Advertising, and Sale Disclosures

We share information with service providers that help us operate the Platform, including payment processors, payout providers, cloud hosting providers, storage providers, database providers, content delivery networks, analytics providers, advertising providers, email providers, SMS providers, push notification providers, customer support tools, identity verification vendors, fraud prevention vendors, security vendors, tax providers, accounting providers, data processing vendors, AI vendors, moderation vendors, and other operational vendors. These providers may process information for us or, in some cases, act as independent controllers for their own legally permitted purposes.

We share information with Hosts, team administrators, organization owners, judges, moderators, sponsors, vendors, prize providers, and campaign participants as needed to operate campaigns and Platform features. For example, Hosts may view entries, participant information, eligibility responses, votes, judging records, payment activity, donation records, referral data, QR attribution, campaign analytics, winner details, and dispute information. Team administrators may view account activity, member names, email addresses, roles, permissions, billing records, campaign settings, and related records.

We share information with payment processors, banks, card networks, payout providers, identity verification vendors, fraud prevention vendors, sanctions screening providers, tax providers, collection agencies, dispute resolution providers, and compliance partners. This sharing supports transactions, payouts, refunds, chargebacks, tax reporting, verification, fraud prevention, risk management, sanctions screening, legal compliance, and payment network obligations.

We share information with analytics and advertising partners, including through cookies, pixels, SDKs, conversion APIs, server-side event sharing, referral tracking, QR attribution, and similar technologies. These partners may help us measure traffic, understand usage, attribute conversions, retarget users, deliver ads, build audiences, create lookalike or similar audiences where permitted, limit ad frequency, detect fraud, and assess marketing performance. Depending on your jurisdiction, partner role, and the nature of the disclosure, this sharing may be considered a "sale," "sharing," or targeted advertising under privacy law. See Section 13.7 for additional disclosures and user rights.

We may share information with legal advisers, tax advisers, accountants, auditors, insurers, consultants, banks, regulators, tax authorities, law enforcement, courts, government agencies, dispute resolution bodies, and other recipients where we believe disclosure is necessary or appropriate to comply with law, respond to legal process, enforce our terms, protect rights, prevent harm, detect fraud, investigate abuse, support audits, resolve disputes, or maintain corporate records.

We may share, transfer, or disclose information in connection with a merger, acquisition, financing, investment, due diligence process, reorganization, bankruptcy, receivership, corporate transaction, sale of assets, transfer of a business line, or similar transaction. Information may be shared with potential buyers, investors, lenders, advisers, successors, and their representatives before, during, or after a transaction, subject to reasonable confidentiality and legal protections where appropriate.

This section describes how ChallengeForge may share personal information and how certain sharing may be treated under privacy laws. Our practices may change over time as laws, products, partners, and technologies evolve. The descriptions below are intended to be accurate as of the effective date of this Privacy Policy and should be read together with Sections 15, 20, 21, 23, and 27.

We may share personal information with service providers that process information on our behalf for Platform operations, security, fraud prevention, payments, verification, communications, analytics, advertising, hosting, storage, support, tax, legal compliance, and related purposes. We may also share personal information with advertising, analytics, social media, measurement, retargeting, conversion tracking, and audience-building partners that help us understand usage, attribute conversions, deliver ads, measure campaigns, optimize marketing, and grow the Platform.

Depending on the partner, technology, and jurisdiction, sharing may include identifiers, contact information, online activity, device information, IP-related signals, campaign interactions, vote-related events, donation-related events, purchase-related events, referral links, QR scan events, conversion events, hashed contact information, and inferences. Sharing may occur through cookies, pixels, SDKs, tags, web beacons, server-side APIs, conversion APIs, referral parameters, QR attribution, embedded widgets, account linking, and similar technologies.

Some sharing may be considered a "sale" of personal information, "sharing" of personal information for cross-context behavioral advertising, or "targeted advertising" under state privacy laws, even when ChallengeForge does not receive money in exchange for the disclosure and even when a recipient uses the information primarily for analytics, attribution, retargeting, remarketing, audience building, lookalike or similar audience creation, conversion measurement, frequency capping, fraud detection, or marketing performance evaluation.

Examples of sharing categories and purposes include:

- **Service providers and operational vendors** — cloud hosting, databases, storage, email, SMS, push notifications, customer support, moderation, identity verification, fraud prevention, payments, payouts, tax, accounting, security, and product operations. - **Advertising and marketing partners** — ad delivery, campaign measurement, retargeting, remarketing, creative testing, channel optimization, and promotional communications. - **Analytics and product partners** — usage measurement, funnel analysis, feature adoption, error monitoring, experimentation, benchmarking, and product improvement. - **Conversion and attribution partners** — server-side events, conversion APIs, click identifiers, referral tracking, QR attribution, checkout attribution, and campaign performance reporting. - **Audience and segment partners** — audience building, segmentation, suppression lists, lookalike or similar audience creation where permitted, and marketing list matching using hashed or device-based identifiers where permitted. - **Hosts, sponsors, campaign partners, and affiliates** — campaign administration, judging, prize fulfillment, sponsor reporting, referral programs, affiliate programs, and co-marketing where configured. - **Professional advisers, regulators, and legal recipients** — legal, tax, audit, insurance, compliance, law enforcement, courts, and dispute resolution as described elsewhere in this Privacy Policy. - **Business successors** — mergers, acquisitions, financing, due diligence, reorganizations, and asset transfers.

Residents of California and certain other U.S. states may have rights to know, access, delete, correct, opt out of sale or sharing, opt out of targeted advertising, limit certain uses of sensitive personal information, and appeal denied requests, subject to legal exceptions. Residents of the EEA, UK, Switzerland, and similar jurisdictions may have rights to object, restrict processing, withdraw consent, and lodge complaints, as described in Section 22. We will honor legally required opt-out preference signals, such as Global Privacy Control, where required and technically feasible. Opting out may not stop all processing needed to operate the Platform, complete transactions you request, prevent fraud, maintain security, enforce terms, or comply with law.

14.1 ChallengeForge Ownership and Use

14.2 Product, Marketing, Investor, and Research Uses

14.3 No Re-Identification Commitment Where Required

14.4 Platform Intelligence, Benchmarking, and Analytics

14.5 Continued Use After Account Closure or Campaign Termination

To the maximum extent permitted by law, ChallengeForge owns aggregated, de-identified, derived, and statistical data created from or related to Platform activity, including product metrics, campaign metrics, voting metrics, ranking metrics, fraud metrics, conversion metrics, benchmarks, trends, insights, reports, dashboards, forecasts, classifications, model outputs, and business intelligence. We may use and disclose this data for any lawful business purpose without restriction, provided we do not identify you where the data is required to remain de-identified or aggregated.

We may use aggregated, de-identified, derived, and statistical data for product development, advertising, marketing, sales materials, case studies, investor materials, partner reports, research, benchmarking, market analysis, business intelligence, platform performance reports, security analysis, fraud prevention, campaign optimization, creator monetization analysis, public relations, and strategic planning. For example, we may disclose that a category of campaigns increased participation by a certain percentage, that certain referral channels convert better, or that a platform feature reduced suspected vote manipulation.

Where we process data as de-identified under laws that require a no re-identification commitment, we will maintain and use the data in de-identified form and will not attempt to re-identify it except as permitted by law, such as to test whether de-identification measures are effective. We may also require service providers or other recipients to follow similar restrictions when legally required.

ChallengeForge may create, own, and use Platform Intelligence derived from Platform activity, including aggregated data, de-identified data, derived data, statistical data, benchmarking data, campaign performance metrics, voting analytics, referral analytics, QR analytics, conversion analytics, engagement analytics, donation analytics, payout analytics, fraud analytics, moderation analytics, and industry benchmarking information.

We may use Platform Intelligence for product development, research, AI systems, automated processing, advertising, marketing, investor materials, partnerships, platform showcases, case studies, educational materials, business intelligence, security analysis, fraud prevention, campaign optimization, creator monetization analysis, Host analytics, pricing analysis, capacity planning, support improvement, and strategic planning. Platform Intelligence may be disclosed to affiliates, service providers, advisers, investors, partners, and other recipients where permitted by law and consistent with this Privacy Policy.

To the maximum extent permitted by law, ChallengeForge may continue to use, retain, disclose, and derive value from aggregated, anonymized, de-identified, derived, statistical, benchmarking, and Platform Intelligence data after you close an account, delete content, or end a campaign. Because this information is not intended to identify you, or is processed in a form that cannot reasonably identify you where required by law, it may be retained and used without the same limitations that apply to identifiable personal information.

By using the Platform, you acknowledge that aggregated, anonymized, de-identified, derived, statistical, benchmarking, and Platform Intelligence information may be owned by ChallengeForge and may continue to be used for the purposes described in this Privacy Policy after account closure, campaign termination, content removal, or the end of your relationship with ChallengeForge, subject to applicable law.

15.1 Advertising Technologies

15.2 Retargeting and Attribution

15.3 Your Choices

We and our advertising partners may use cookies, pixels, SDKs, tags, web beacons, server-side events, conversion APIs, click identifiers, device identifiers, hashed contact information, browser signals, referral links, QR codes, and similar technologies to deliver ads, measure ad performance, attribute conversions, retarget visitors, build audiences, personalize marketing, detect ad fraud, frequency cap ads, and understand the effectiveness of campaigns.

If you visit the Platform, view a campaign, scan a QR code, click an ad, open an email, follow a referral link, start a checkout flow, enter a campaign, host a campaign, donate, purchase, subscribe, or otherwise interact with the Platform, we may use that activity to retarget you with ads or attribute later actions to the original source. Attribution may involve sharing event data with advertising platforms, analytics providers, social networks, affiliate partners, sponsors, or campaign partners.

You may be able to limit certain cookies and tracking technologies through browser settings, device settings, platform controls, consent tools, industry opt-out tools, or privacy rights requests. Blocking cookies may affect Platform functionality, including login, security, preferences, analytics accuracy, referrals, QR attribution, voting integrity, fraud prevention, and checkout flows. Some browsers or devices offer global privacy controls or opt-out preference signals, which we will honor where required by applicable law.

16.1 Marketing Communications

16.2 SMS, Push, and Other Messages

16.3 Transactional and Required Notices

We may send you marketing emails, newsletters, product announcements, event invitations, case studies, promotional offers, campaign recommendations, creator resources, sponsor updates, and other communications about ChallengeForge or related opportunities. You may opt out of marketing emails by using the unsubscribe link in the email or by following instructions we provide. Opting out of marketing emails does not stop transactional, legal, security, payment, verification, or service communications.

If you provide a phone number or enable push notifications, we may send SMS, text messages, push notifications, app notifications, or similar messages for purposes such as account verification, two-factor authentication, security alerts, campaign reminders, voting reminders, payment updates, payout updates, support responses, product updates, and marketing where permitted. Message and data rates may apply. You may be able to manage certain message preferences through Platform settings, device settings, or instructions in the message.

We may send communications that are necessary or important for your use of the Platform, including security notices, account notices, payment notices, refund notices, chargeback notices, verification notices, payout notices, tax notices, legal notices, terms updates, privacy updates, campaign notices, moderation notices, integrity notices, support notices, product notices, feature notices, and service availability notices. You may not be able to opt out of these communications while you maintain an account or use the relevant feature.

17.1 Age Restrictions and COPPA

17.2 Parental Rights

17.3 Campaigns Involving Minors

17.4 Safety Restrictions

The Platform is not directed to children under the age at which parental consent is legally required in their jurisdiction, including children under 13 in the United States under the Children's Online Privacy Protection Act ("COPPA"). We do not knowingly collect personal information from children under those thresholds without legally required consent. If you are under the age required to use the Platform independently, you may not use the Platform unless your parent or legal guardian has provided any required consent and your use is allowed by applicable law and Platform rules.

If you believe a child provided personal information to us without required consent, contact us at privacy@challengeforge.com. We may ask for information needed to verify your identity and relationship to the child. Where required by law, a parent or legal guardian may review the child's personal information, request deletion, refuse further collection or use, or withdraw consent. We will respond as required by applicable law.

Hosts are responsible for determining whether their campaigns involve minors and for obtaining all required parental consents, releases, school permissions, publicity releases, safety approvals, and privacy disclosures. Campaigns involving minors may require additional restrictions on public display, communications, submissions, prizes, travel, judging, advertising, data sharing, and retention. We may restrict, remove, or require changes to campaigns that we believe create risk for minors or violate applicable law.

We may limit features available to minors, restrict direct messaging, limit public profiles, require verification, remove content, block payments, restrict payouts, deny participation, or take other protective steps when we believe doing so is appropriate for safety, legal compliance, Platform integrity, or user trust. We may also preserve information related to suspected harm to minors, grooming, exploitation, abuse, fraud, or unsafe activity and report information to appropriate authorities when required or appropriate.

18.1 General Retention

18.2 Retention Purposes

18.3 Retention After Account Closure or Campaign Deletion

18.4 Preservation Where Legally Permitted

18.5 Retention Criteria and Deletion

ChallengeForge may retain information, records, submissions, campaign data, rankings, votes, analytics, fraud records, transaction records, payout records, donation records, verification records, archived campaigns, moderation records, communications, logs, backups, tax records, payment records, support records, advertising records, referral records, QR records, affiliate records, and related information for as long as reasonably necessary for the purposes described in this Privacy Policy and applicable law.

We may retain information for purposes including:

- Platform operations and service delivery - Fraud prevention, abuse prevention, and integrity reviews - Safety, security, and incident response - Legal compliance, regulatory compliance, and law enforcement cooperation - Tax compliance, accounting, and financial reporting - Payment processing, payouts, refunds, chargebacks, and disputes - Dispute resolution, investigations, audits, and enforcement - Product development, experimentation, and quality assurance - Historical archives, public campaign records, and continuity of results - Analytics, research, benchmarking, and Platform Intelligence - Business operations, corporate transactions, and insurance - Protection of ChallengeForge, users, Hosts, participants, and the public

Closing an account, deleting content, ending a campaign, or submitting a deletion request does not automatically require deletion of all records. We may retain information after account closure, campaign deletion, or content removal where needed for the purposes listed in Section 18.2, including fraud prevention, legal compliance, tax reporting, payment records, chargebacks, refunds, payout records, investigations, disputes, audits, safety reviews, security logs, sanctions compliance, campaign integrity, backup systems, archived public pages, analytics, Platform Intelligence, product improvement, enforcement records, and protection of our rights or the rights of others.

ChallengeForge may preserve information where legally permitted, including where retention is needed to establish, exercise, or defend legal claims; comply with legal holds; satisfy payment network, processor, or tax provider requirements; maintain records required by law; support investigations; prevent repeat abuse; preserve public campaign results; maintain archived content described in Section 12.4; or convert information into aggregated, de-identified, derived, statistical, or Platform Intelligence form.

Retention periods vary based on the type of information, the sensitivity of the information, the purposes for processing, user expectations, legal requirements, contractual obligations, risk of harm, fraud patterns, payment and tax rules, limitation periods, security needs, technical constraints, backup cycles, and whether the information appears in public content, campaign records, archives, logs, backups, or aggregated or de-identified data. When information is no longer needed for the purposes for which it was retained, we may delete it, de-identify it, aggregate it, archive it, restrict access to it, or retain it in a form that no longer identifies you where permitted by law.

19.1 Requesting Account Deletion

19.2 Verification and Processing Requirements

19.3 No Guarantee of Immediate Deletion

19.4 Information We May Retain After Deletion

19.5 Public Records and Archived Campaign Content

19.6 User Acknowledgment

You may request deletion of your account through Platform settings where the feature is available, or by contacting privacy@challengeforge.com. Account deletion requests are separate from privacy rights requests under applicable law, though they may overlap in some circumstances. We may ask you to confirm your request, explain what will happen to your account, and direct you to export information you want to keep before deletion is processed.

Before processing an account deletion request, ChallengeForge may require identity verification, password confirmation, deletion confirmation, a cooling-off period, resolution of pending payouts or disputes, completion of required tax or verification steps, or other security and operational steps we believe are necessary to protect your account, other users, and the Platform. We may delay or deny deletion if we cannot verify your identity, if your account is under investigation, if deletion would interfere with legal obligations, or if required by law, payment provider rules, or Platform integrity needs.

Account deletion does not guarantee immediate deletion of all information. Deletion may be staged across systems, backups, service providers, archives, and logs. Some information may remain accessible for a period of time while deletion, de-identification, aggregation, archival conversion, or access restriction is completed. Technical, legal, security, fraud prevention, tax, payment, and operational requirements may prevent immediate deletion of certain records.

After account deletion, ChallengeForge may retain information where legally permitted and reasonably necessary, including:

- Transaction records - Tax records - Fraud records - Security records - Compliance records - Moderation records - Investigation records - Copyright and intellectual property records - Historical campaign records - Archived public content - Aggregated data - De-identified data - Derived data - Platform Intelligence

We may retain this information for legal, operational, security, analytics, research, fraud prevention, historical archive, dispute resolution, payment integrity, tax compliance, and business purposes described in Sections 12.4, 14, and 18 of this Privacy Policy.

Public campaign records, rankings, challenge outcomes, winner information, submissions, archived campaigns, leaderboards, and historical Platform records may remain visible, accessible, archived, excerpted, or referenced after account deletion where legally permitted. This may occur when information was already public, shared with Hosts or participants, indexed by search engines, copied by others, included in campaign results, preserved for campaign integrity, or retained in archives described in Section 12.4.

Account deletion generally removes or restricts access to your account login, private account settings, and certain account-linked features, but it does not automatically remove all public campaign participation, submissions, votes where displayed, winner announcements, Host records, sponsor records, payment records, tax records, fraud records, moderation records, or historical archives.

By requesting account deletion or using deletion features, you acknowledge that certain information cannot be deleted immediately—or at all—due to legal, security, fraud prevention, tax, compliance, payment, dispute, operational, archival, and public-record requirements described in this Privacy Policy. You also acknowledge that aggregated, de-identified, derived, statistical, benchmarking, and Platform Intelligence information may continue to be used as described in Sections 14 and 18.

Privacy rights requests may still be available under applicable law, but those rights are subject to exceptions described in Section 20 of this Privacy Policy.

20.1 Access, Correction, Deletion, and Portability

20.2 Objection, Restriction, and Consent Withdrawal

20.3 Limits on Rights

20.4 How to Make a Request

Depending on where you live, you may have the right to request access to personal information we hold about you, request correction of inaccurate information, request deletion of personal information, request a portable copy of certain information, or request information about how we process and share your information. You may be able to access and update certain information directly through your account settings. Account deletion through Platform settings is described in Section 19.

Depending on your jurisdiction, you may have the right to object to certain processing, request restriction of processing, opt out of certain uses, withdraw consent where processing is based on consent, or object to direct marketing. Withdrawing consent or objecting to processing may affect your ability to use certain features, including features that require verification, payments, communications, fraud prevention, public display, or campaign participation.

Privacy rights are not absolute. We may deny, limit, or delay requests where permitted by law, including when we need information to provide the Platform, protect security, prevent fraud, complete transactions, comply with law, preserve legal claims, retain tax or payment records, maintain campaign integrity, protect other users, respect free expression, retain public records, keep de-identified or aggregated data, or comply with another exception. We may ask you to verify your identity before responding to a request. Retention after account deletion is described in Sections 18 and 19.

You may submit privacy requests by contacting privacy@challengeforge.com. Please include enough information for us to identify your account and understand your request. Do not send sensitive documents unless we ask for them through an appropriate channel. If you are an authorized agent submitting a request for someone else, we may require proof of authorization and identity verification as permitted by law.

21.1 Notice at Collection

21.2 Sources, Purposes, and Disclosures

21.3 Sale, Sharing, Targeted Advertising, and Your Choices

21.4 Sensitive Personal Information

21.5 California Rights

This section provides additional information for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"). We may collect the categories of personal information described in this Privacy Policy, including identifiers, customer records information, protected classification information where provided or inferred for eligibility or compliance, commercial information, internet or electronic network activity, geolocation-related information, audio, electronic, visual, or similar information, professional or employment-related information, education information, sensitive personal information, inferences, and other information that identifies or can reasonably be linked to you.

We collect personal information from you, your devices, Platform activity, Hosts, teams, other users, service providers, payment processors, verification vendors, fraud vendors, analytics partners, advertising partners, public sources, and commercial sources. We use and disclose these categories of information for the business and commercial purposes described in this Privacy Policy, including Platform operations, payments, verification, fraud prevention, security, analytics, product development, advertising, marketing, communications, legal compliance, support, and corporate transactions.

ChallengeForge may share personal information with advertising, analytics, social media, measurement, conversion tracking, retargeting, and audience-building partners as described in Sections 13, 13.7, and 15 of this Privacy Policy. These disclosures may include identifiers, online activity, device information, campaign interactions, referral activity, QR scan activity, conversion events, and similar information.

Depending on your jurisdiction and the partner's role, some disclosures may be considered a "sale" of personal information, "sharing" of personal information for cross-context behavioral advertising, or "targeted advertising" under California and other state privacy laws—even if ChallengeForge does not receive money in exchange for the disclosure and even if the recipient uses the information primarily for analytics, attribution, retargeting, remarketing, audience building, lookalike or similar audience creation, conversion measurement, or marketing performance evaluation.

California residents may have the right to know categories of personal information sold or shared, opt out of sale or sharing, and limit certain uses of sensitive personal information where applicable. We will honor legally required opt-out preference signals, such as Global Privacy Control, where required and technically feasible. Opting out may not stop all sharing needed to operate the Platform, provide requested transactions, prevent fraud, maintain security, or comply with law. See Section 13.7 for additional disclosures.

We may collect sensitive personal information, including account credentials, government identifiers, precise information contained in identity documents, financial information, payment-related information, tax information, racial or ethnic origin where voluntarily provided or needed for specific campaigns, biometric-related information used for identity verification where applicable, contents of communications where we are not the intended recipient, and information concerning minors where applicable. We use sensitive personal information for purposes permitted by law, including providing requested services, security, fraud prevention, verification, payments, legal compliance, safety, and quality assurance. We do not use sensitive personal information to infer characteristics in ways that would require a right to limit under California law unless we provide the required notice and choice.

California residents may have the right to know what personal information we collect, use, disclose, sell, or share; access specific pieces of personal information; request deletion; request correction; opt out of sale or sharing; limit certain uses of sensitive personal information where applicable; and not be discriminated against for exercising privacy rights. To exercise these rights, contact privacy@challengeforge.com. You may also contact legal@challengeforge.com for legal notices. We may verify your request and may deny or limit it where permitted by law.

22.1 Legal Bases for Processing

22.2 EEA, UK, Swiss, and Similar Rights

22.3 International Transfers

22.4 Legitimate Interests

If you are in the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with similar legal bases, we process personal information under one or more legal bases. We process information to perform a contract with you, including providing accounts, campaigns, submissions, votes, payments, subscriptions, payouts, support, and requested features. We process information based on legitimate interests, including securing the Platform, preventing fraud, improving products, conducting analytics, marketing our services, protecting rights, and supporting business operations. We process information to comply with legal obligations, including tax, accounting, payment, sanctions, safety, and legal process obligations. We process information based on consent where required, such as for certain cookies, marketing communications, or optional features.

Depending on your location, you may have the right to access personal information, correct inaccurate information, delete information, restrict processing, object to processing, receive data portability, withdraw consent, object to direct marketing, and lodge a complaint with a data protection authority. You may also have rights related to automated decision-making where legally applicable. To exercise rights, contact privacy@challengeforge.com.

ChallengeForge may process and store information in the United States and other countries where we, our affiliates, our service providers, or our partners operate. These countries may have privacy laws that differ from those in your location. When we transfer personal information internationally, we use safeguards required by applicable law, such as standard contractual clauses, data processing agreements, adequacy decisions, transfer risk assessments, consent, necessity for contract performance, or other legally recognized mechanisms.

Where we rely on legitimate interests, those interests may include operating and improving the Platform, preventing fraud, protecting campaign integrity, securing accounts, enforcing terms, supporting payments, maintaining records, communicating with users, marketing services, conducting analytics, developing AI and automated tools, supporting research, protecting users, and managing business operations. You may object to processing based on legitimate interests where applicable, but we may continue processing if we have compelling legitimate grounds or if processing is needed for legal claims.

23.1 State-Specific Rights

23.2 Appeals

Residents of certain U.S. states may have rights to access, correct, delete, or obtain a copy of personal information; opt out of targeted advertising, sale of personal information, sharing of personal information for cross-context behavioral advertising, or certain profiling where applicable; appeal a denied request; and receive information about data practices. The exact rights, definitions, and exceptions depend on your state. Some disclosures described in Sections 13.7, 15, and 21.3 may be treated as a sale or sharing under state law even when ChallengeForge does not receive money for the disclosure. To exercise rights, contact privacy@challengeforge.com and tell us your state of residence.

If we deny a privacy request and your state gives you a right to appeal, you may appeal by replying to our decision or contacting privacy@challengeforge.com with "Privacy Appeal" in the subject line. We may ask for additional information to evaluate the appeal. If your appeal is denied, you may have the right to contact your state attorney general or another privacy regulator.

24.1 Safeguards

24.2 No Perfect Security

24.3 Your Account Responsibility

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. These safeguards may include access controls, authentication, encryption in transit, monitoring, logging, vendor reviews, incident response procedures, security testing, permission controls, and employee training. The safeguards we use may vary based on the sensitivity of the information, the feature involved, legal requirements, risk, and technical feasibility.

No system, network, website, application, database, payment flow, identity verification process, email, SMS, cloud service, or transmission method is perfectly secure. We cannot guarantee that personal information will never be accessed, disclosed, altered, lost, or destroyed. You use the Platform with the understanding that security risks exist, including unauthorized access, phishing, malware, credential stuffing, social engineering, third-party breaches, device compromise, and user error.

You are responsible for maintaining the confidentiality of your login credentials, using strong passwords, enabling available security features, securing your email account, limiting access by team members, reviewing administrator permissions, keeping devices and browsers updated, avoiding suspicious links, and promptly notifying us of unauthorized access. We are not responsible for losses caused by your failure to secure your account, your sharing of credentials, compromised email accounts, weak passwords, malware, social engineering, or actions taken by people who access your account with your credentials.

25.1 Cross-Border Processing

25.2 Local Law

If you access the Platform from outside the United States, your information may be transferred to, stored in, accessed from, or processed in the United States and other countries. These countries may not provide the same level of data protection as your home country. By using the Platform, you understand that your information may be processed in countries where ChallengeForge, service providers, payment processors, verification vendors, analytics providers, advertising partners, Hosts, sponsors, or other relevant parties operate.

You are responsible for determining whether your use of the Platform is lawful where you are located. Some campaigns, payments, prizes, donations, verification requirements, advertising activities, or communications may be restricted in certain jurisdictions. We may restrict features, decline transactions, block access, require verification, or remove campaigns where we believe doing so is necessary for legal, compliance, risk, payment, or operational reasons.

26.1 Third-Party Services

26.2 Third-Party Privacy Practices

The Platform may link to or integrate with third-party websites, social networks, payment services, identity verification tools, analytics tools, advertising platforms, communication tools, cloud tools, file storage tools, developer tools, sponsor sites, Host sites, embedded content, widgets, APIs, and other services. These third parties may collect information directly from you or receive information from us as described in this Privacy Policy.

Third-party services are governed by their own privacy policies and terms. We do not control their independent privacy practices. You should review the privacy policies and settings of third-party services before using them, linking accounts, sharing content, scanning QR codes, clicking ads, making payments, submitting verification documents, or participating in campaigns that involve third parties.

27.1 Do Not Track

27.2 Global Privacy Control and Similar Signals

Some browsers offer "Do Not Track" signals. There is no uniform industry standard for how to respond to those signals, and we may not respond to them unless required by law. You can use browser settings, cookie controls, device settings, and privacy tools to manage certain tracking technologies.

Where required by applicable law, we will honor recognized opt-out preference signals, such as Global Privacy Control, for the browser or device that sends the signal. Because these signals may be browser- or device-specific, you may need to enable them on each browser and device you use. We may still process information for purposes that are not covered by the opt-out, such as security, fraud prevention, legal compliance, Platform operations, and transactions you request.

28.1 Keeping Information Current

28.2 Account Settings, Exports, and Deletion

You are responsible for keeping your account, profile, billing, payout, tax, verification, and contact information accurate and current. Inaccurate information may affect your ability to access features, receive notices, host campaigns, enter campaigns, receive payouts, claim prizes, receive tax forms, recover your account, or complete transactions.

The Platform may provide settings that allow you to update profile details, change communication preferences, manage security settings, control some public visibility, export certain records, delete certain content, or request account deletion as described in Section 19. Feature availability may vary by account type, campaign status, legal requirements, retention obligations, and technical constraints. Some changes may not affect information already shared, exported, publicly displayed, archived, backed up, or retained for legitimate purposes.

29.1 Compliance and Legal Requests

29.2 Investigations and Disputes

We may access, preserve, use, and disclose information when we believe doing so is necessary or appropriate to comply with law, legal process, court orders, subpoenas, warrants, regulatory requests, tax obligations, sanctions rules, payment network rules, law enforcement requests, government requests, or other legal obligations. We may also disclose information to protect rights, safety, property, users, the public, ChallengeForge, the Platform, or others.

We may preserve and use information for investigations, audits, disputes, appeals, chargebacks, refunds, fraud reviews, safety reviews, security reviews, moderation reviews, campaign integrity reviews, eligibility reviews, payout reviews, tax reviews, legal claims, and enforcement of our terms. We may share relevant information with Hosts, participants, payment processors, verification vendors, fraud vendors, professional advisers, regulators, law enforcement, or other parties where appropriate.

30.1 Mergers, Acquisitions, Financing, and Asset Sales

30.2 Continuity of Services

If ChallengeForge is involved in a merger, acquisition, investment, financing, due diligence process, restructuring, reorganization, bankruptcy, receivership, sale of assets, transfer of a business line, joint venture, change of control, or similar transaction, personal information may be disclosed, reviewed, transferred, assigned, or otherwise processed as part of that transaction. Recipients may include potential or actual buyers, investors, lenders, acquirers, successors, affiliates, advisers, and representatives.

After a corporate transaction, your information may continue to be used for the purposes described in this Privacy Policy unless you receive a new privacy notice or other legally required notice. We may also retain copies of information where needed for legal compliance, accounting, tax, dispute resolution, fraud prevention, security, audits, or other legitimate business purposes.

31.1 Updates

31.2 Continued Use

We may update this Privacy Policy from time to time. We will post the updated Privacy Policy on the Platform or provide notice through reasonable means. The updated Privacy Policy becomes effective when posted or on the effective date stated in the notice. If an update materially affects your rights or our handling of personal information, we will use reasonable efforts to provide advance notice where legally required.

Your continued use of the Platform after the effective date of an updated Privacy Policy means that your information will be handled under the updated Privacy Policy, subject to applicable law. If you do not agree with an update, you should stop using the Platform and may submit a privacy request as described in Section 20 or request account deletion as described in Section 19.

32.1 Privacy Questions and Requests

32.2 Legal Notices

If you have questions about this Privacy Policy or want to exercise privacy rights, contact us at privacy@challengeforge.com. Please include enough information for us to understand your request and identify your account. For your security, do not send government IDs, full payment card numbers, tax identifiers, or other highly sensitive documents by email unless we specifically request them and provide appropriate instructions.

Legal notices may be sent to legal@challengeforge.com or to [LEGAL_ENTITY_NAME] at [REGISTERED_ADDRESS]. Email notices are not always sufficient for formal legal process unless applicable law allows them or we expressly agree in writing. We may require additional verification before discussing account-specific information.