NIBBLES PRIVACY POLICY

Thank you for visiting our website and/or mobile applications (the “Online Services”). We hope you choose to be part of our community at Nibbles PBC and Nibbles Insurance Agency LLC (collectively “Nibbles”, “we”, “us”, “our”). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about this Online Privacy Policy, or our practices with regards to your personal information, please contact us at support@nibbles.com.

This Online Privacy Policy explains how Nibbles collects, shares, uses and protects your information on https://nibbles.com and the other websites on which this Online Privacy Policy appears (“Website”), within the Nibbles mobile app (“Mobile App”)(together with Website, “Online Services”), as well as when you interact with us on social media sites or through email, as well as any interactions you may have while viewing content provided through one of our digital advertising campaigns.

We hope you take some time to read through it carefully, as it is important. By using our Online Services or interacting with us online, you agree and consent to the terms and conditions of this Online Privacy Policy, and our Terms of Use, which are incorporated herein by reference. If there are any terms in this Online Privacy Policy that you do not agree with, please discontinue use of our Online Services immediately.

We collect personal information that you voluntarily provide to us when you visit or use our Online Services, and where we believe it is reasonably required for ordinary business purposes. The personal information we collect may typically include the following:

• Contact information like your name, email address, mail address and phone number.
• ID information like your Social Security number or driver’s license number.
• Application information like your credit history.
• Security information like your password and user ID.
• Device information like your IP address, browser type and communication preferences.
• When you communicate with us, either by email, phone or other means of communication, we may also collect the content of these communications, including but not limited to recordings of phone calls where permitted by law.

In addition to the personal information described above, we (and Service Providers or Third-Party Ad-Servers) may collect automatically collect certain information that does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location (non-precise), information about how and when you use the Online Services and other technical information.

We may collect such automatically generated or collected information through a variety of tracking technologies, including cookies, pixels, web beacons, embedded scripts, mobile SDKs, location-identifying technologies and similar technology (“Tracking Technologies”), and we may use third-party partners or services to assist with this effort. We also implement session replay technology that we use to better understand interactions with our Online Services users. This session replay technology collects information about your interactions with our pages, including the duration of your visits to each page, the content you may have reviewed, the location of your clicks, and the way you navigate our Online Services. Information we collect automatically about you or your device may be combined with other personal information we collect directly.

While such automatically generated or collected information is primarily needed to maintain the security and operation of the Online Services, and for our internal analytics and reporting purposes, we, or the Service Providers we use, may also use information to (and as also described “HOW WE USE THE INFORMATION COLLECTED” below): (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the Online Services; (b) provide custom, personalized content and information to you; (c) identify and contact you across multiple devices; (d) provide and monitor the effectiveness of the Online Services; perform analytics and detect usage patterns on the Online Services; (f) diagnose or fix technology problems; (g) detect or prevent fraud or other harmful activities, and (h) otherwise plan for and enhance the Online Services and for other internal purposes. Some of this information may be collected by external parties or Service Providers on our behalf. For example, we use a payment processor when you engage in a payment transaction on our website; Nibbles does not itself collect or store payment card information.

In addition, we may obtain additional information about you from publicly available sources and from various third parties, such as marketers, researchers, consumer and credit reporting agencies, and others for marketing purposes. For instance, we may work with data enhancement companies to learn more about our members or potential members to help provide more relevant ads and offers for you. We use this information to offer you customized marketing and advertising. Additionally, we collect information from social media sites and apps. Your use of such sites or apps and what information each social media site may share with us is subject to their privacy policies, terms of use and advertising settings. We may receive personal information, such as your name, address, phone number, email address, transaction details, and pet information, from our business partners when you participate in joint marketing promotions, events, transactions, or similar partnerships.

We use your personal information for the following purposes:

• Processing applications and transactions.
• Responding to your requests, questions and comments and providing customer support.
• Improving our products and services.
• Obtaining pet healthcare plan and/or insurance coverages (including by sharing such information with underwriters at your direction for that purpose) when in line with the preferences you have shared with us, and provide you with information or advertising relating to the Online Services.
• Monitoring the performance of our Online Services including metrics such as total number of visitors, traffic, and demographic patterns.
• Using technology to recreate a browser session to improve our Online Services and resolve customer concerns.
• Interacting with you, including to notify you regarding products, services, and promotions that may be of interest to you and inform you about important changes to this Online Privacy Policy, our terms or other policies.
• Tailoring the content we display to you in our Online Services and communications, including advertising, and offer products and services that we believe may be of interest to you.
• For security purposes, to protect against fraud and manage risk.
• Disclosing to companies or businesses in connection with a proposed sale or merger.
• With your consent, including in our agreements, or in accordance with your directions.

Aggregated Information or De-identified Information: Aggregated Information and De-identified information does not identify you individually, but helps us gain insights into trends and patterns of groups of people. We may use and share information in an aggregated or de-identified manner in several ways, including for research, analysis, modeling, marketing - including targeted marketing, and improvement of our Online Services.

When you visit our Websites or open up our Mobile App, we may use information that allows us (or our Business Partners, Service Providers or third parties on our behalf) to send your computer or device targeted messages and offers. We may use passive technologies such as cookies, location information, device-level advertising and user identifiers, and pixel tags to uniquely identify your computer or device and the pages you view within our Online Services as well as to provide information to us and third parties about sites and apps you visit after seeing Nibbles ads or offers. Learn how you can control tracking tools below: Opting Out of Interest-Based Advertising and Tracking

We may share the information we collect from and about you with our Affiliates and other third parties as described below. In particular, we may share your information with:

• Current and future Nibbles subsidiaries or affiliates.
• Service Providers, contractors and authorized vendors, that we believe need the information to perform a technology, business, or other professional function for us such as, IT services, maintenance and hosting of our Services, marketing partners, accounting, auditing, and tax services, and other professional services.
• Financial Partners and Service Providers: We share information with our banking partners, payment processors, and other financial institutions as necessary to provide our services and process transactions. This includes;
• Nibble’s affiliated websites and businesses in an effort to bring you improved service across our family of products and services, when permissible under relevant laws and regulations;
• Other companies to bring you co-branded services, products or programs that you have requested;
• To deliver targeted and cross-context advertising (that is based on personal information obtained from your activities over time and across websites or applications that are not affiliated with Nibbles), in addition to general advertising.
• Third parties or affiliates in connection with a corporate transaction, such as a sale, consolidation or merger of Nibbles businesses; and
• Other third parties to comply with legal requirements such as the demands of applicable subpoenas and court orders; to verify or enforce our terms of use, our other rights, or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect the rights, property or security of our customers or third parties.

We take reasonable steps to keep your personal information only for as long as it is necessary for the purposes set out in this Online Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). Actual retention periods vary depending on particular services and products. We use the following criteria to determine retention periods:

• As needed to provide our services and products (e.g., while you are still receiving services from us), and
• As needed for auditing purposes, troubleshooting problems or to assist with investigations, enforcing our policies; and to comply with any legal requirements.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your personal information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security, and improperly collect, access, steal, or modify your personal information. Although we will do our best to protect your personal information, transmission of personal information to and from the Online Services is at your own risk. You should only access the Online Services within a secure environment.

We do not knowingly solicit personal information from or market to children under 18 years of age. By using the Online Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Online Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the corresponding account and take reasonable measures to promptly delete such data from our records. If you become aware of any personal information we may have collected from users under age 18, please contact us at support@nibbles.com.

The Online Services may contain links to third party websites and applications of interest, including advertisements and external services, that are not affiliated with us. Once you have used these links to leave the Online Services, any information you provide to these third parties is not covered by this Online Privacy Policy, and we cannot protect the safety and privacy of information that you provide to a third party outside of the Online Services. Before visiting and providing any information to any third party websites or applications, you should inform yourself of the privacy policies and practices (if any) of the third party responsible for that website or application, and should take those steps necessary to, in your discretion, protect the privacy of your information. We are not responsible for the content or privacy and security practices and policies of any third parties, including other sites, services or applications that may be linked to or from the Online Services.

Our servers are located in the United States of America. If you are accessing the Online Services from outside of the United States of America, please be aware that your personal information may be transferred to, stored, and processed by us in our facilities and by those third parties with whom we may share your personal information (see the section headed “HOW WE SHARE YOUR INFORMATION” above), in the United States of America and other countries.

If you are a resident of a country other than the United States of America, including countries within the European Economic Area and the United Kingdom, then we may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. We will however take reasonably necessary measures to protect your personal information in accordance with this Online Privacy Policy and applicable law.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log into your account settings and update your user account; or
• Email us at support@nibbles.com

Upon your request to terminate your account, we will deactivate or delete your account and personal information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Use and/or comply with applicable legal requirements.

Tracking Technologies

As described in the Information Collected Automatically section, we collect information with Tracking Technologies, and have Service Providers and third parties that collect information with similar technologies. We gather this information using the Tracking Technologies you make available to us when you interact with us, our affiliates and other third parties, to decide what advertising is relevant to you. This may be referred to as interest-based or online behavioral advertising. Nibbles uses interest-based advertising to target its advertising more effectively, and can include ads after you leave our Website, and we think are relevant based on your shopping habits or online activities.

• To recognize new or past customers;
• To store your password if you are registered on our Website or Mobile App(s);
• To improve our Website and Mobile App(s);
• To serve you with interest-based or targeted advertising
• To observe your behaviors and browsing activities over time across multiple websites or other Online Services; and
• To better understand the interests of our customers and our Website and Mobile Apps visitors.

Opting Out of Interest-Based Advertising and Tracking

You have several ways to opt-out of interest-based advertising:

• You may choose to allow or disable cookies which are not required for our sites via DO NOT SELL OR SHARE MY PERSONAL INFORMATION link, which may be accessed through the banner when first visiting our websites. To set or modify your preferences on subsequent visits or at any time, access the “Do Not Sell or Share My Personal Information” link in the footer of our website(s). To effectively manage cookies via this tool, you must set cookie preferences on all web browsers that you use. If you clear the cookies on your web browser(s) or device(s), you may need to set your cookie preferences again. When using our mobile application(s), you may set or alter your cookie preferences at any time in the Privacy section of your Profile within the mobile application Settings.
• In some instances, you can opt-out of receiving interest-based online ads from us, third party advertisers and ad networks. We do not control third parties' collection or use of your information to serve interest- based advertising. Advertisers and ad networks that are members of the Network Advertising Initiative (NAI) or who follow the Digital Advertising Alliance’s Self-Regulatory Principles for Online Behavioral Advertising provide opt-out choices at the following websites:
  • NAI Website
  • DAA Website
  Be advised that these opt-out tools are provided by third parties and may not be available with respect to all interest-based advertising that is presented to you. We do not control or operate these tools or the choices that advertisers and others provide through these tools. Even if you opt out of receiving interest- based advertising, you may still receive generic ads.
• On mobile devices, you can control device-level advertising privacy settings.

DO-NOT-TRACK

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

• Google Analytics - We use Google Analytics to help us manage and improve the Website. Google provides a Browser Add-On that allows you to opt-out by downloading and installing the add-on for your web browser, available at https://tools.google.com/dlpage/gaoptout.

California residents covered by the California Consumer Privacy Act may have additional rights. Please see the Privacy Notice for California Residents below for more information.

Opting out of email marketing

This Privacy Notice for California Residents applies solely to the personal information of individuals who reside in the State of California (“Covered Individuals”). We have provided this Privacy Notice for California Residents (“CCPA Notice”) to comply with the California Consumer Privacy Act of 2018 (the “CCPA”) and any terms defined in the CCPA have the same meaning when used in this notice. It explains what personal information we collect, where we collect it from, what we use it for, who we disclose it to, how long we keep it, the rights California residents may have, and how to exercise them. Covered Individuals include those California residents from whom we collected personal information as a business.

Please note that the CCPA and this disclosure, do not apply to information covered by federal and state privacy laws, including the Gramm-Leach Bliley Act (“GLBA”), the Fair Credit Reporting Act (“FCRA”) and certain other laws.

The information that we collect in connection with establishing eligibility with Nibbles or with Nibble’s financial products or services that Covered Individuals apply for or obtain for personal, family, or household use is not subject to the requirements of the CCPA, or addressed by this CCPA Notice because such data is already protected GLBA and FCRA. Please see Nibbles Privacy Notice for more information about our privacy practices with respect to such information.

This CCPA Notice does not apply to individuals who do not reside in California, nor to California residents who have applied for or obtained Nibble’s financial products or services for personal, family, or household purposes.

To the extent we process de-identified information, we will maintain and use the information in de-identified form and will not attempt to re-identify the information permitted by applicable law.

Categories of Personal Information We May Collect Depending on the nature of your relationship with us, we may collect (and may have collected during the 12-month period prior to the last updated date of this CCPA Notice):

• Identifiers: such as name, address, unique personal identifier, IP address, email address, Social Security number, driver’s license, passport number, date of birth and other similar identifiers;
• Personal information Listed in the California Customer Records Statute (Cal. Civ. Code Sec. 1798.80(e): such as contact information and financial information.
• Characteristics of protected classifications, such as sex/gender and marital status, race, national origin, military, and veteran status
• Commercial information, such as transaction and account information
• Internet or network activity information, such as browsing history and interactions with our website(s)
• Geolocation data, such as device location (not precise - i.e. not within 1,850 feet of a particular person)
• Audio, electronic, visual or similar information, such as call and video recordings
• Inferences drawn from any of the personal information previously mentioned to create a profile about something such as an individual’s preferences and characteristics
• Sensitive Personal Information: Personal information that reveals a Covered Individual’s account log-in, financial account, debit card, or credit card number in connection with any required security or access code, Social Security number, driver’s license, state ID card.

We only collect and process personal information that is considered to be Sensitive Personal Information under the CCPA for the purposes set forth in HOW WE USE OF INFORMATION COLLECTED. We do not collect or process Sensitive Personal Information with the purpose of inferring characteristics about Covered Individuals.

Sale or Share of Personal Information

In the past 12 months, we have shared Identifiers and Internet or Network Activity Information with social networks/advertising networks, and data analytics providers to personalize, market, and advertise our products and services. For purposes of this disclosure, “share” means sharing a consumer’s personal information with a third party for cross-contextual behavioral advertising for monetary or other valuable consideration or for the benefit of a business in which no money is exchanged.

In the past 12 months, based upon our actual knowledge, we have not “sold” Personal Information or Sensitive Personal Information relating to California residents (including minors under 16 years of age). For purposes of this disclosure, “sold” means the disclosure of Personal Information to a business or third party for monetary or other valuable consideration. You may opt-out from the “sale” or “sharing” of your personal information by clicking here.

Additionally, we have disclosed Personal Information to Business or Nonbusiness third parties based upon the consent or at the direction of a California resident to disclose the information.

YOUR CALIFORNIA PRIVACY RIGHTS

• Right to know what personal information we have collected about you;
• Right to delete your personal information;
• Right to correct your personal information;
• Right to opt-out of the "sale" or "sharing" of your personal information;
• Right to opt-out of sharing of your personal information with third parties for the purposes of cross-content behavioral advertising
• Right to non-discrimination for exercising your rights.

Please note that Nibbles does not offer the “Right to limit the use and disclosure of sensitive personal information” because we do not collect or process Sensitive Personal Information with the purpose of inferring characteristics about Covered Individuals.

How to Exercise Your California Privacy Rights. Please direct any Data Subject Requests to us at support@nibbles.com. We will promptly verify your request and respond within the applicable time frame of forty-five (45) days. Where a request is particularly complex, additional time may be required, we will notify you directly. You may also opt-out from the “sale” or “sharing” of your personal information by clicking here.

If we are unable to verify your identity as required by the CCPA, we reserve the right to not process your request. Upon this determination, we will notify you of the decision, along with any rights you may have to appeal the decision. Under the CCPA, we are only required to respond to certain rights requests twice in any twelve (12) month period. You may designate an authorized agent to make requests on your behalf. You will need to provide your identification, the identification of the agent, and your written consent for them to act on your behalf.

Updates to this CA Notice We may update this CA Notice from time to time. When we make changes to this CA Notice, we will update the “Last Updated” date at the top of the page.

Contact Us Should you have additional questions about this CA Notice, please contact us at support@nibbles.com

Notice of Financial Incentives: We offer various financial incentives. For example, we may provide discounts, rewards, exclusive offers, or other benefits to customers who sign up to join our Benefit Program or to participate in a promotional campaign. When you participate in a financial incentive, we collect personal information from you, such as identifiers (like your name, email address, or phone number) and commercial information (like your purchase preferences and interests or purchase history). You can opt into a financial incentive by following the sign-up or participation instructions provided, and, for any ongoing benefits, you have the ability to opt-out at any time, such as by following the instructions set forth in the applicable promotional campaign or program, or contacting us through one of the methods below. In some cases, we may provide additional terms and conditions for a financial incentive, which we will provide to you when you sign up. The value of your personal information is reasonably related to the value of the offer or discount presented to you.

ADDITIONAL STATE SPECIFIC PRIVACY RIGHTS

Depending on the state in which you live, you may have the following privacy rights listed below in relation to the personal information we have collected about you: This section describes those rights for residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana.

• Right to confirm whether we process your personal data and to access such personal data;
• Right to correct inaccuracies in your personal data;
• Right to deletion of your personal data, subject to certain exceptions;
• Right to obtain a copy of your personal data;
• Right to opt-out of processing of personal data for purposes of targeted-advertising;
• Right to request to opt-out of the "sale" of personal data;
• Right to opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects; and
• Right to list of third parties to which your personal data was disclosed; and
• Right to appeal if we deny your request.

How to Exercise Your Rights

Please direct any Data Subject Requests to us at support@nibbles.com. We will promptly verify your request and respond within the applicable time frame. Where a request is particularly complex, additional time may be required, we will notify you directly. You may also opt-out from the “sale” or “sharing” of your personal information by clicking here.

If we are unable to verify your identity as required, we reserve the right to not process your request. Upon this determination, we will notify you of the decision, along with any rights you may have to appeal the decision. Depending on the state law, you may be able to designate an authorized agent to make requests on your behalf. If allowed, you will need to provide your identification, the identification of the agent, and your written consent for them to act on your behalf. We will not discriminate against you for exercising any of the rights that are provided to you under applicable state laws.

We do not conduct profiling in furtherance of decisions that produce legal or similarly significant effects for consumers.

To the extent we process de-identified information, we will maintain and use the information in de-identified form and will not attempt to re-identify the information unless permitted by applicable law.

Nevada law 603A requires website operators to provide a way for Nevada consumers to opt out of the sale of certain information that the website operator may collect about them. Nibbles does not sell your personal information to third parties as defined in Nevada law, and will not do so in the future without providing you with notice and an opportunity to opt-out of such sale as required by law.

We may update this Online Privacy Policy from time to time. The updated version will be indicated by an updated “Effective Date” and the updated version will be effective as of that date. If we make material changes to this Online Privacy Policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. You will be deemed to have been made aware of, will be subject to, and will be deemed to have accepted the changes in any revised Online Privacy Policy by your continued use of the Online Services after the date such revised Online Privacy Policy is posted.

If you have questions, requests or comments about this Online Privacy Policy please contact us at support@nibbles.com