PRIVACY POLICY

Privacy Policy — adOndes

Version: 1.1 Last updated: September 25, 2026 Effective: from the date of publication

1. Introduction

At adOndes we value your privacy and are committed to protecting your personal data. This Privacy Policy describes what data we collect, how we use it, with whom we share it, how long we retain it, and what your rights are regarding that information.

By using adOndes (the "Platform"), you accept the practices described in this document. If you do not agree, we ask that you do not use the Platform.

This Policy is drafted in compliance with the General Data Protection Regulation (GDPR, EU 2016/679), the General Data Protection Law (LGPD, Brazil), the Personal Data Protection Law (Argentina 25.326), the Federal Law on the Protection of Personal Data Held by Private Parties (Mexico LFPDPPP), the California Consumer Privacy Act (CCPA), and equivalent regulations in other jurisdictions where we operate.

2. Data controller

Legal name: Adondes LLC, a Delaware limited liability company (the "Company", "we", "our") Website: https://adondes.com Privacy email: privacy@adondes.com Legal address: 8 The Green, Suite B, Dover, DE 19901, United States

If your jurisdiction requires a Data Protection Officer (DPO), you may contact them by writing to the email address above.

3. Definitions

• Personal data: any information that allows direct or indirect identification of a natural person.
• Processing: any operation performed on personal data (collection, recording, storage, consultation, use, communication, deletion, etc.).
• Consumer (End user): natural person who uses adOndes to interact with advertisements, earn rewards, and consume advertising content.
• Advertiser: natural or legal person who uses adOndes to publish advertising campaigns targeted at Consumers.
• Third party: any person or organization other than the data subject, adOndes, or authorized adOndes personnel.

4. Categories of personal data we collect

4.1 Identification and contact data

• Email (required for registration · used as unique account identifier)
• First and last name (optional · when completing profile)
• Phone number (optional · used for verification or commercial contact)
• Date of birth (optional · used to verify age of majority and for segmentation)
• Postal address (optional · address line, city, state/province, zip code, country)
• Preferred language

4.2 Technical and device data

• IP address (automatically collected on each access)
• User Agent (browser, operating system, device)
• Device fingerprint (non-personal technical identifier of the device)
• Session and authentication cookies (see Section 10)

4.3 Behavioral data (Consumers)

• Ad impressions viewed (how many, when, which campaigns)
• Clicks on advertisements
• Conversions recorded (actions completed after click)
• Sessions (start, duration, frequency)
• Engagement scores (interaction score calculated algorithmically)
• Lifecycle stage (lifecycle stage: New / Active / Engaged / Loyal / At Risk / Churned / Dormant)
• Interaction patterns with the Platform (times, sections visited, inferred preferences)

4.4 Optional profile data

• Profile picture (profile_image_url)
• Bio / description
• Display name (display_name)
• Avatar color
• Notification preferences (email, push)

4.5 Commercial data (Advertisers)

• Legal name and billing details (CUIT, RFC, NIT, EIN, or equivalent according to jurisdiction)
• Payment data (processed by a certified payment provider · we NEVER store complete credit card numbers)
• Published campaigns and their performance metrics
• Commercial agreements with the Platform

4.6 Rewards data (Consumers)

• Accumulated rewards balance
• Redemption history
• Events that generated rewards

5. Processing purposes

We process your personal data for the following purposes:

6. Legal bases for processing

We process your personal data on the following legal bases (according to applicable jurisdiction):

• Consent: when you expressly accept the processing (registration, marketing, non-essential cookies).
• Performance of a contract: when processing is necessary to provide the agreed service.
• Legitimate interest: when processing is necessary for legitimate purposes of adOndes (security, fraud prevention, statistical analysis), provided that your fundamental rights do not prevail.
• Legal obligation: when we are required to process data by law (billing, anti-money laundering, judicial requirements).

7. Third parties with whom we share data

adOndes shares personal data with third parties only in the following cases:

7.1 Service providers (data processors)

• Mailgun (sending transactional emails and notifications): shares recipient email and message content.
• Payment provider (billing to Advertisers): name, commercial email, billing details. We do NOT store complete card data on our servers.
• Hosting / VPS provider (technical storage): all data is stored in provider infrastructure with encryption in transit and at rest.

All processors are bound by data processing agreements (DPAs) that require them to use your data exclusively for the contracted purposes and maintain equivalent security measures.

7.2 Advertisers

Advertisers receive AGGREGATED and ANONYMIZED statistics of their campaign performance (number of impressions, clicks, conversions, CTR, CVR, aggregated demographic segmentation). Advertisers do NOT access individually identifiable personal data of Consumers unless the Consumer has explicitly opted to share contact information in a conversion.

7.3 Public authorities

We may share personal data when legally required by court order, tax authority, data protection regulatory authority, or consumer defense authority, in accordance with applicable legislation.

7.4 Business succession

In the event of merger, acquisition, asset sale, or restructuring, personal data may be transferred to the new entity, always guaranteeing an equivalent level of protection.

adOndes does NOT sell personal data to third parties for marketing purposes.

8. Data retention

After the indicated periods, data is securely deleted or irreversibly anonymized.

9. Your rights as data subject

In accordance with applicable legislation, you have the following rights:

• Right of access: request a copy of your personal data we process.
• Right of rectification: correct inaccurate or incomplete data.
• Right of erasure (right to be forgotten): request deletion of your data when it is no longer necessary or you withdraw consent.
• Right to object: object to processing based on legitimate interest or direct marketing.
• Right to portability: receive your data in a structured, machine-readable format (JSON, CSV).
• Right to restriction of processing: restrict the use of your data in certain cases.
• Right not to be subject to automated decisions: request human review of algorithmic decisions that significantly affect you.
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.

9.1 How to exercise your rights

Send your request to privacy@adondes.com indicating: - Identification (email associated with your account) - Right you wish to exercise - Additional relevant information

We will respond within 30 days of receipt (extendable to 60 days in complex cases, with prior notification).

9.2 Right to file a complaint

If you consider that we process your data improperly, you may file a complaint with the supervisory authority of your jurisdiction:

• European Union: your National Data Protection Authority
• Argentina: Agencia de Acceso a la Información Pública (AAIP)
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI)
• California: California Privacy Protection Agency (CPPA)
• Other jurisdictions: the equivalent applicable authority

10. Cookies and similar technologies

10.1 Types of cookies used

• Essential cookies (no consent required): session, authentication, CSRF security.
• Functionality cookies (consent required in GDPR jurisdictions): language preferences, UI settings.
• Analytics cookies (consent required): aggregated visitor counting, most-used sections.
• Advertising cookies (express consent required): ad personalization, campaign measurement.

10.2 Cookie management

On your first visit to the Platform, we will show a cookie banner where you can accept all, reject non-essential, or configure your preferences individually.

You may revoke or modify your consent at any time from your account settings or by deleting cookies from your browser.

10.3 Visit statistics without cookies

We count visits to adondes.com from our own server's access log, with no cookie, pixel or third-party tracker. To tell one visitor from another within a single day, the IP address and the user agent are combined with a random key that exists only for that day. The key and the combined values live only in the server's memory and are destroyed when the day ends; they are never written to a database or to a backup.

We keep only daily totals for each part of the Platform (the consumer site, the advertiser portal and the app) and their breakdown by country, region and city (from a geolocation database kept on our own server), by referring website and by the utm_source tag of the link that was followed. These totals cannot identify you and are kept as anonymized aggregated data (Section 8).

11. Minors

adOndes is intended for persons over 16 years old (or the minimum legal age applicable in your jurisdiction, for example 13 years under COPPA in the United States).

If you are under 16, you must NOT use the Platform without verifiable authorization from your parent, mother, or legal representative. If we detect that a minor has created an account without authorization, we will delete their data without delay.

Parents or legal representatives who detect an account of a minor in their care may contact us at privacy@adondes.com to request deletion.

12. International data transfers

adOndes operates with technical infrastructure that may be located outside your country of residence. International transfers are carried out under the following guarantees:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EU.
• Adequacy decisions when the destination country has a recognized adequate level of protection.
• Express consent for exceptional cases duly justified.

Information about the countries where we store your data is available by requesting it at privacy@adondes.com.

13. Data security

We implement reasonable technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption in transit (TLS 1.2+ for all communications)
• Encryption at rest (sensitive data stored with encryption)
• Password hashing (bcrypt or equivalent, never plain text)
• Two-factor authentication (when available)
• Role-based access control (RBAC) for authorized personnel
• Audit logs for administrative actions
• Backups regular with secure rotation
• Input sanitization against XSS, SQL injection, and other common vectors
• Rate limiting to prevent brute force attacks
• Continuous security monitoring

Despite these measures, no system is 100% invulnerable. In the event of a security breach affecting your personal data, we will notify you within 72 hours of detection, as required by applicable regulation.

14. Automated decisions and profiling

adOndes uses algorithms to: - Calculate your engagement score and assign lifecycle stage - Personalize the advertising content shown to you - Detect potentially fraudulent behavior

These automated decisions have limited effects (ad display, segment assignment) and do NOT produce legal effects or significantly similar effects on your rights.

If an automated decision significantly affects you, you have the right to request human review, express your viewpoint, and contest the decision by writing to privacy@adondes.com.

15. Changes to this Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legislation, or service. When changes are substantial, we will notify you at the registered email at least 30 days in advance and request renewed acceptance when appropriate.

The date of the last update always appears at the top of this document. Previous versions are available by request to privacy@adondes.com.

16. Contact

For any inquiry, request, or claim related to this Privacy Policy or the processing of your personal data:

Email: privacy@adondes.com Suggested subject: "Privacy Request — [Access / Rectification / Deletion / Other]" Response time: 30 days (60 days in complex cases)

17. Final provisions

This Privacy Policy is complemented by adOndes Terms and Conditions of Service. In case of discrepancy between both documents regarding the processing of personal data, this Privacy Policy prevails.

If any provision of this Policy is deemed invalid or unenforceable by a competent authority, the other provisions will remain in full force.

End Privacy Policy adOndes v1.0 · 2026-05-11 · document subject to jurisdictional legal review before public publication.