Privacy Policy

The Greak Life Corp. · support@gated.us

GATED — PRIVACY POLICY

Effective Date

June 22, 2026

Last Updated

June 22, 2026

Legal Entity / Data Controller

The Greak Life Corp., a Delaware corporation

Platform / Brand Name

Gated

Privacy Contact / Consumer Requests

support@gated.us

TABLE OF CONTENTS

1. Introduction and Scope

2. Relationship to Terms of Service

3. Who This Policy Applies To

4. Information We Collect

5. How We Collect Information

6. How We Use Information

7. How We Share and Disclose Information

8. Cookies, Local Storage, and Similar Technologies

9. Payment Information

10. Push Notifications and Device Tokens

11. User Content, Event Listings, and Visibility

12. Automated Processing and Profiling

13. Data Retention

14. Security

15. Children's Privacy

16. International and Cross-Border Processing

17. Your Privacy Choices

18. U.S. State Privacy Rights (All 50 States)

19. California Privacy Notice (CCPA / CPRA)

20. Other State-Specific Disclosures

21. Changes to This Privacy Policy

22. Contact Us

Appendix A — Categories of Personal Information (California Format)

Appendix B — Service Providers and Processors (Current Architecture)

1. INTRODUCTION AND SCOPE

This Privacy Policy ("Policy") describes how The Greak Life Corp. ("Gated," "we," "us," or "our") collects, uses, discloses, and otherwise processes information when you access or use:

the Gated mobile application (including iOS builds distributed through the Apple App Store and TestFlight);

our website and web application, if any; and

related services, APIs, support channels, and features (collectively, the "Platform").

We operate the Platform as a technology provider for discovering, listing, coordinating, registering for, ticketing, messaging about, and managing campus- and community-related events and organizations. We are not a university and are not directly associated with, affiliated with, or endorsed by any educational institution. See our Terms of Service for more information about the Platform's role and limitations.

By using the Platform, you acknowledge that you have read and understand this Policy and agree to the collection, use, and disclosure of your information as described herein. This Policy is incorporated into and forms part of our Terms of Service. If you do not agree with this Policy, do not access or use the Platform.

2. RELATIONSHIP TO TERMS OF SERVICE

This Policy should be read together with our Terms of Service. Defined terms in the Terms of Service apply here unless this Policy defines them differently.

If there is a conflict between this Policy and the Terms regarding privacy or data processing, this Policy controls for privacy matters. If there is a conflict regarding use of the Platform, events, payments, or liability, the Terms control. For the avoidance of doubt, the limitation of liability, indemnification, dispute resolution, and governing law provisions of the Terms of Service apply to all claims arising out of or relating to this Policy.

3. WHO THIS POLICY APPLIES TO

This Policy applies to:

Individual users who create accounts, browse events, register for events, purchase tickets, follow organizations, use maps, messaging, or event chat;

Organization users who create or manage organization profiles, events, ticketing, team roles, payouts, or check-in tools; and

Visitors who interact with the Platform without creating an account, to the extent we collect information from them.

This Policy does not apply to:

Third-party websites, apps, or services linked from or integrated with the Platform (such as payment processors or map providers), which have their own privacy policies;

In-person events hosted by independent organizers, which may have separate privacy practices outside our control; or

Information you provide directly to another user or organizer outside the Platform.

4. INFORMATION WE COLLECT

The information we collect depends on how you use the Platform. We may collect the following categories of information:

4.1 Account and Authentication Information

Email address

Password or authentication credentials (processed through Supabase Auth; we do not intend for staff to access your plaintext password)

Internal user identifiers (such as Supabase auth.users UUID)

Account type (individual or organization)

Session and authentication tokens stored on your device (including native app secure storage / preferences on iOS)

4.2 Profile and Directory Information You Provide

Full name or display name

Username or handle

Profile photo or avatar (including images you upload or default avatar URLs)

Bio or profile description

Self-reported university or school affiliation

Organization name, organization profile details, and related metadata

Contact information you choose to provide in support requests

4.3 Event, Organization, and Community Information

Event titles, descriptions, dates, times, locations, addresses, coordinates, images, prices, capacity, categories, and fundraising flags

Organization pages, follow relationships, and membership or role assignments (such as admin, scan/check-in permissions)

RSVP, registration, waitlist, and join-request status

Ticket records, ticket codes, QR check-in / scan records, and attendance-related metadata

Fundraiser or donation-related event settings, where enabled

4.4 Messaging and Event Chat Information

Messages and content you send through Platform messaging or event chat features

Message timestamps and sender identifiers associated with chat functionality

Event chat participation tied to event registration eligibility

4.5 Payment and Payout Information

We use third-party payment processors (such as Stripe) for paid tickets, registrations, and organizer payouts.

We do not store full payment card numbers, CVV/CVC codes, or magnetic-stripe data in our own application database (for example, in Supabase).

We may store or receive limited payment-related information such as:

Payment or checkout status

Stripe customer, session, payment intent, charge, or Connect account identifiers

Ticket purchase amounts, currency, timestamps, and refund status fields

Payout onboarding status for eligible organization accounts

Sensitive payment card data is processed directly by Stripe under its own privacy notice and PCI-DSS obligations.

4.6 Push Notification and Device Information (Native App)

If you use the native mobile app and grant permission, we may collect:

Push notification device tokens (such as Apple Push Notification service tokens on iOS)

Device platform (for example, ios)

Notification delivery metadata and in-app notification history stored in our database

4.7 Technical, Log, and Security Information

Automatically collected or generated information may include:

IP address

Browser or WebView type and version

Device type, operating system, and app version

General usage logs, error logs, and security logs from our hosting and database providers

Date/time stamps and diagnostic data needed to operate, secure, and troubleshoot the Platform

4.8 Camera and QR Check-In (Where Enabled)

If you use QR ticket scanning or similar check-in features, the Platform may access your device camera locally through the browser or app to scan codes. We do not intend to store raw camera video; scan results and validation outcomes may be logged for event operations.

4.9 Location-Related Information

Event and organization location data you or other users submit (addresses, map coordinates, campus-related place names)

Map interactions processed through map providers such as Mapbox

We do not currently use device GPS or precise real-time geolocation tracking as a core feature of the Platform, unless a specific feature you enable in the future requests that permission and we update this Policy.

4.10 Communications with Us

If you contact us at support@gated.us (or other support channels we provide), we collect the information you include in your message, such as your email address, name, event details, refund requests, and attachments.

4.11 Information We Do Not Intentionally Collect

We do not intentionally collect:

Social Security numbers

Driver's license numbers (except if you voluntarily include them in a support email, which we discourage)

Health or medical records

Biometric identifiers for identification purposes

Information from children under 13 (see Section 15)

5. HOW WE COLLECT INFORMATION

We collect information:

Directly from you when you register, create a profile, create or join events, purchase tickets, send messages, update settings, or contact support;

Automatically when you use the Platform, through logs, cookies/local storage, session storage, and similar technologies;

From your device when you grant permissions (such as push notifications or camera access for QR scanning);

From payment processors (such as payment confirmation metadata from Stripe);

From other users when they tag, list, register, message, or otherwise interact with content associated with you (for example, organization admins viewing attendee registration lists); and

From service providers that help us operate the Platform (such as authentication, hosting, and notification delivery).

6. HOW WE USE INFORMATION

We use information for the following business and commercial purposes:

6.1 Provide and Operate the Platform

Create, authenticate, and maintain accounts

Display profiles, events, organizations, maps, tickets, and registrations

Enable event discovery, search, filtering by university/community, and sharing

Operate event chat, messaging, notifications, and check-in features

Process or facilitate payments and payouts through third-party processors

6.2 Communicate with You

Send service-related messages, security alerts, and support responses

Send push notifications about events, registrations, reminders, followers, or Platform updates (subject to your device and in-app settings)

6.3 Safety, Security, and Integrity

Detect, investigate, and prevent fraud, abuse, unauthorized access, and violations of our Terms

Enforce our Terms and protect users and the public

Debug, monitor performance, and improve reliability

6.4 Legal and Compliance

Comply with applicable law, regulation, legal process, or governmental request

Establish, exercise, or defend legal claims

Maintain records required by tax, payment, or accounting rules

6.5 Improve and Develop the Platform

Analyze aggregated or de-identified usage trends

Develop new features and fix bugs

6.6 With Your Direction or Consent

For purposes disclosed at the time of collection or with your consent.

7. HOW WE SHARE AND DISCLOSE INFORMATION

We may disclose information in the following circumstances. We may also share information with our current and future affiliates, subsidiaries, and parent companies, which will use information in a manner consistent with this Policy.

7.1 Service Providers and Processors

We share information with vendors that process data on our behalf to help us operate the Platform, including providers for:

Database hosting, authentication, and file storage (Supabase)

Payment processing and organizer payouts (Stripe)

Backend/API hosting (Render or similar infrastructure)

Map display and geocoding (Mapbox)

Push notification delivery (Apple Push Notification service and related mobile platform services)

Email or support tooling, if configured

These providers are authorized to use information only as needed to provide services to us and subject to contractual or legal obligations.

7.2 Other Users and Organizers (Platform Functionality)

Depending on product design and your actions, information may be visible to other users, such as:

Public or community-visible event listings

Organization profile pages

Attendee/registrant information visible to event organizers for events you join

Messages you send in chats or conversations

Profile details shown in search, tickets, or event contexts

Organizers are independent third parties and are not agents of Gated. If an organizer collects or uses your information outside the Platform, their use is governed by their own practices and applicable law. We are not responsible or liable for any organizer's privacy practices, data handling, or misuse of information, whether received through or outside the Platform.

7.3 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, dissolution, or sale of all or a portion of our assets, information may be accessed, shared, or transferred during due diligence or as part of that transaction, subject to applicable law. Any successor entity may continue to process information in accordance with this Policy or provide notice of changes as described in Section 21.

7.4 Legal and Safety Disclosures

We may disclose information if we believe in good faith that disclosure is necessary to:

Comply with law, regulation, legal process, or governmental request;

Protect the rights, property, or safety of Gated, our users, or the public;

Detect or prevent fraud or security issues; or

Enforce our Terms.

7.5 Aggregated and De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you. Aggregated or de-identified information is not personal information and is not subject to access, correction, or deletion requests.

7.6 Sale or Sharing for Cross-Context Behavioral Advertising

We do not sell your personal information for money.

We do not share your personal information for cross-context behavioral advertising (as those terms are defined under California law) as of the Effective Date of this Policy.

If we change this practice in the future, we will update this Policy and provide any opt-out rights required by law.

8. COOKIES, LOCAL STORAGE, AND SIMILAR TECHNOLOGIES

We and our service providers use cookies, local storage, session storage, and similar technologies to:

Keep you signed in

Remember preferences (such as dark mode)

Store temporary signup or session hints

Operate authentication securely, including native app session persistence through Capacitor Preferences on iOS

You can control cookies through browser settings, but disabling them may affect Platform functionality. Mobile OS settings control push notifications and camera permissions separately.

We do not respond to "Do Not Track" browser signals in a uniform way because there is no industry standard for DNT. Separately, certain state laws require us to honor opt-out preference signals, such as the Global Privacy Control (GPC). Because we do not sell personal information or share it for cross-context behavioral advertising, there is currently no such sale or sharing to opt out of; however, where required by applicable law, we will treat a recognized opt-out preference signal as a valid request to opt out for the browser or device from which it is sent. If our practices change, we will process such signals as legally required.

9. PAYMENT INFORMATION

Payments and payouts are handled by Stripe (and potentially other processors we add). When you make or receive payments through the Platform, Stripe's privacy policy and terms apply to Stripe's processing of payment information. We are not responsible for the data practices of Stripe or any other third-party payment processor, and your use of their services is at your own risk.

We may receive limited transaction metadata from Stripe to confirm purchases, issue tickets, support refunds for cancelled events, and operate organizer payout features.

For more information, see Stripe's privacy notice at: https://stripe.com/privacy

10. PUSH NOTIFICATIONS AND DEVICE TOKENS

If you use the native Gated app and opt in to notifications, we store your device push token in our database (for example, in a device_tokens table linked to your user account) so our server can send notifications such as:

Event reminders

New event alerts from followed organizations

New follower alerts

Other service notifications we may add

You can disable push notifications in your device settings at any time. Disabling notifications may not delete stored tokens immediately; you may request deletion as described in Section 18.

11. USER CONTENT, EVENT LISTINGS, AND VISIBILITY

You choose much of the information you provide on the Platform. Some content may be visible to other users based on product design, including public event listings and organization pages.

Important: Content you publish may be seen, copied, or reused by other users or third parties outside our control. Gated is not responsible or liable for any use, disclosure, or misuse of information you choose to make publicly available on the Platform. Please do not post sensitive personal information you do not want others to see.

Because Gated is not affiliated with any university, your self-reported university affiliation and organization names are user-provided and do not mean the university has reviewed or approved your content. We do not verify and are not responsible for the accuracy of any user-submitted information, including university affiliation, organization names, or event details.

12. AUTOMATED PROCESSING AND PROFILING

We do not use automated decision-making that produces legal or similarly significant effects about you without human review.

We may use basic automated systems for fraud prevention, security, spam detection, and Platform reliability. We do not use personal information for targeted advertising profiling as of the Effective Date.

13. DATA RETENTION

We retain information for as long as reasonably necessary to:

Provide the Platform and maintain your account

Meet legal, tax, accounting, and payment record obligations

Resolve disputes and enforce our agreements

Maintain security and backup integrity

Retention periods vary by data type. Examples:

Data Type

Typical Retention Approach

Account/profile data

While account is active, then deleted or anonymized subject to legal exceptions

Event and ticket records

As needed for event operations, refunds, disputes, and legal compliance

Payment metadata

As required for financial recordkeeping and processor rules

Support emails

As needed to resolve requests and maintain support history

Logs/security data

For a limited operational period unless needed for incident investigation

Device push tokens

Until you log out, uninstall, request deletion, or token is refreshed/replaced

You may request deletion as described in Section 18, subject to legal exceptions and technical feasibility. We may retain certain information as required or permitted by applicable law, including for tax, accounting, legal compliance, fraud prevention, dispute resolution, enforcement of our agreements, backup or archival purposes, and completion of pending transactions.

14. SECURITY

We use reasonable administrative, technical, and organizational safeguards designed to protect information appropriate to the nature of the Platform, including:

Authentication through Supabase Auth

Access controls and row-level security in our database, where configured

HTTPS/TLS for data in transit

Use of reputable infrastructure and payment processors

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot and do not guarantee the absolute security of any information you transmit to, from, or through the Platform. You acknowledge that you provide information at your own risk. You are responsible for safeguarding your password and device and for any activity that occurs under your account.

If you believe your account has been compromised, contact support@gated.us promptly.

15. CHILDREN'S PRIVACY

The Platform is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you believe we have collected personal information from a child under 13, contact us at support@gated.us and we will promptly take appropriate steps to investigate and delete such information, consistent with applicable law. If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will delete that information as quickly as practicable.

Users must meet the age requirements in our Terms of Service (generally at least 18 or the age of majority, unless otherwise stated for a specific account type).

16. INTERNATIONAL AND CROSS-BORDER PROCESSING

Gated is operated from the United States. If you access the Platform from outside the United States, you understand and expressly consent to having your information transferred to, stored in, and processed in the United States and other countries where we or our service providers operate.

Those countries may have data protection laws different from your country of residence. Where required, we will implement appropriate safeguards; contact us for more information.

17. YOUR PRIVACY CHOICES

Depending on your location and the features you use, you may have choices including:

Account settings: Update profile information in the app

Notifications: Adjust device-level push notification permissions

Camera: Allow or deny camera access for QR scanning

Marketing: We do not currently sell personal information or use it for cross-context behavioral advertising

Account deletion: Delete your account at any time in the app (Settings → Account → Delete account), or request deletion by emailing support@gated.us

Access/correction/deletion: See Section 18 and Section 19

We may need to verify your identity before fulfilling certain requests. If we are unable to verify your identity to a reasonable degree of certainty, we may decline the request to protect your account and personal information, and we will notify you of our decision.

18. U.S. STATE PRIVACY RIGHTS (ALL 50 STATES)

Gated intends to operate across all 50 U.S. states. Privacy laws vary by state. Depending on where you live, you may have some or all of the following rights, subject to applicable exceptions:

Right to know / access — confirm whether we process your personal information and obtain a copy of certain information;

Right to correct — request correction of inaccurate personal information;

Right to delete — request deletion of personal information we collected from you;

Right to portability — obtain a portable copy of certain information, where applicable;

Right to opt out of: sales of personal information (we do not sell personal information as of the Effective Date); sharing for targeted/cross-context behavioral advertising (we do not engage in this as of the Effective Date); certain profiling in furtherance of decisions producing legal or similarly significant effects (we do not engage in this as of the Effective Date);

Right to limit use and disclosure of sensitive personal information, where applicable;

Right to non-discrimination for exercising privacy rights.

How to Submit a Request

Email support@gated.us with the subject line "Privacy Request" and include:

Your full name

The email address associated with your Gated account

The state you reside in

The specific right you wish to exercise

Enough detail for us to locate your account/records

We will respond within the timeframe required by applicable law (for example, 45 days under California law, with a permitted extension where allowed).

Verification

We may request additional information to verify your identity before fulfilling a request. If you use an authorized agent, we may require proof of authorization and verification of your identity, as permitted by law.

Appeals

If we deny your request, you may appeal by replying to our decision email with "Privacy Appeal." If your appeal is denied and your state law provides a complaint right, we will explain how to contact your state regulator where applicable.

19. CALIFORNIA PRIVACY NOTICE (CCPA / CPRA)

This Section applies to California residents and supplements the rest of this Policy.

California law uses defined terms such as "personal information," "sensitive personal information," "sell," "share," "business purpose," and "service provider/contractor." This Section uses those terms as defined in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "California Privacy Laws").

19.1 Notice at Collection (California)

In the preceding 12 months, we may collect the categories of personal information listed in Appendix A for the business/commercial purposes described in Section 6.

Sources of collection: See Section 5.

Retention: See Section 13.

Selling or Sharing: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

19.2 Categories of Personal Information Collected (Summary)

CPRA Category (Summary)

Examples on Gated

Collected

A. Identifiers

Name, email, username, user ID, device token, IP address

Yes

B. Personal information (Cal. Civ. Code § 1798.80)

Name, email, phone if provided in support

Yes

C. Protected classification characteristics

Not intentionally collected

No*

D. Commercial information

Ticket purchases, registration/payment status

Yes

E. Biometrics

Not intentionally collected for identification

F. Internet or other electronic network activity

Logs, app/WebView interactions, security data

Yes

G. Geolocation data

Event/map location data; not precise device GPS by default

Limited**

H. Sensory information

Photos, images, chat content you submit

Yes

I. Professional or employment information

Not intentionally collected

J. Education information

Self-reported university affiliation

Yes

K. Inferences

Not used for targeted advertising profiling

L. Sensitive personal information (CPRA)

See 19.3

Limited***

* Unless voluntarily included in user content or support communications.

** We process location information primarily as event/venue/map data, not continuous precise device tracking.

*** See Section 19.3.

19.3 Sensitive Personal Information (California)

Under California Privacy Laws, certain data may be classified as sensitive personal information, such as account log-in credentials combined with passwords.

We use sensitive personal information only for purposes permitted by California Privacy Laws, including:

Providing the Platform and maintaining your account

Security and fraud prevention

Short-term transient use, debugging, and service improvement, where applicable

We do not use or disclose sensitive personal information for purposes other than those permitted by California Privacy Laws without providing a right to limit, where required.

If you are a California resident and wish to limit our use of sensitive personal information beyond what is permitted by law, email support@gated.us with subject "Limit Sensitive PI."

19.4 Disclosures for Business Purposes

In the preceding 12 months, we may disclose the categories of personal information in Appendix A to service providers/contractors for business purposes listed in Section 6, including hosting, authentication, payments, maps, notifications, and security.

We require service providers to process personal information under contractual restrictions consistent with California Privacy Laws.

19.5 Sale and Share Disclosures

Sold: None in the preceding 12 months.

Shared for cross-context behavioral advertising: None in the preceding 12 months.

Because we do not sell or share personal information for cross-context behavioral advertising, we do not operate a "Do Not Sell or Share My Personal Information" link at this time. If our practices change, we will update this Policy and provide legally required opt-out mechanisms.

19.6 Your California Rights

California residents may have the right to:

Know what personal information we collected, used, disclosed, sold, or shared;

Access specific pieces of personal information;

Delete personal information, subject to exceptions;

Correct inaccurate personal information;

Opt out of sale/share (not applicable as of Effective Date);

Limit use/disclosure of sensitive personal information, where applicable;

Not receive discriminatory treatment for exercising privacy rights.

Submit requests to support@gated.us as described in Section 18.

19.7 Authorized Agents (California)

You may designate an authorized agent to submit a request on your behalf. We may require:

Proof of the agent's authority (such as a signed permission); and

Direct verification of your identity, unless the agent has a valid power of attorney.

19.8 Shine the Light (California Civil Code § 1798.83)

California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for those third parties' direct marketing purposes as defined under that statute.

19.9 Financial Incentives

We do not currently offer financial incentives tied to the collection, sale, or deletion of personal information.

20. OTHER STATE-SPECIFIC DISCLOSURES

Several U.S. states have comprehensive privacy laws (including, without limitation, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, and others). Depending on your state, you may have rights similar to those in Section 18.

20.1 Virginia / Colorado / Connecticut / Other Comprehensive State Laws

Where applicable, residents may have rights to access, correct, delete, obtain a copy of, and opt out of certain processing (including targeted advertising, sale, or profiling in furtherance of legal/similarly significant decisions).

Our current practices:

We do not sell personal information.

We do not process personal information for targeted advertising as defined by those laws as of the Effective Date.

We do not engage in profiling in furtherance of legal or similarly significant decisions.

To exercise rights, contact support@gated.us.

20.2 Nevada

Nevada residents may submit a request directing us not to sell certain covered information. We do not sell covered information as defined under Nevada law. You may still contact us at support@gated.us with subject "Nevada Do Not Sell Request."

20.3 Delaware and Other States

We will honor applicable privacy rights under the laws of the state where you reside, to the extent required. Contact us using the process in Section 18.

21. CHANGES TO THIS PRIVACY POLICY

We may update this Policy from time to time. When we do, we will post the updated Policy in the app and/or on our website and revise the "Last Updated" date at the top.

If we make material changes, we will provide additional notice as required by law (such as in-app notice or email).

Your continued use of the Platform after the effective date of an updated Policy means you acknowledge the updated Policy, where permitted by law.

22. CONTACT US

For privacy questions, requests, or complaints:Severability. If any provision of this Policy is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

Legal Entity

The Greak Life Corp.

support@gated.us

Recommended subject line: Privacy Request23. Governing Law

This Policy and any disputes arising out of or relating to this Policy or our privacy practices shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-laws principles. To the extent not governed by the dispute resolution provisions in our Terms of Service, you agree that any legal action or proceeding relating to this Policy shall be brought exclusively in the state or federal courts located in the State of Delaware, and you consent to the personal jurisdiction of such courts.

APPENDIX A — CATEGORIES OF PERSONAL INFORMATION (CALIFORNIA FORMAT)

A.1 Categories Collected in the Last 12 Months