1. Information We Collect

We collect only the information described below. We collect information you provide directly, information generated through your use of the Services, and information from third parties you connect or that process data on our behalf.

1.1 Account Data

To create and secure your account, we collect your mobile phone number, which is used for your account and to send a one-time SMS verification code. You may also optionally provide a display name or handle.

1.2 Connected Platform Identity

When you connect a third-party platform (such as YouTube, TikTok, or Meta/Instagram), we store the platform account identifier (for example, your YouTube channel ID, TikTok open_id, or Meta/Instagram user id) and your public display name. We use this to bind your platform account to your Impressions account and to verify that you own a post you submit.

Client-custody of credentials. We do not collect or store your platform passwords. The platform OAuth access and refresh tokens are stored on your device, in the iOS Keychain, and not on our servers. The App reads your own platform data directly from your device using those tokens. Our servers only relay the one-time secure token exchange required to establish the connection and do not retain the tokens.

1.3 Content Performance Data

For a post you choose to submit to a campaign, the App reads that post's public view count (along with its title, description, and duration) using your own platform connection, and submits that number to us as part of a cryptographically signed submission. We use this data to calculate campaign payouts, and we re-check the view count at a later settlement date (approximately 14 days after submission).

1.4 Submitted Video File

When you submit a post, you upload a copy of the video you posted. We use this copy to (a) confirm it matches the submitted post via a cryptographic hash, and (b) run automated content verification — an AI analysis of the video's audio transcript (speech-to-text) and a sample of still frames — to confirm the video matches the advertiser's brief and meets our content and brand-safety standards. After this one-time analysis, we delete the video file and retain only its cryptographic hash and derived metadata (not the video itself).

1.5 Device Integrity Signals

To prevent fraud and confirm that the App is genuine and unmodified, we use Apple's App Attest and the device Secure Enclave to generate cryptographic attestations and signatures. We store the device's public key and attestation data. We do not collect biometrics or any personal content from your device through these signals.

1.6 Payment Data

Payouts are processed by Stripe (Stripe Connect). Identity verification (KYC), bank account details, and tax information (such as your SSN or EIN and W-9/1099 information) are collected and stored by Stripe, not by us. On our systems, we store your Stripe account identifier, your payout and withdrawal history, and your in-app wallet balance.

1.7 Usage and Technical Data

In the course of operating the Services, we collect:

• Your submissions, campaign participation, and earnings;
• App version and device/operating-system information;
• IP address and timestamps;
• Support communications you send to us.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Operate the marketplace — create and maintain your account, connect your platform accounts, and enable campaign participation;
• Verify submissions — confirm you own the submitted post, validate performance data, and run content verification against the advertiser's brief and our brand-safety standards;
• Calculate and pay earnings — determine campaign payouts based on verified views and process payouts and withdrawals through Stripe;
• Prevent fraud and abuse — use device integrity signals and cryptographic verification to confirm the App is genuine and submissions are authentic;
• Provide support — respond to your inquiries and troubleshoot issues;
• Comply with law and tax reporting — meet our legal obligations, including tax reporting (for example, 1099 reporting facilitated through Stripe).

3. How We Share Your Information

We do not sell your personal information. We share information only as described below.

3.1 Service Providers and Platform Partners

• Google/YouTube, TikTok, and Meta — platform APIs used to read your own content at your direction and to verify ownership of submitted posts;
• OpenAI (AI provider) — automated content verification of the submitted video's transcript and sampled frames;
• Stripe — payment processing, KYC identity verification, and tax reporting;
• Cloudflare — edge hosting, databases, and object storage;
• Apple — App Attest device integrity attestation;
• A third-party SMS provider — delivery of one-time verification text messages.

3.2 Advertisers

Advertisers receive aggregate campaign-performance data (for example, total verified views delivered to a campaign). Note that a post you submit is public by nature, since it is published on your own third-party platform account.

3.3 Legal and Compliance Disclosures

We may disclose information if required to do so by law or in the good-faith belief that such disclosure is necessary to comply with legal process, enforce our Terms of Service, protect the rights, property, or safety of Luck Inc, our users, or others, or detect and prevent fraud or security issues.

3.4 Business Transfers

If Luck Inc is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction, subject to the commitments made in this Privacy Policy.

4. Content Verification and Automated Processing

To protect advertisers and maintain the integrity of the marketplace, we use automated processing to verify submissions. This includes generating a speech-to-text transcript of the submitted video's audio, analyzing a sample of still frames from the video, and comparing the results against the advertiser's brief and our content and brand-safety standards. We also use cryptographic hashing to confirm that the uploaded video matches the submitted post, and cryptographic signatures and device attestations to confirm the authenticity of submissions and the App.

The automated transcript and frame analysis is performed using OpenAI, a third-party AI provider (see Section 3). To perform this one-time check, the derived speech-to-text transcript and the sampled still frames from your submitted video are transmitted to OpenAI, which processes this data on our behalf as a service provider.

As described in Section 1.4, the submitted video file is used only for this one-time analysis and is then deleted; we retain only its cryptographic hash and derived metadata.

5. Data Retention

We retain your personal information for as long as your account is active and thereafter as required by law or for legitimate business purposes, such as complying with tax and financial-reporting obligations, resolving disputes, preventing fraud, and enforcing our agreements. As described above, we delete submitted video files after content verification is complete and retain only the derived cryptographic hash and metadata. When information is no longer needed, we delete or de-identify it in accordance with our retention practices and applicable law.

6. Data Security

We implement reasonable administrative, technical, and organizational measures designed to protect your information against unauthorized access, disclosure, alteration, and destruction. These measures include the client-custody design described in Section 1.2 — platform OAuth tokens remain on your device in the iOS Keychain and are not stored on our servers — as well as cryptographic hashing and signatures, device attestation via Apple's App Attest and Secure Enclave, and reliance on established infrastructure and payment providers such as Cloudflare and Stripe.

No method of transmission or storage is completely secure, and we cannot guarantee the absolute security of your information.

7. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you;
• Correction — request that we correct inaccurate or incomplete information;
• Deletion — request that we delete your personal information, subject to legal and legitimate-business exceptions;
• Opt-out — opt out of certain uses of your information as permitted by applicable law.

To exercise any of these rights, contact us at support@luckincorporated.com. We will respond within the time required by applicable law. We may need to verify your identity before fulfilling your request, and we will not discriminate against you for exercising your rights. Please note that certain information held by our payment processor, Stripe (such as KYC and tax records), is subject to Stripe's own retention obligations and legal requirements.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), provides you with additional rights regarding your personal information, including the right to:

• Know what categories of personal information we collect, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we share it;
• Access the specific pieces of personal information we have collected about you;
• Correct inaccurate personal information we maintain about you;
• Delete personal information we have collected from you, subject to certain exceptions;
• Opt out of the "sale" or "sharing" of personal information, and to limit the use of sensitive personal information;
• Non-discrimination for exercising your privacy rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. The categories of personal information we collect are described in Section 1, the purposes for which we use them in Section 2, and the parties with whom we share them in Section 3. To exercise your California rights, contact us at support@luckincorporated.com. You may use an authorized agent to submit a request on your behalf, subject to our verification of the agent's authority.

9. Children's Privacy

The Services are for adults 18 years of age or older only. The Services are not directed to children under 18, and we do not knowingly collect personal information from anyone under 18.

If you are under 18, please do not use the Services or provide any information to us. If we learn that we have collected personal information from someone under 18, we will delete that information. If you believe a person under 18 has provided us with personal information, please contact us at support@luckincorporated.com.

10. International Users and U.S. Processing

Luck Inc is based in the United States, and the Services are operated and the information we collect is processed and stored in the United States. If you access the Services from outside the United States, you understand and consent that your information will be transferred to, processed, and stored in the United States, where data-protection laws may differ from those in your jurisdiction. By using the Services, you consent to this transfer and processing.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this policy and, where appropriate, provide additional notice. Your continued use of the Services after any update constitutes your acceptance of the revised Privacy Policy. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices — including requests to exercise your privacy rights or to delete your data — please contact us at:

• Email: support@luckincorporated.com
• Company: Luck Inc LLC, United States

This Privacy Policy is governed by the laws of the State of South Dakota, USA, without regard to its conflict-of-laws principles.