INFANITY, INC.

PRIVACY POLICY

Effective Date: June 12, 2026 | Last Updated: June 20, 2026

This Privacy Policy describes how Infanity, Inc. ("Infanity," "we," "us," or "our") collects, uses, stores, shares, and protects your personal information when you use the Infanity platform (the "Platform"), including our mobile application, website at www.infanity.xyz, and all associated features and services. It also describes your rights with respect to your personal information and how to exercise them. This Privacy Policy is incorporated into and forms part of our Terms of Service (available at www.infanity.xyz/terms). Capitalized terms used but not defined here have the meanings given in the Terms of Service.

1. WHO WE ARE AND HOW TO CONTACT US

Infanity, Inc. is a Delaware corporation and the data controller responsible for your personal information collected through the Platform. For all privacy-related inquiries, data subject rights requests, or complaints:

• Email: privacy@infanity.xyz
• Legal matters: legal@infanity.xyz
• Website: www.infanity.xyz/privacy EU and UK users: You have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at https://edpb.europa.eu. The UK supervisory authority is the Information Commissioner's Office (ICO) at https://ico.org.uk. Brazil users: You may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at https://www.gov.br/anpd.

2. INFORMATION WE COLLECT

We collect information in three ways: information you give us directly, information we collect automatically when you use the Platform, and information we receive from third parties.

2.1 Information You Provide Directly

• Account Registration. When you create an Infanity account, we collect your name or display name, email address, and any profile information you choose to provide, including a profile photo, biography, and links to other accounts.
• Wallet Information. When you create or connect a cryptocurrency wallet, we collect your wallet's public Ethereum address. We do not collect, store, or have access to your private keys, seed phrase, or any other wallet credentials. Where you connect an external wallet, we receive only the public address you authorize for connection.
• Social Protocol Profile. When you create a Farcaster profile through the Platform as part of onboarding, a unique Farcaster ID (FID) is assigned to your Ethereum address via an on-chain transaction on the Optimism blockchain. We associate your FID with your Infanity account. Your FID and custody address are publicly visible on the Optimism blockchain and are not within Infanity's control to modify or delete.
• Payment Information. When you fund your Engagement Wallet via Coinbase Commerce or other supported payment methods, payment processing is handled directly by the applicable third-party processor. We do not store full payment card numbers or private cryptocurrency transaction credentials. We receive transaction confirmation data, amounts, and public wallet addresses associated with completed transactions.
• Creator Content. If you register as a Creator, we collect your uploaded music files, artwork, biographical information, streaming catalog connection authorizations, and any other content you upload or submit to the Platform.
• Communications. When you contact us for support, respond to surveys, or communicate with us directly, we collect the content of those communications.
• Authorized Manager Information. If you register as an Authorized Manager, we collect your name, organization name, contact information, and documentation of your authorization to manage Creator accounts.

2.2 Information We Collect Automatically

• Device and Usage Data. When you use the Platform, we automatically collect information about your device, including device type, operating system, browser type, IP address, and unique device identifiers. We also collect information about how you interact with the Platform, including pages and content viewed, features used, time spent, and clickstream data.
• Engagement Data. We collect data about your Engagement Actions on the Platform, including every like and comment you make, the content you engage with, the Creators whose content you engage with, timestamps, and the micropayment amounts generated by each Engagement Action. As described in Section 3.7, your likes and comments are public and visible to other users by design.
• Earnings and Transaction Data. For Creators, we collect data about micropayment earnings accrued, Engagement Actions that generated those earnings, and, when off-ramp functionality is available, disbursement transaction records.
• Live Space Data. When you host or attend a Live Space, we collect data about your participation, including hosting activity, attendance, duration, and Engagement Actions that occurred during the Space. Where Infanity archives a Live Space, we retain a recording of the broadcast.
• Channel Data. We collect data about Channels you create, manage, or access, including content posted, engagement activity within Channels, and, for Gated Channels, access records.
• Log Data. Our servers automatically record information when you use the Platform, including your IP address, access times, pages viewed, and error logs.

2.3 Information from Third-Party Services

• Streaming Service Data. If you connect a third-party streaming account (such as Apple Music or other supported services) to your Infanity account, we receive data from that service through its API, subject to your authorization and the streaming service's own terms. This data may include your listening history and playback activity, playlists and saved content, followed artists and music preferences, genre affinities inferred from your streaming activity, and catalog and track metadata associated with your activity. As described in Section 3.7, your listening activity from connected streaming services may be surfaced publicly within the Platform. You may disconnect your streaming account at any time through your account settings.
• Social Protocol Network Data. We receive data from the Social Protocol (currently, Farcaster) network related to your Social Protocol profile, including your FID, public profile information, and content you have published to the Social Protocol network. Because the Social Protocol is a decentralized public network, this data is publicly accessible.
• Coinbase Commerce. When you fund your Engagement Wallet through Coinbase Commerce, Coinbase may share transaction confirmation data with us, including transaction identifiers, amounts, and associated public wallet addresses. Coinbase Commerce's collection and use of your data is governed by Coinbase's own privacy policy.
• Analytics Providers. We may use third-party analytics tools to help us understand how users interact with the Platform. These tools may collect data about your usage patterns in aggregate or pseudonymous form.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

3.1 Providing and Operating the Platform

• Creating and managing your Infanity account and Social Protocol profile;
• Processing Engagement Wallet funding transactions and tracking micropayment earnings;
• Enabling streaming of Creator content through API integrations and direct upload hosting;
• Operating Live Spaces, Channels, and other Platform features;
• Facilitating the Social Protocol identity and signing key delegation process;
• Managing Authorized Manager access to Creator accounts; and
• Providing customer support and responding to your inquiries.

3.2 Personalizing Your Experience

• Using your streaming account data, listening history, and engagement patterns to surface music, Creators, Channels, and Live Spaces likely to be relevant to you;
• Recommending Creators and content based on your engagement history and music preferences; and
• Tailoring the Platform's discovery features to your taste profile.

3.3 Improving the Platform

• Analyzing usage patterns and engagement data in aggregate to improve Platform features, recommendation algorithms, and user experience;
• Generating anonymized, aggregate insights about music trends and listener behavior that may be shared with Creators in non-personally-identifiable form;
• Identifying and fixing bugs, errors, and technical issues; and
• Conducting internal research and development.

3.4 Safety, Security, and Compliance

• Verifying your identity and eligibility to use the Platform;
• Screening transactions for compliance with OFAC sanctions and applicable anti-money-laundering requirements;
• Detecting, investigating, and preventing fraudulent transactions, unauthorized account access, and other prohibited conduct;
• Enforcing our Terms of Service and other Platform policies; and
• Complying with applicable laws, regulations, court orders, and lawful requests from regulatory authorities.

3.5 Communications

• Sending you account-related notifications, including transaction confirmations, earnings updates, and security alerts;
• Notifying you of updates to our Terms of Service, Privacy Policy, or Platform features;
• Sending you promotional communications about Infanity features, new Creator content, and Platform developments, where you have consented or where permitted by applicable law; and
• Responding to your support requests and feedback.

3.6 Tax and Legal Reporting

• Issuing applicable tax forms (e.g., IRS Form 1099) to Creators and other users who meet applicable reporting thresholds;
• Maintaining records required by applicable financial, tax, and regulatory laws; and
• Sharing information with tax authorities as required by law.

3.7 Public Surfacing of Listening and Engagement Activity

IMPORTANT: Your music activity and engagement on Infanity is social by design and visible to other users. A core feature of the Platform is that it surfaces your music listening activity and engagement behavior to other users. This is not a background or internal use of your data — it is a visible, social feature of the Platform. Specifically:

• Music You Listen To. Music you stream or play on the Platform — whether from a connected streaming service such as Apple Music or from Creator content hosted directly on the Platform — may be surfaced to other users. This may include what tracks you are currently playing, recently played content, and your listening history on the Platform. Other users may be able to see your listening activity in their feeds, on your profile, or through Platform discovery features.
• Connected Streaming Service Activity. If you connect a third-party streaming account to the Platform, your listening activity from that service — including tracks, artists, albums, and playlists you engage with — may be surfaced within the Platform and made visible to other users, subject to the permissions you grant when connecting the account. By connecting a streaming account, you acknowledge and agree that your listening activity from that service may appear on your Infanity profile and in other users' feeds.
• Likes. When you like a Creator's content on the Platform, that Engagement Action is visible to other users, including the Creator whose content you liked and other Listeners. Your likes may appear on your public Infanity profile, on the content itself, and in feeds visible to other Platform users.
• Comments. Comments you post on Creator content are public by default and visible to all Platform users, including the Creator and other Listeners. Your comments appear on the content and may be surfaced in feeds and on your public Infanity profile.
• Social Protocol Network. Because the Platform is built on the Social Protocol (currently, Farcaster), your public listening and engagement activity that is published to the Social Protocol network is also visible to anyone using any compatible Social Protocol client, beyond the Infanity Platform itself. What Is Not Surfaced Publicly. The following activity is not surfaced to other users: private messages between users; your Engagement Wallet balance and funding transactions; your earnings as a Creator; your connected streaming account credentials or full account details; content you engage with inside Gated Channels (visible only to Channel members); and any data you have not authorized for public display in your account settings. Managing Your Visibility. You may be able to adjust certain visibility settings through your account settings, including controlling whether your listening activity is surfaced publicly and which streaming service activity appears on your profile. However, please note that some public surfacing of activity is a core feature of the Platform and may not be fully disabled without affecting your ability to use engagement features. Details of available visibility controls are described in the Platform's account settings. Legal Basis (EU/EEA/UK Users). We surface your listening and engagement activity to other users on the basis of our legitimate interests in operating a social music platform whose core purpose is to make music discovery and fan engagement visible and social. We have assessed that this processing is proportionate to the Platform's purpose and expected by users of a social music service. You have the right to object to this processing under Article 21 of the GDPR. If you object, please contact privacy@infanity.xyz, though we note that this processing is fundamental to the Platform's core functionality.

4. LEGAL BASES FOR PROCESSING (EU/UK GDPR)

If you are located in the European Union, European Economic Area, or United Kingdom, we process your personal data on the following legal bases under the GDPR and UK GDPR:

• Performance of a Contract. We process your personal data to the extent necessary to provide the Platform services you have requested, including account creation, Engagement Wallet transactions, micropayment processing, content delivery, and Creator earnings tracking. This is our primary legal basis for most data processing activities.
• Legitimate Interests. We process certain data based on our legitimate interests in operating a safe, functional, and improving platform, including fraud prevention, security monitoring, aggregate analytics, and platform improvement. We have assessed that our legitimate interests in these activities are not overridden by your rights and interests.
• Legal Obligation. We process certain data to comply with our legal obligations, including OFAC sanctions screening, anti-money-laundering requirements, tax reporting obligations, and responses to lawful regulatory requests.
• Consent. Where we rely on your consent as the legal basis for processing — for example, for optional streaming account connections or promotional communications — you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, contact privacy@infanity.xyz or adjust your account settings. For users outside the EU/EEA/UK, we process your personal data based on our legitimate interests in operating the Platform, performance of our contract with you, and compliance with applicable legal obligations.

5. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information to third parties. We share your information only in the following circumstances:

5.1 Service Providers and Data Processors

We share personal data with third-party service providers who process data on our behalf to help us operate the Platform. These providers are contractually bound to process your data only as directed by us and in accordance with this Privacy Policy. They include:

• Cloud Infrastructure Providers. Third-party cloud hosting providers that store and serve Creator-uploaded content and Platform data on our behalf.
• Payment Processors. Coinbase Commerce and other payment processors that handle Engagement Wallet funding transactions. These processors operate as independent data controllers for your payment data in accordance with their own privacy policies.
• Analytics Providers. Third-party analytics tools that help us understand Platform usage in aggregate or pseudonymous form.
• Customer Support Tools. Third-party tools that help us manage and respond to support requests.

5.2 The Social Protocol Network

Content you publish through the Platform is transmitted to the Social Protocol (currently, Farcaster) network, which is a public, decentralized network operated independently of Infanity. Once published to the Social Protocol network, your content — including posts, profile information, and engagement activity — is publicly accessible to anyone using any Social Protocol-compatible client. Infanity does not control how the Social Protocol network or third-party Social Protocol clients handle or display your data. Your on-chain identity data (Farcaster ID and custody address) is recorded on the Optimism blockchain, which is a public blockchain. This information is immutable and permanently publicly accessible.

5.3 Streaming Service APIs

When you connect a streaming account, we receive data from that streaming service's API as described in Section 2.3. We do not share your personal data back to streaming services except as required to maintain the API connection or as otherwise required by the streaming service's API terms.

5.4 Authorized Managers

If you are a Creator and you have authorized an Authorized Manager (record label, manager, or administrator) to manage your Infanity account, that Authorized Manager will have access to your Creator account data, including your content, profile information, earnings data, and account settings, to the extent of their authorization. You are responsible for the authorization you grant, and Infanity is not responsible for how Authorized Managers use the data they access.

5.5 Business Transfers

If Infanity is involved in a merger, acquisition, asset sale, financing, or other corporate transaction, your personal information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Platform before your personal data is transferred and becomes subject to a different privacy policy.

5.6 Legal Requirements and Safety

We may disclose your personal information if we believe in good faith that disclosure is necessary to: (i) comply with applicable law, regulation, legal process, or enforceable governmental request; (ii) enforce our Terms of Service; (iii) detect, prevent, or address fraud, security, or technical issues; or (iv) protect the rights, property, or safety of Infanity, our users, or the public.

5.7 Aggregated and De-Identified Data

We may share aggregated or de-identified data that cannot reasonably be used to identify you, including aggregate music trend reports and engagement analytics that we may share with Creators or publish publicly.

6. SOCIAL PROTOCOL AND BLOCKCHAIN DATA

6.1 On-Chain Data

Your Farcaster ID (FID) and associated Ethereum custody address are recorded on the Optimism blockchain as part of account creation. Blockchain data is public, permanent, and immutable by design. Infanity cannot delete, modify, or restrict access to your on-chain identity data. Your on-chain records will persist on the blockchain regardless of whether you close your Infanity account or request deletion of your data. We want to be transparent that this means certain information associated with your Infanity account — specifically your FID and custody wallet address — cannot be erased as part of any data deletion request. This is an inherent characteristic of public blockchain infrastructure, not a choice Infanity makes. You should consider this before proceeding with onboarding.

6.2 Social Protocol Hub Data

Posts, comments, and social activity you publish through the Platform are stored off-chain on the Social Protocol's distributed Hub network. While not stored on a blockchain, Hub data is replicated across multiple independent node operators that Infanity does not control. As a result, deleted content may persist on Hub nodes operated by third parties even after you delete it from the Platform. Infanity will process deletion requests for Hub content on a best-efforts basis by removing content from the Infanity application layer, but cannot guarantee removal from all third-party Hub nodes.

6.3 Signing Key Data

Infanity holds a delegated signing key that allows it to publish content to the Social Protocol network on your behalf. This signing key is associated with your FID in the Social Protocol's Key Registry, which is publicly readable on-chain. You may revoke Infanity's signing key at any time through your wallet or Social Protocol account settings.

7. STREAMING ACCOUNT DATA

Connecting a third-party streaming account to the Platform is entirely voluntary. If you choose to connect a streaming account:

• We access the data described in Section 2.3 through the streaming service's API, subject to the permissions you grant;
• We use that data to personalize your Platform experience and improve our recommendation systems, as described in Section 3.2 and 3.3;
• We do not sell your individual streaming data to any third party;
• We may use aggregated, anonymized insights derived from streaming data to generate music trend reports;
• You may disconnect your streaming account at any time through your account settings, after which we will cease accessing new data from that service; and
• Data already collected prior to disconnection will be retained in accordance with our retention practices in Section 10, but will no longer be actively refreshed. Your streaming data is governed by the terms of the applicable streaming service as well as this Privacy Policy. Infanity's access to your streaming data is limited to what is permitted by the streaming service's API terms.

8. CRYPTOCURRENCY WALLETS AND PAYMENT DATA

8.1 Wallet Data

We collect and store your public Ethereum wallet address(es) associated with your Infanity account. Public wallet addresses are, by their nature, publicly visible on the blockchain and are not considered private information in the traditional sense. We do not collect, store, or access your private keys, seed phrases, or any other wallet credentials. We associate your public wallet address with your Infanity account for the purpose of Social Protocol identity management, Engagement Wallet funding verification, and, when operational, Creator earnings disbursement.

8.2 Transaction Data

When you fund your Engagement Wallet or when micropayment transactions occur on the Platform, we collect transaction data including amounts, timestamps, public wallet addresses involved, and transaction identifiers. This data is used to maintain accurate Engagement Wallet balances, track Creator earnings, fulfill tax reporting obligations, and comply with applicable financial regulations including OFAC sanctions screening.

8.3 Coinbase Commerce

Engagement Wallet funding is currently processed through Coinbase Commerce. When you initiate a funding transaction, relevant transaction data is shared with Coinbase Commerce to process the payment. Coinbase Commerce operates as an independent data controller for your payment transaction data. Coinbase's privacy policy, available at https://www.coinbase.com/legal/privacy, governs how Coinbase collects, uses, and shares your data in connection with payment processing.

8.4 OFAC Sanctions Screening

We are required by law to screen transactions for compliance with OFAC sanctions and other applicable financial regulations. As part of this screening, we may check wallet addresses and user information against government sanctions lists. If a match is identified, we may be required to block, freeze, or report the transaction to relevant authorities.

9. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies to operate and improve the Platform. The types of tracking technologies we use include:

• Essential Cookies. Cookies necessary for the Platform to function, including session management, authentication, and security. These cannot be disabled without affecting core Platform functionality.
• Analytics Cookies. Cookies and similar technologies that help us understand how users interact with the Platform, measure performance, and identify areas for improvement. These operate on an aggregate or pseudonymous basis.
• Preference Cookies. Cookies that remember your settings and preferences to personalize your experience. You may control cookie settings through your browser settings or, where available, through our in-app cookie preferences. Note that disabling certain cookies may affect Platform functionality. We do not use tracking technologies for cross-site advertising purposes.

10. DATA RETENTION

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. Our general retention practices are:

• Account Data. Retained for the duration of your account and for a period of up to 3 years following account closure, to allow for dispute resolution, legal compliance, and tax reporting obligations.
• Transaction and Earnings Data. Retained for a minimum of 7 years following the transaction date, as required by applicable tax and financial recordkeeping laws.
• Engagement and Usage Data. Retained in identifiable form for up to 2 years, after which it may be aggregated or de-identified for analytics purposes.
• Streaming Account Data. Retained for the duration of your streaming account connection, plus up to 12 months following disconnection, after which it is deleted or de-identified.
• Support Communications. Retained for up to 3 years following resolution of the relevant inquiry.
• On-Chain and Social Protocol Data. As described in Section 6, on-chain identity data is permanent and cannot be deleted by Infanity. Social Protocol Hub data is subject to the retention practices of the Social Protocol network and independent Hub operators.
• Legal Hold. We may retain data beyond the above periods where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.

11. DATA SECURITY

We implement technical and organizational security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls and authentication requirements for internal systems, security monitoring and logging, and regular security assessments of our infrastructure and third-party providers. However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your information. If you have reason to believe your account has been compromised, please contact us immediately at privacy@infanity.xyz. You are responsible for maintaining the security of your own wallet, private keys, and account credentials. Infanity cannot recover lost private keys or wallet access.

12. INTERNATIONAL DATA TRANSFERS

Infanity is based in the United States. If you are located outside the United States, your personal information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence. EU/EEA and UK Users. When we transfer personal data from the EU/EEA or UK to the United States, we rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our agreements with third-party processors;
• The EU-U.S. Data Privacy Framework, where applicable; and
• Other appropriate safeguards recognized under the GDPR and UK GDPR. You may request a copy of the applicable transfer safeguards by contacting privacy@infanity.xyz. Brazil Users. When we transfer personal data from Brazil to the United States, we implement appropriate safeguards in accordance with the LGPD, including contractual clauses and other transfer mechanisms recognized by the ANPD. Other Jurisdictions. For transfers from other jurisdictions, we implement appropriate safeguards as required by applicable local law.

13. YOUR PRIVACY RIGHTS

Depending on your location, you have certain rights with respect to your personal information. We honor these rights as described below.

13.1 Rights Available to All Users

• Access. You have the right to request a copy of the personal information we hold about you.
• Correction. You have the right to request correction of inaccurate or incomplete personal information.
• Deletion. You have the right to request deletion of your personal information, subject to our legal obligations to retain certain data and the inherent limitations of blockchain and Social Protocol Hub data described in Section 6.
• Opt-Out of Communications. You may opt out of promotional communications at any time by clicking the unsubscribe link in any marketing email or by contacting privacy@infanity.xyz. You will continue to receive transactional and account-related communications.

13.2 EU/EEA and UK Rights (GDPR and UK GDPR)

If you are located in the EU, EEA, or UK, you have the following additional rights:

• Right to Restriction. You may request that we restrict processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or object to processing.
• Right to Portability. You have the right to receive personal data you have provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object. You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Rights Related to Automated Decision-Making. If we use automated decision-making that produces legal or similarly significant effects on you, you have the right to request human review, contest the decision, and obtain an explanation of the logic involved. We do not currently use automated decision-making in this manner for decisions affecting your rights.
• Right to Withdraw Consent. Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint. You have the right to lodge a complaint with your local supervisory authority at any time.

13.3 California Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to Know. You have the right to know what personal information we collect, use, disclose, and sell, and the right to request a copy of the specific personal information we have collected about you in the preceding 12 months.
• Right to Delete. You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct. You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing. We do not sell or share your personal information for cross-context behavioral advertising as defined under CCPA/CPRA.
• Right to Limit Use of Sensitive Personal Information. To the extent we collect sensitive personal information as defined under CPRA (which may include wallet addresses in some interpretations), you have the right to limit its use to purposes necessary to provide the services you requested.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights. To submit a California rights request, contact privacy@infanity.xyz. We may need to verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf by providing written authorization.

13.4 Brazil Rights (LGPD)

If you are located in Brazil, you have the following rights under the LGPD:

• Confirmation of the existence of processing of your personal data;
• Access to your personal data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary or excessive data;
• Portability of your data to another service or product provider;
• Deletion of personal data processed with your consent;
• Information about third parties with whom we share your data;
• Information about the possibility of denying consent and the consequences; and
• Revocation of consent.

13.5 Other U.S. State Rights

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws may have similar rights to those described above. We honor applicable state privacy rights as required by law. Contact privacy@infanity.xyz to submit a request.

13.6 How to Exercise Your Rights

To exercise any of the rights described in this Section, please contact us at privacy@infanity.xyz. We will respond to verified requests within the timeframes required by applicable law (generally 30 days under GDPR; 45 days under CCPA, extendable by an additional 45 days with notice). We may need to verify your identity before processing your request. We will not charge a fee for processing rights requests unless they are manifestly unfounded or excessive. Please note that certain rights cannot be applied to data that is permanently recorded on the Optimism blockchain or that has been replicated across the Social Protocol Hub network, as described in Section 6. We will always be transparent with you about which data falls into this category when responding to your request.

14. CHILDREN'S PRIVACY

The Platform is not directed to children under the age of 18, and we do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected personal information from a child under 18, please contact us immediately at privacy@infanity.xyz and we will take steps to delete such information as promptly as possible. Because the Platform involves cryptocurrency wallet creation and financial transactions, it is particularly important that users be adults with legal capacity to enter into binding agreements.

15. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to or integrations with third-party websites, applications, and services, including streaming platforms, the Social Protocol network, Coinbase Commerce, and other services. This Privacy Policy applies only to information collected by Infanity through the Platform. We are not responsible for the privacy practices of third-party services, and we encourage you to review their privacy policies before providing any personal information to them.

16. BUSINESS USER DATA PROCESSING AND DATA PROCESSING ADDENDUM

Where Infanity processes personal data on behalf of record labels, management companies, or other business entities ("Business Users") in connection with Authorized Manager accounts or other business relationships, such processing may give rise to controller-to-processor or controller-to-controller obligations under the GDPR, UK GDPR, or LGPD. Business Users who are subject to GDPR, UK GDPR, or LGPD obligations and who process personal data through the Platform in a business capacity should contact legal@infanity.xyz to request a Data Processing Addendum (DPA). The DPA will govern the respective roles, obligations, and responsibilities of the parties with respect to personal data processed in connection with the business relationship, and will include applicable Standard Contractual Clauses for international data transfers where required. For the avoidance of doubt, Infanity acts as an independent data controller with respect to personal data it collects directly from Platform users. Where Infanity processes personal data on behalf of a Business User in connection with that Business User's Creator account management activities, Infanity may act as a data processor with respect to that specific processing.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or Platform features. If we make material changes, we will notify you by posting a notice on the Platform and, where required by applicable law, by sending you an email notification at least 14 days before the changes take effect. The updated Privacy Policy will be effective as of the date indicated at the top of the document. Your continued use of the Platform after the effective date constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated Privacy Policy, you must stop using the Platform and may request deletion of your account by contacting privacy@infanity.xyz. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

18. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: Infanity, Inc. Privacy Inquiries: privacy@infanity.xyz Legal Matters: legal@infanity.xyz Website: www.infanity.xyz/privacy For EU/EEA users: You have the right to contact your local supervisory authority if you are not satisfied with our response to your privacy request. For UK users: You may contact the Information Commissioner's Office (ICO) at https://ico.org.uk. For Brazil users: You may contact the Autoridade Nacional de Proteção de Dados (ANPD) at https://www.gov.br/anpd.

— END OF PRIVACY POLICY —

Infanity, Inc. • www.infanity.xyz • privacy@infanity.xyz