🔒 PRIVACY POLICY

Whale Group LTD ("Company," "we," "us," or "our") operates various software products under distinct trade names ("Trading Names"), including our current product Pumio. We are committed to protecting your privacy and ensuring compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable global privacy frameworks.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our websites or use our mobile applications (available on the Apple App Store and Google Play Store).

---

1. Data Controller

For the purposes of all applicable data protection laws, the Data Controller is:

• Entity: Whale Group LTD
• Company Number: 17318249
• Registered Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Email: support@pumio.io

2. Information We Collect

We categorize the data we handle into three distinct types:

#### A. Information You Voluntarily Provide to Us When you interact with our Services, we may collect:

• Account Information: Name, email address, username, and password during registration.
• User-Generated Content (UGC): Any photos, videos, text, or profile information you voluntarily upload to the platform.
• Creator Payout Request Data: If you request a payout, we collect your bank or Wise payout coordinates (e.g., IBAN, account number, or email associated with your payment account).

#### B. Information Processed by Third Parties (Data We DO NOT Collect/Store) We use specialized third parties for sensitive processes:

• Payment & Card Details: We do not collect, process, or store your credit card details or billing information. This data is collected directly by Lemon Squeezy, LLC (Merchant of Record) for web transactions, and entirely by Apple Inc. or Google LLC for mobile app purchases.
• Identity Verification (KYC) Documentation: For Creator payouts, identity verification is mandatory. This process is handled entirely by a specialized third-party KYC provider. We do not receive, view, or store your passport, government IDs, or biometric data. We only receive and retain a binary status confirmation ("Success" or "Failed").

#### C. Information Collected Automatically

• Device and Usage Data: IP address, device type, operating system version, browser type, and app performance metrics are automatically collected.
• Analytics and Tracking: We utilize Google Analytics (GA4) to track user engagement, conversions, and behavioral data across our services. For detailed information on our use of tracking mechanisms, please review our separate Cookie Policy.

3. How We Use Your Information (Legal Basis)

We use your information for specific purposes based on established legal grounds:

• ✅ To Provide and Maintain Services: Fulfilling contractual obligations to you as a User.
• ✅ To Process Transactions & Subscriptions: Executing payments via our external providers (Contractual Obligation).
• ✅ To Facilitate Payouts: Processing transfers through Wise or manual bank transfers (Legal Obligation).
• ⚙️ To Improve Services: Using aggregated analytics from Google Analytics (Legitimate Interest).
• 🛡️ Safety & Compliance: Ensuring adherence to our Terms of Service and enforcing bans for violations like 18+ content (Legal Obligation / Legitimate Interest).

4. How Your Data is Shared and Disclosed

We do not sell your personal data. We only share information with approved third-party vendors under strict confidentiality protocols:

• Lemon Squeezy (MoR): Shares payment data required to process web-based payments and subscriptions.
• Apple & Google: Processes billing via native APIs for in-app purchases.
• Content Delivery Networks (CDNs): Media materials, photos, and videos are stored on an independent third-party CDN provider.
• KYC/AML Partners: Verification requests are routed to our specialized identity check provider.
• Google Analytics: Anonymized behavioral data is transmitted solely for generating product performance insights.
• Legal Disclosure: We may disclose your information if legally required by the courts of England and Wales or other valid regulatory authorities.

5. Data Retention

The duration of data storage depends on its purpose:

• Account & Content Data: Retained for as long as your account is active. If terminated (e.g., permanent ban), we reserve the right to retain specific identifiers (email/device IDs) solely to enforce the lifetime ban and prevent re-registration.
• Media Assets on CDN: Stored while the account is active. Upon deletion, an automated command is issued to wipe assets from the third-party CDN servers within standard caching cycles.

6. International Data Transfers

As a UK company with a global user base, your data may be transferred and processed outside of the United Kingdom or European Economic Area (EEA) (e.g., by Lemon Squeezy and Google Analytics, headquartered in the US). We ensure that all such transfers comply with applicable law, utilizing legal mechanisms like Standard Contractual Clauses (SCCs) to secure your personal data.

7. Your Privacy Rights (UK GDPR)

If you reside in the United Kingdom or the European Union, you possess the following statutory rights regarding your personal data:

• Right of Access: Request a copy of all data we hold about you.
• Right to Rectification: Request corrections to inaccurate information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your account and related data.
• Right to Object/Restrict Processing: Limit how certain aspects of your data are processed.
• Right to Data Portability: Request a structured transfer of your personal data.

To exercise any of these rights, please contact us at support@pumio.io.

If you are not satisfied with our response or believe we are processing your personal data incorrectly, you have the statutory right to lodge a complaint with the UK supervisory authority: Information Commissioner's Office (ICO) (www.ico.org.uk).

8. Mobile Platforms & Privacy Consents

• iOS App Store Compliance: Our applications fully comply with Apple’s App Tracking Transparency (ATT) framework and will request explicit user permission before tracking cross-platform activity for analytical purposes.
• Google Play Compliance: Data safety logs are transparently declared within the Google Play Console in compliance with Google’s Developer Program Policies.

9. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect regulatory shifts or product changes. The updated version will be clearly marked by an updated "Last Updated" date at the top of this page.