Vport Privacy Policy

Effective Date: August 31, 2026 · Last Updated: August 8, 2026

1. Introduction

Vport, LLC ("Vport," "we," "us," or "our") operates a platform for immersive video experiences delivered to spatial computing devices, together with our related website at thevport.com (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard Personal Data when you access or use the Services.

How Vport works. Vport distributes immersive and, in some cases, non-immersive 180-degree video content in two formats: Video-on-Demand (VOD) and Live Events transmitted in real time. Content is supplied by Creators — artists, promoters, venues, and production companies — who upload it to Vport through Creator Studio. Every registered user begins as a Viewer and may activate Creator Studio from within their account. Vport hosts, processes, optimizes, and distributes Creator Content and shares revenue with Creators.

Vport hosts content supplied by its users. Creator Content is supplied at the direction of the Creator who uploads it. Before Creator Content becomes publicly available through Vport, Vport conducts a limited human review for compliance with Vport's safety and objectionable-content standards. This safety review is designed to identify content prohibited by Vport or applicable Platform safety rules; it is not editorial endorsement, copyright clearance, music-rights verification, or a determination that the Creator owns or controls all rights necessary to distribute the content. Creators remain solely responsible for obtaining all required rights and permissions. Vport also acts on valid legal notices and reports in accordance with Sections 9 and 17.

What Vport is not. Vport is not an advertising platform and displays no advertising. Vport does not offer live chat, comments, ratings, direct messages, voice chat, avatars, or co-presence. Viewers do not appear to one another, and Vport does not capture your voice, image, likeness, or surroundings through the applications at any time.

Where Vport is available. The Services are offered only in the United States, to users located in the United States. See Section 10.

By accessing or using the Services, you acknowledge the practices described in this Policy.

Deleting your data. You may delete your account and associated Personal Data at any time, free of charge, from within the Vport application (Settings → Account → Delete Account), from your account page at thevport.com, or by emailing privacy@thevport.com. This right is available to all users, in every country and region, regardless of which privacy laws apply to you. See Sections 13.1 and 13.5.

Contents

| | | | |-----------------------------------------------|--------------------------------------------------------|--------------------------------------------------------| | 1. Introduction | 9. Content Rights, Copyright & Mandatory Reporting | 17. Human Review, Automated Processing & AI | | 2. Definitions | 10. Data Location & Users Outside the U.S. | 18. Data Broker Disclosure | | 3. Scope & Applicability | 11. Data Retention | 19. Apple Vision Pro Platform Notices | | 4. Personal Data We Collect | 12. Security & Breach Notification | 20. Meta Quest & Horizon Store Notices | | 5. Purposes for Processing | 13. Your Privacy Rights | 21. Accessibility | | 6. Disclosure of Personal Data | 14. Creator-Specific Provisions | 22. Contact | | 7. Viewing & Attendance Records | 15. Cookies & Tracking Technologies | 23. Changes to This Policy | | 8. Biometric, Neural & Sensor Information | 16. Age Restriction & Children's Privacy | 24. Governing Law & Interpretation |

Deleting your account: Section 13.1  ·  Reporting content, including intimate images published without consent: Section 9.4  ·  California rights: Section 13.2  ·  What is published publicly: Section 4.4

2. Definitions

"Personal Data" (or "Personal Information") – any information that identifies, relates to, describes, or could reasonably be linked to an individual.

"User" – any individual with a Vport account. Every User is a Viewer; a User who activates Creator Studio is additionally a Creator.

"Viewer" – a User accessing the Services to view content.

"Creator" – a User who has activated Creator Studio and accepted the Vport Creator Agreement.

"Creator Studio" – the self-service area of the Services through which a User may become a Creator, upload, manage, publish, and monetize content, and access performance and payout information.

"Creator Agreement" – the agreement a User accepts upon activating Creator Studio, governing content licensing, rights representations, revenue share, and permitted use of the Services.

"Creator Content" – video, audio, still images, titles, descriptions, artwork, credits, metadata, and rights information supplied to Vport by a Creator.

"Creator Profile" – the publicly visible page associated with a Creator, containing the Creator's display name, biography, profile image, and published catalog.

"Live Event" – content transmitted to Viewers in real time or near-real time, whether or not later made available as VOD.

"Attendance Record" – a record that a specific account accessed a specific Live Event.

"Viewing Record" – a record that a specific account requested or obtained specific VOD content.

"Platform" – Apple's App Store and visionOS operating system, the Meta Horizon Store and Horizon OS operating system, or any other third-party distribution channel through which the Services are made available.

"Credits" – a prepaid stored-value balance associated with a User account, applicable toward content purchases or Live Event access.

"Biometric Information" – data generated by automatic measurement of an individual's biological characteristics used to identify that individual, as defined under RCW 19.375.010, the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and comparable state law.

"Neural Data" – information generated by measuring the activity of an individual's central or peripheral nervous system, as defined under California, Colorado, Montana, and Connecticut law.

"Spatial Data" – real-time data about your physical space, head pose, gaze, hand movement, or body position generated by headset sensors and processed locally on-device by the headset operating system. As described in Section 4.9, Vport does not receive Spatial Data.

"Sensitive Personal Information" – under the California Privacy Rights Act (CPRA), the categories specified in Cal. Civ. Code § 1798.140(ae), including account login credentials, government-issued identifiers, and precise geolocation; and under other applicable U.S. state privacy law, Biometric Information, Neural Data, and precise geolocation.

3. Scope & Applicability

This Policy applies to all Users of the Services, in both Viewer and Creator capacities, and governs:

• Apple Vision Pro application (visionOS) – distributed through the Apple App Store
• Meta Quest application (Horizon OS) – distributed through the Meta Horizon Store
• Website (thevport.com) – account registration, Creator Studio, content upload and management, event schedules, Credit purchases, and privacy controls

Geographic application. The Services are offered only in the United States. Residents of U.S. states with comprehensive privacy laws have additional rights as described in Sections 13.2 through 13.4. The rights described in Section 13.1 are extended to every User, everywhere, whether or not any law requires it. See Section 10 regarding Users outside the United States.

Availability of this Policy. This Policy is published at a publicly accessible, non-geoblocked address at thevport.com/privacy, requires no login to view, and is available inside each Vport application under Settings → Privacy Policy.

4. Personal Data We Collect

4.1 Account Registration

Information you provide:

• Email address
• Username or handle
• Date of birth, entered at signup solely to make a one-time 18-and-over eligibility determination. Vport does not retain the exact date of birth after the eligibility check is completed; see Sections 11 and 16

Authentication:

• Email and password only
• Passwords are secured using industry-standard hashing with per-password salt
• Passwords are transmitted over encrypted connections (TLS 1.2 or higher; TLS 1.3 supported and preferred)
• Passwords are Sensitive Personal Information under the CPRA and are used solely for authentication

Not supported:

• Social login (Apple Sign-In, Google Sign-In, Meta Login, or other OAuth providers)
• Single Sign-On or enterprise authentication
• In-app biometric authentication. Apple's Optic ID and Face ID and Meta's device authentication operate at the device level only and are not accessible to Vport
• Viewer profile photographs, comments, ratings, or messages

Whether provision is required. A date of birth must be entered first to determine whether you meet Vport's 18-and-over eligibility requirement. If you are eligible, an email address and password are then necessary to create an account and provide the Services. The exact date of birth is discarded after the eligibility determination; Vport retains only the resulting eligibility status and limited audit information described in Sections 11 and 16. All other data described in this Section 4 is either generated automatically as a technical necessity of delivering video, is supplied voluntarily when you activate Creator Studio, or is optional and identified as such.

4.2 Creator Studio Activation

Any eligible User may activate Creator Studio from within their account. Activation is self-service and requires acceptance of the Creator Agreement. Creator Studio activation permits a User to submit Creator Content; it does not constitute Vport endorsement of the Creator, verification of the Creator's identity beyond the account and payout processes described in this Policy, or clearance of any rights in the Creator's content. Upon activation and thereafter, Vport collects:

• Creator identity and business details — legal or business name, contact email, country and state, and where applicable the entity type and business name under which the Creator operates
• Creator Profile information — display name, biography, profile image, links, and other information the Creator elects to publish (see Section 4.4)
• Rights representations and attestations — the declarations a Creator makes under the Creator Agreement and at the time of each upload regarding ownership and clearance of the content and of the musical compositions, sound recordings, performances, likenesses, and venue permissions embodied in it
• Upload compliance confirmation — at each submission, the Creator must confirm that the Creator Content complies with Vport's Content Standards, does not contain prohibited or objectionable material, does not violate applicable law, and does not infringe or misappropriate third-party intellectual property or other rights
• Payout account status — see Section 4.3
• Creator Studio activity — upload, edit, publication, scheduling, pricing, takedown, and appeal actions, with timestamps and originating IP address

Age. Creator Studio is available only to Users who are at least 18 years of age. See Section 16.

4.3 Creator Payouts — Stripe

Creator payments are administered through Stripe. When a Creator sets up payouts, Stripe collects the information required to verify identity and remit funds — which may include full legal name, date of birth, residential or business address, taxpayer identification number (SSN, ITIN, or EIN), government-issued identification, and bank account details — directly from the Creator through Stripe's own interface.

• Vport does not collect, receive, or store Creator taxpayer identification numbers, government identification documents, or full bank account numbers. Stripe processes that information as an independent controller under its own privacy policy and terms.
• Vport receives from Stripe only: a payout account identifier, verification and eligibility status, the Creator's name and country as verified, payout amounts and dates, and any restriction or dispute status necessary to administer the account.
• Earnings, payout history, revenue-share calculations, and any adjustments or recoupments are recorded by Vport in association with the Creator's account.
• Information reporting to the U.S. Internal Revenue Service, including Forms 1099 where required, is performed by Vport and/or Stripe as applicable, using the information Stripe has verified.

4.4 Creator Content, Metadata, and the Public Creator Profile

Content and metadata:

• Video, audio, images, and other files a Creator uploads, together with technical metadata generated during ingest, transcoding, packaging, and quality analysis
• Titles, descriptions, artwork, credits, performer and songwriter information, event dates, venue information, territory and scheduling settings, pricing, and rights attestations supplied by the Creator

Information published publicly. A Creator Profile and the Creator Content published under it are public. Display name, biography, profile image, published titles, artwork, descriptions, credits, and aggregate figures such as view counts are visible to any User and may be indexed by search engines and cached or copied by third parties beyond Vport's control. Do not place information in a Creator Profile, title, description, or credit field that you do not wish to be public. Vport does not publish a Creator's email address, payout information, taxpayer information, or account identifiers.

4.5 Reports, Moderation, and Enforcement Data

Vport maintains mechanisms allowing Users, rights holders, and members of the public to report content and conduct, and to appeal enforcement decisions. In connection with those mechanisms we process:

• The content of a report, notice, counter-notification, removal request, or appeal, together with the identity and contact information of the person submitting it and any supporting material supplied
• Records of enforcement actions taken on an account or item of content, including removal, restriction, suspension, termination, and reinstatement, with the basis and date of each action
• Records maintained to administer Vport's repeat infringer policy under 17 U.S.C. § 512(i)
• Records reasonably necessary to enforce prior removal, suspension, blocking, and other safety or legal decisions and to prevent circumvention of those decisions

Reports may be submitted by individuals who do not hold a Vport account. Where a report is submitted without an account, we process only the information the reporter supplies and the technical information necessary to receive and respond to it. If a User blocks a Creator, Vport stores the minimum account-to-Creator blocking preference necessary to keep that Creator's content from being presented to that User until the block is removed or the User account is deleted.

4.6 Automatically Collected Information

Device and log data:

• IP address, retained in identifiable form for 30 days and then deleted or irreversibly truncated for aggregate reporting
• Apple IDFV (Identifier for Vendors) on visionOS, used for session management and for first- and third-party analytics (see Section 15.2)
• Installation UUID for crash attribution
• Crash reports and system performance logs, retained 30 days and then deleted
• Operating system version, headset or device model, application version, and browser type

We do not collect the IDFA (Identifier for Advertisers), the Meta Advertising ID, or cross-app tracking identifiers, and we do not construct device fingerprints for tracking or identification purposes.

Usage data:

• Content titles and watch time, and Live Event identifiers and attendance times, stored internally for Service functionality and Creator revenue accounting. This information is not shared with any third-party analytics provider (see Section 7)
• Features used, including search, filters, playback controls, catalog and schedule browsing, and Creator Studio functions. We log that a feature was used; we do not store the text of your search queries
• Session duration and interaction timestamps
• Individual identifiers are removed from Vport's own analytics stores after 30 days, and data is aggregated thereafter

4.7 Live Event Data

Session and quality-of-service telemetry:

• Stream join and leave timestamps and session duration
• Selected bitrate and resolution, adaptive bitrate switches, rebuffering events, dropped frames, and playback error codes
• End-to-end latency measurements and the content delivery network edge region serving the session
• Network connection type and approximate available bandwidth

This telemetry is used for real-time capacity management, fault diagnosis, and post-event quality review. Individual identifiers are removed within 30 days, after which only aggregate quality metrics are retained.

Entitlement, ticketing, and concurrent-stream enforcement:

• Account identifier, Live Event identifier, and a device or installation identifier are processed to confirm a valid entitlement or ticket and to enforce reasonable limits on simultaneous streams per account

Attendance Records:

A record that an account attended a specific Live Event is created and retained for entitlement, support, refund, and revenue-accounting purposes. Vport applies to Attendance Records the same confidentiality protections it applies to Viewing Records, as described in Section 7, without regard to how a live transmission may be characterized under the federal Video Privacy Protection Act.

Not collected during Live Events:

• No microphone access. Vport does not request microphone permission on any Platform and cannot record or transmit your voice or the audio of your surroundings
• No camera or passthrough access. Vport does not request camera, passthrough camera, or screen-capture permission
• No Viewer-generated content. There is no mechanism for a Viewer to transmit messages, audio, video, or other content during a Live Event. Viewers may, however, use Vport's reporting and blocking controls in connection with Creator Content; records generated by those controls are handled as described in Sections 4.5 and 9.6
• No avatars, presence, or co-presence. Other Viewers cannot see you, learn that you are watching, or learn who else is watching
• No identifiable audience data to Creators. Creators receive aggregate audience figures only (see Section 6.3)

Recording and republication:

Live Events may be recorded and subsequently made available as VOD, and VOD content may or may not originate from a Live Event. Any such recording captures the content, not the audience of the Vport applications. Nothing about your viewing session, your device, or your environment is recorded into the captured content. Filming of in-person audiences at physical venues is conducted by the Creator or its production partners under the venue's own ticketing terms, posted notices, and applicable law, and is not governed by this Policy. If you believe you appear identifiably in content distributed on Vport and wish to raise a concern, contact privacy@thevport.com.

4.8 Approximate Location and Territory Restrictions

Creator Content and Live Events are frequently licensed on a territory-limited basis. To honor those licenses, to confirm eligibility for the Services, and to protect against fraud, we process your IP address to determine your approximate location at the country and, in some cases, regional level, and we may restrict access to specific content on that basis.

• We do not collect precise geolocation. Approximate location derived from an IP address is materially coarser than the thresholds defining "precise geolocation" as sensitive data under U.S. state privacy law (1,850 feet under the CPRA; 1,750 feet under most other state laws). Vport does not collect, infer, or store location at that level of precision
• We do not request device location permissions (GPS, Core Location, or Horizon OS location) on any Platform
• We may detect the use of VPNs, proxies, or other IP-masking services and may decline to serve territory-restricted content where such use is detected
• Our analytics provider (Google Firebase) may derive approximate location at the country or region level from IP addresses for aggregate reporting
• IP addresses and coarse location are Personal Data and are within the scope of your access and deletion rights

4.9 Headset Sensor and Spatial Data

All spatial and sensor processing occurs on-device, at the operating system level. On both Apple Vision Pro and Meta Quest, Vport never receives:

• Raw camera images, passthrough video, or screen captures
• Depth maps, scene meshes, room geometry, planes, or environmental mapping
• Hand-tracking vectors, hand skeleton models, or hand geometry
• Eye-gaze data, eye-tracking vectors, iris or retina data, or pupillometry
• Facial expression data, face-tracking blendshapes, or Persona or avatar imagery
• Body-tracking or skeletal joint data
• Microphone audio or voice data

What Vport receives: discrete interaction events only — tap, select, pinch, scroll — being the same class of input generated by a mouse or touchscreen; and, where the application places content in your space, abstract positioning values used solely for rendering.

Retention. Spatial Data is held in volatile memory only and is purged when the session ends. No persistent storage occurs.

Permissions not requested. Vport does not request eye tracking, face tracking, body tracking, hand tracking, camera or passthrough camera, scene or spatial data, microphone, location, or contacts permissions on any Platform.

No derived biometrics. We do not use spatial interaction data, hand tracking, head pose, or eye tracking to identify individual users, build biometric profiles, or derive unique biometric identifiers. See Section 8.

4.10 Platform Account and Entitlement Data

Where you obtain a Vport application through a Platform, we receive a limited set of data from that Platform to confirm your purchase and deliver your content.

| Platform | What Vport receives | What Vport does not receive | |---------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Apple App Store (visionOS) | Transaction success or failure status; App Store transaction receipt for entitlement verification; IDFV | Apple ID, name, email address, payment card data, billing address, Apple Account contact details, IDFA | | Meta Horizon Store (Horizon OS) | An app-scoped Meta user identifier, unique to the Vport application and not correlatable across other developers' applications; entitlement check result | Meta account name, Meta Horizon username, profile picture, friends list, presence, party or room membership, organization-scoped identifier, payment card data, Meta Advertising ID |

Vport does not link, combine, or cross-reference Platform identifiers with data obtained from any other company's applications, websites, or offline properties.

Shared headsets. Where a Platform permits more than one account to use an application on the same physical headset, each account is treated as a separate User with separate data and separate deletion rights.

4.11 Payment Processing

Viewers on Apple Vision Pro:

• In-app purchases are processed exclusively through Apple's In-App Purchase system
• Vport does not collect, process, or store Viewer financial information. Apple processes and retains Viewer payment data under its own privacy policy
• Vport receives transaction success or failure status and Apple's transaction receipt for entitlement verification

Viewers on Meta Quest:

• In-app purchases, add-ons, and subscriptions are processed exclusively through Meta's Platform In-App Purchase system, as required by the Meta Horizon Store
• Vport does not collect, process, or store Viewer financial information. Meta processes and retains Viewer payment data under its own privacy policies
• Vport receives transaction and entitlement status only

Website purchases:

• Credit purchases on thevport.com are processed by Stripe
• Vport receives transaction success or failure status and masked card identifiers only (for example, "Visa ending in 4242")
• We do not receive full card numbers, security codes, or raw payment credentials
• Credit balances and Credit transaction history are stored with your account and are subject to Sections 11 and 13

4.12 Marketing Communications

We send marketing and promotional email — for example, announcements of new content and upcoming Live Events — only if you affirmatively opt in. Opting in is never required to create an account, to activate Creator Studio, or to access content you have purchased.

• We use your email address, username, and coarse engagement data (whether a message was delivered and opened) for this purpose
• Every marketing email contains a one-click unsubscribe link, and you may also unsubscribe in-app under Settings → Notifications or by emailing privacy@thevport.com
• Unsubscribe requests are honored promptly and in all cases within ten business days, consistent with the CAN-SPAM Act
• Transactional and service messages — receipts, entitlement confirmations, payout notices, legal notices, and security alerts — are not marketing and are sent regardless of marketing preferences

4.13 Push Notifications and Event Reminders

If you elect to receive reminders about upcoming Live Events, we process a push notification token issued by your Platform's notification service, together with your account identifier and the events you have chosen to follow.

• Notifications are opt-in and may be disabled at any time in the application or in device settings
• Push tokens are deleted when notifications are disabled, when the token is invalidated by the Platform, or when the account is deleted
• Access to purchased content is not conditioned on enabling notifications, granting analytics consent, or enabling any other system permission

5. Purposes for Processing

| Purpose | Basis | |------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------| | Service delivery — account creation, catalog, VOD and Live Event playback, payments | Necessary to provide the Services requested | | Creator Studio operation — upload, transcoding, publication, scheduling, catalog management | Necessary to provide the Services requested | | Creator payouts, revenue accounting, and tax reporting | Necessary to provide the Services; legal obligation | | Entitlement, ticketing, and concurrent-stream enforcement | Necessary to provide the Services; legitimate business interest in preventing credential abuse | | Live stream quality-of-service and capacity management | Necessary to operate a reliable service | | Territory restriction and licensing compliance | Necessary to honor content licenses | | Content protection and digital rights management | Necessary to secure licensed playback and protect the Services | | Receiving and acting on reports, legal notices, and appeals; enforcing the Creator Agreement and repeat infringer policy | Legal obligation; legitimate business interest in operating a lawful platform | | Security and fraud prevention | Legitimate business interest in securing accounts and protecting the Services and Users | | Age assurance and 18-and-over enforcement | Necessary to enforce Vport service eligibility and safety requirements; Platform and legal compliance where applicable | | First-party analytics and quality improvement | Legitimate business interest in understanding aggregate product usage | | Third-party analytics (Firebase) | Notice, with opt-out available to every User at any time | | Live event reminders and push notifications | Your consent (opt-in) | | Marketing email | Your consent (opt-in) | | Legal compliance — tax, copyright, mandatory reporting, lawful requests | Legal obligation |

We do not process Personal Data for any purpose incompatible with those listed above without first updating this Policy and, where required, obtaining your consent.

6. Disclosure of Personal Data

Vport does not sell Personal Data for monetary or other valuable consideration and does not disclose Personal Data for cross-context behavioral advertising. Vport does not engage in targeted advertising, displays no advertising, and has not sold or shared Personal Data, as those terms are defined under the CCPA and other U.S. state privacy laws, in the preceding twelve months.

6.1 Public Disclosure by You

Information you publish through Creator Studio — including your Creator Profile and all published Creator Content and its associated metadata — is disclosed publicly by you, not by Vport, and is described in Section 4.4.

6.2 Service Providers

We engage third-party vendors under written agreements limiting them to processing data on our instructions and prohibiting secondary use:

| Category | Providers | |----------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------| | Hosting and infrastructure | Google Cloud Platform, Bunny CDN, Cloudflare | | Ingest, transcoding, packaging, and delivery | Encoding, transcoding, packaging, and low-latency delivery vendors engaged for VOD and Live Events | | Digital rights management | DRM license vendors (Apple FairPlay, Google Widevine, and associated licensing services) | | Analytics | Google Firebase — crash reporting, performance monitoring, and application analytics, excluding all viewing and attendance data | | Payments and payouts | Apple (In-App Purchase), Meta (Platform In-App Purchase), Stripe (website purchases and Creator payouts) | | Email communications | SendGrid | | Customer support | Chatwoot |

Subprocessor list. A current list of subprocessors, including the specific delivery and DRM vendors engaged at any time, is maintained at thevport.com/subprocessors.

Equivalent protection. Every third party with whom Vport shares User data — including analytics providers, infrastructure and delivery vendors, third-party SDKs, and any parent, subsidiary, affiliate, or other related entity with access to User data — is contractually required to provide the same or equal protection of User data as is stated in this Privacy Policy and as required by applicable Platform guidelines. Vport does not share Personal Data with data brokers or advertising networks, and does not disclose Personal Data to any third party for the purpose of developing, training, or improving artificial intelligence models.

Analytics and California law. Because Vport does not disclose Personal Information for cross-context behavioral advertising, our use of Google Firebase does not constitute a "sale" or "share" under Cal. Civ. Code § 1798.140(ad) and (ah). Firebase is engaged as a service provider under a written data processing agreement, is configured without Google Signals and without advertising personalization, and receives Identifiers (user ID, device ID), Internet Activity (screen views, session data, feature interactions), and coarse country or region location derived from IP address. It does not receive viewing history, attendance records, or any content titles or event identifiers. A one-click opt-out from third-party analytics is nevertheless available to every User in-app under Settings → Privacy, or by emailing privacy@thevport.com with subject line "Opt-Out Analytics Sharing."

6.3 Aggregate Data to Creators

Creators receive aggregated, non-identifiable statistics regarding their own content only — for example, total views, average watch time, peak concurrent audience, and region-level audience distribution. Creators do not receive Viewer names, email addresses, usernames, account identifiers, device identifiers, IP addresses, or individual Viewing Records or Attendance Records.

6.4 Rights Holders and Legal Notices

Where Vport receives a notice of claimed infringement, a removal request, or a comparable legal complaint concerning content on the Services, Vport may disclose to the complaining party the information necessary to process and respond to that notice.

Counter-notification. If you submit a counter-notification under 17 U.S.C. § 512(g), the statute requires Vport to provide the complaining party with a copy of your counter-notification, including your name, address, telephone number, and the statement of consent to jurisdiction it contains. This disclosure is mandatory and is a direct consequence of submitting a counter-notification. Consider that before submitting one.

6.5 Legal Requirements and Government Requests

We may disclose data where required by valid subpoena, court order, warrant, or other legal obligation, including mandatory reports under 18 U.S.C. § 2258A described in Section 9.5. We notify Users unless legally prohibited from doing so or unless Section 7.4 provides otherwise, and we will challenge requests we determine to be overbroad or unlawful. Disclosure of Viewing Records and Attendance Records is additionally constrained by Section 7.4.

6.6 Business Reorganization

If Vport is acquired, merged, or undergoes a change of control, Personal Data may transfer as a business asset. We will notify Users as soon as practicable and in any event before Personal Data is used in a manner materially different from this Policy, and Users may request deletion at that time.

6.7 De-Identification and Pseudonymization

Aggregated data is combined with data of other Users such that individuals cannot be identified. De-identified data is data from which all identifiers have been permanently and irreversibly removed and which we do not attempt, and contractually prohibit our vendors from attempting, to re-identify; it is not subject to privacy rights requests. Pseudonymized data — data in which direct identifiers have been replaced or hashed but which could still be linked to an individual with additional information — is treated as Personal Data and remains within the scope of your privacy rights.

6.8 California "Shine the Light" (Cal. Civ. Code § 1798.83)

Vport does not disclose Personal Information to third parties for those third parties' own direct marketing purposes. California residents may request confirmation by emailing privacy@thevport.com with subject line "Shine the Light Request," and we will respond as required by law.

7. Viewing and Attendance Records

What you choose to watch is among the most sensitive information Vport holds. We apply a single uniform standard to all Viewing Records and Attendance Records — VOD, Live Event, and live content later republished as VOD — without regard to how any particular transmission may be characterized under the federal Video Privacy Protection Act, 18 U.S.C. § 2710 ("VPPA").

7.1 Commitments

• No disclosure to advertisers, data brokers, or marketers. We do not disclose personally identifiable information concerning your viewing or attendance history to advertisers, advertising networks, data brokers, social media platforms, or any third party for marketing purposes
• No title-level data to analytics providers. Content titles, event identifiers, and content identifiers are not transmitted to Google Firebase or to any other third-party analytics, attribution, or measurement provider, alone or in combination with an identifier. Automatic screen-name collection in our analytics SDK is configured so that screen identifiers are content-agnostic
• No advertising or tracking pixels. Vport does not deploy advertising pixels, conversion tags, social plugins, retargeting tags, or session-replay tools in its applications or on its content pages
• No identifiable viewing data to Creators. Creators receive aggregate figures only, per Section 6.3
• Strictly necessary recipients only. The only disclosure of viewing or attendance information to service providers is that strictly necessary to deliver the Services: cloud hosting and content delivery infrastructure required to transmit video; DRM licensing required to decrypt it; entitlement checking required to confirm permission to view; transactional email required to send a receipt or event confirmation; and customer support where you yourself raise an issue about specific content. Each such provider is bound by a written agreement prohibiting use of that information for advertising, marketing, model training, or any purpose unrelated to delivering the Services

7.2 Consent Standard

Vport does not disclose personally identifiable viewing or attendance information to any third party for any purpose beyond those described in Section 7.1. If Vport proposes to do so, it will first obtain your informed, written consent in a form distinct and separate from any other legal or financial terms — a standalone, affirmative opt-in, and not a term contained in this Policy, in the Terms of Service, or in a checkout flow. Any such consent will be limited in duration to no more than two years, will be withdrawable at any time on a case-by-case basis or as to all ongoing disclosures, and will be accompanied by a clear and conspicuous means of withdrawal. This standard reflects 18 U.S.C. § 2710(b)(2)(B).

7.3 Destruction

Viewing Records and Attendance Records are retained only as long as necessary for the purposes for which they were collected — including maintaining your library, resume-playback position, purchase history, entitlement verification, support, refunds, and Creator revenue accounting — and are destroyed as soon as practicable and in no event later than one year after the date on which the information is no longer necessary for those purposes, consistent with 18 U.S.C. § 2710(e). Records retained solely to satisfy a legal obligation are retained in a form that does not identify the specific content viewed wherever practicable.

7.4 Legal Process

Law enforcement. Vport will not disclose Viewing Records or Attendance Records to a law enforcement agency except pursuant to a valid warrant, or a court order or grand jury subpoena issued in accordance with 18 U.S.C. § 2710(b)(2)(C). Where a court order is relied upon, we will provide reasonable notice and an opportunity to contest the order unless legally prohibited from doing so.

Civil proceedings. Vport will disclose Viewing Records or Attendance Records in a civil proceeding only pursuant to a court order meeting the compelling-need standard of 18 U.S.C. § 2710(b)(2)(F), and only after providing notice and a reasonable opportunity to appear and contest the order.

8. Biometric, Neural, and Sensor Information

Vport does not collect, capture, process, store, or disclose Biometric Information or biometric identifiers as defined by RCW 19.375, the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, Colorado's biometric provisions, or any other applicable biometric privacy law. Vport does not enroll any individual in a biometric database, does not convert any biological characteristic into a reference template, and does not use any such data to identify an individual. Vport does not seek consent for biometric processing because it performs none.

Vport does not collect, process, or store Neural Data as defined under California, Colorado, Montana, or Connecticut law, and does not collect pupillometry, brain activity, or any measurement of central or peripheral nervous system activity.

Uploaded content. Vport does not apply facial recognition, voice identification, gait analysis, or any other biometric identification technology to Creator Content or to any image, video, or audio available through the Services, and does not derive biometric identifiers from that content.

Hardware isolation. Biometric authentication and sensing — Apple's Optic ID and Face ID, Meta's device authentication, and eye, face, and hand tracking on either Platform — occur entirely at the hardware and operating-system level within secure processing environments controlled by Apple and Meta. Vport never accesses biometric templates, raw sensor data, or underlying camera feeds, and no Platform interface available to Vport permits it to do so.

No derived biometrics. We do not use spatial interaction data, hand tracking, head pose, or eye tracking to identify individual Users, derive unique biometric identifiers, or build behavioral or biometric profiles.

No health data. Vport does not collect consumer health data, does not infer health status, conditions, or treatment from viewing behavior, content selection, or sensor data, and does not collect location information capable of indicating an attempt to acquire or receive health services.

Change of practice. Vport will not begin collecting Biometric Information or Neural Data without first updating this Policy, publishing any separate written biometric policy required by law with a retention schedule and destruction guidelines, and obtaining the affirmative, informed consent applicable law requires before collection begins.

9. Content Rights, Copyright, and Mandatory Reporting

9.1 Creator Responsibility and Vport's Role

Creator Content is uploaded at the direction of the Creator. Under the Creator Agreement and the upload flow, each Creator represents and warrants that it owns or controls all rights necessary to distribute the content uploaded, including where applicable the musical composition, sound recording, master, synchronization, public performance, name and likeness, and venue rights embodied in it, and confirms that the submission complies with Vport's Content Standards and applicable law.

Before publication, Vport performs the limited human safety review described in Section 9.6 to identify objectionable or prohibited subject matter. That safety review is not a copyright-clearance process and is not designed to investigate ownership, licensing, chain of title, or infringement. Vport does not use automated copyright fingerprinting or content-recognition systems to determine whether uploaded material infringes third-party rights, and Vport does not undertake an affirmative duty to monitor the Services for copyright infringement, consistent with 17 U.S.C. § 512(m). Creators remain responsible for rights clearance. If Vport receives a compliant infringement notice or otherwise obtains actual knowledge or awareness of specific infringing material or activity, Vport acts in accordance with applicable law and the processes below.

9.2 Designated Copyright Agent

As required by 17 U.S.C. § 512(c)(2), Vport has designated an agent to receive notifications of claimed infringement, has registered that designation with the United States Copyright Office at https://www.copyright.gov/dmca/onlinesp/, maintains the registration in current form, and publishes the agent's contact information here and at thevport.com in a location accessible to the public without login:

• Designated Agent: Vport Legal Department
• Address: 2510 6th Avenue, Unit 3006, Seattle, WA 98121, USA
• Email: dmca@thevport.com

9.3 Notice, Counter-Notification, and Repeat Infringers

Notices. A notification of claimed infringement must contain the elements required by 17 U.S.C. § 512(c)(3), including identification of the copyrighted work, identification of the material claimed to be infringing and information sufficient to locate it, your contact information, a statement of good-faith belief, a statement of accuracy made under penalty of perjury, and a physical or electronic signature. Vport removes or disables access to material expeditiously upon receipt of a compliant notice and notifies the affected Creator.

Good-faith removal. Vport removes or disables access to material in good faith upon receipt of a notice, or where infringing activity is otherwise apparent, without first adjudicating the merits of the claim. Removal is not a determination that the material infringes. Where Vport removes material supplied by a Creator, it notifies the Creator, forwards any valid counter-notification, and restores the material within the statutory period, as described below and as contemplated by 17 U.S.C. § 512(g).

Misrepresentation. Under 17 U.S.C. § 512(f), any person who knowingly materially misrepresents that material or activity is infringing, or that material was removed or disabled by mistake or misidentification, is liable for damages, including costs and attorneys' fees, incurred by the alleged infringer, the copyright owner or its licensee, or the service provider. This applies to notices and counter-notifications alike.

Counter-notification. An affected Creator may submit a counter-notification meeting the requirements of 17 U.S.C. § 512(g)(3), which include the Creator's signature; identification of the removed material and where it appeared; a statement under penalty of perjury of good-faith belief that removal resulted from mistake or misidentification; and the Creator's name, address, and telephone number, together with consent to the jurisdiction of the federal district court for that address and to accept service of process from the complaining party. Material is restored not less than ten nor more than fourteen business days after receipt of a valid counter-notification, unless the complaining party first notifies Vport that it has filed an action seeking a court order. Vport is required by statute to forward the counter-notification, including all of that identifying and contact information, to the complaining party. See Section 6.4.

Repeat infringers. Vport has adopted and reasonably implements a policy providing for termination, in appropriate circumstances, of the accounts of Users who are repeat infringers, as required by 17 U.S.C. § 512(i). Vport maintains the records described in Section 4.5 for that purpose. Appeals may be submitted to legal@thevport.com.

Standard technical measures. Vport accommodates and does not interfere with standard technical measures used by copyright owners to identify or protect copyrighted works.

9.4 Non-Consensual Intimate Imagery

Reporting intimate images published without consent. If an intimate visual depiction of you — including a digitally created or altered depiction — has been published on Vport without your consent, you may request its removal by emailing report@thevport.com with the subject line "NCII REMOVAL REQUEST," or by using the in-product reporting control. You do not need a Vport account to submit a request. A valid request must include a physical or electronic signature; identification of the depiction and information reasonably sufficient to locate it; a brief statement that you have a good-faith belief the depiction was published without your consent; and information sufficient for Vport to contact you. Vport will remove the depiction, and make reasonable efforts to remove any known identical copies, within 48 hours of receiving a valid request. This process is provided under Section 3 of the TAKE IT DOWN Act, Pub. L. 119-12.

Information submitted through this process is used solely to evaluate and act on the request, to prevent re-upload of the depiction, and to comply with law. It is retained as described in Section 11.

9.5 Child Sexual Abuse Material

Vport prohibits the upload or transmission of child sexual abuse material and of any content depicting the sexual exploitation of a minor. Upon obtaining actual knowledge of facts or circumstances indicating an apparent violation of 18 U.S.C. §§ 2251, 2251A, 2252, 2252A, 2252B, 2260, 1591, or 2422(b), Vport reports to the CyberTipline of the National Center for Missing & Exploited Children as soon as reasonably possible, as required by 18 U.S.C. § 2258A, and preserves the reported content and associated records for the period the statute requires. Such reports may include the identifying information, technical information, geographic information, and content specified in 18 U.S.C. § 2258A(b). Vport does not notify the account holder of such a report where notification is prohibited or would compromise an investigation.

9.6 Other Reporting

Vport operates a content safety system comprising four elements:

• Content standards and pre-publication safety filtering. The Creator Agreement, Terms of Service, and Content Standards prohibit objectionable and unlawful content. Each Creator must provide the upload compliance confirmation described in Section 4.2. Before Creator Content becomes publicly available, a Vport reviewer conducts a limited human safety review for prohibited or objectionable subject matter, including pornography or sexually explicit material, sexual exploitation, severe graphic violence, credible threats or dangerous conduct, hate or targeted harassment, exploitation of minors, and other material prohibited by Vport or applicable Platform rules. Content that does not pass this review is rejected, withheld, or escalated. This safety review does not constitute copyright clearance or verification of intellectual-property rights; copyright matters are handled separately under Sections 9.1 through 9.3.
• Reporting. Any User, rights holder, or member of the public — including a person without a Vport account — may report content or conduct that violates Vport's standards or applicable law, using the in-product reporting control or by writing to report@thevport.com. In-product report reasons include prohibited or objectionable content, age/safety concerns, abusive conduct, intellectual-property concerns, and other violations. Reports are triaged and acted upon promptly, and reporters receive confirmation where contact information is available.
• User blocking and platform enforcement. A User may block a Creator through the in-product control, after which Vport uses the blocking preference described in Section 4.5 to stop presenting that Creator's content to that User. Separately, Vport may remove or restrict content, restrict a Creator's ability to publish, suspend or terminate accounts, block a terminated User from re-registering, and withhold or reverse payouts, in accordance with the Creator Agreement and Terms of Service.
• Contact and appeal. Contact information is published at Section 22. An affected User may contest an enforcement action by writing to legal@thevport.com.

Personal data processed through these mechanisms is described in Section 4.5 and retained as described in Section 11. The complete copyright and content-standards policy is set out in Vport's Terms of Service and Creator Agreement; this Section describes the personal data aspects.

10. Data Location and Users Outside the United States

Vport is a Delaware limited liability company with operations in the United States, and all Personal Data is stored and processed in the United States. Content delivery infrastructure serving the Services operates within the United States.

United States availability only. The Services are offered only in the United States. Vport's applications are made available on United States storefronts only, are priced in U.S. dollars, are presented in English, and are not directed to, marketed to, or intended for individuals located outside the United States. Vport does not offer the Services to individuals in the European Economic Area, the United Kingdom, Switzerland, Canada, or any other jurisdiction outside the United States, does not monitor the behavior of individuals located outside the United States, and applies the territory controls described in Section 4.8.

If you are outside the United States, please do not use the Services. If you believe you created an account while located outside the United States, contact privacy@thevport.com and we will delete your account and associated Personal Data, free of charge, as described in Sections 13.1 and 13.5. The universal rights in Section 13.1 are available to every User regardless of location.

Expansion. If Vport begins offering the Services outside the United States, we will update this Policy before doing so and describe the additional rights, legal bases, and cross-border transfer safeguards that apply.

11. Data Retention

| Data category | Retention period | |------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Account profile data — email, username, Credit balance | Life of account. Following a verified deletion request, deleted from production systems promptly and purged from backups within 90 days | | Age eligibility record — 18+ eligibility result, completion timestamp, and declaration method | Life of account; exact date of birth entered for the eligibility check is not retained | | Creator blocking preferences | Until the User removes the block or deletes the account | | Viewing Records and Attendance Records | Only as long as necessary for the purposes collected; destroyed no later than one year thereafter (Section 7.3) | | Creator Content and associated metadata | Until removed by the Creator, removed by Vport, or the Creator account is deleted; subject to the exceptions in Section 13.5 | | Creator rights attestations and upload records | Life of the Creator account plus 3 years, and longer where subject to a claim, notice, or legal hold | | Creator earnings, payout, and revenue-share records | 7 years (IRS recordkeeping requirements and applicable limitations periods) | | Copyright notices, counter-notifications, and repeat infringer records | As long as necessary to administer the repeat infringer policy under 17 U.S.C. § 512(i) and to comply with 17 U.S.C. § 512(g) | | NCII removal requests and associated records | Retained as necessary to act on the request, prevent re-upload, and evidence compliance | | Records reported under 18 U.S.C. § 2258A | Preserved for the period required by 18 U.S.C. § 2258A(h), and longer where required by legal process | | Reports, moderation, and enforcement records | 24 months from resolution, and longer where subject to appeal, claim, or legal hold | | Live session and quality-of-service telemetry | 30 days in identifiable form, then aggregated | | Entitlement and concurrent-stream records | Life of entitlement plus 90 days | | DRM license logs | 90 days | | Transaction records (tax) | 7 years (IRS recordkeeping requirements and applicable limitations periods) | | IP and device logs | 30 days in identifiable form, then deleted or irreversibly truncated | | Analytics identifiers — Vport systems | 30 days, then aggregated | | Analytics identifiers — third-party analytics provider | Configured to the shortest user-level retention period the provider offers, and in no case longer than two months, after which only aggregate reports are retained | | Spatial Data and sensor interaction data | No persistent storage | | Push notification tokens | Until notifications disabled, token invalidated, or account deleted | | Customer support correspondence | 24 months from resolution, unless subject to a legal hold | | Marketing preferences and suppression records | Preferences until unsubscribe or account deletion; suppression records retained so that we do not re-contact you |

Backups. Data is purged from production systems promptly following a verified deletion request and from backup systems within 90 days as backup media cycle.

12. Security and Breach Notification

12.1 Security Measures

• Encryption: AES-256 for data at rest; TLS 1.2 or higher in transit, with TLS 1.3 supported and preferred
• Access controls: role-based access control, multi-factor authentication for administrators, least-privilege provisioning, and segregated access to Creator Studio and moderation systems
• Content security: DRM-protected playback, signed and expiring streaming URLs, and token-based entitlement validation
• Infrastructure security: firewalls, intrusion detection, and regular security assessments

These measures are designed to protect against unauthorized access, alteration, and disclosure. No security system is impenetrable.

12.2 Risk Assessments

Vport conducts privacy and security risk assessments where required by applicable U.S. state privacy regulation before commencing new processing activities presenting a significant risk to consumers' privacy or security. Creator Studio, Live Event streaming, and the reporting and enforcement systems described in Section 9 are within the scope of that process.

12.3 Breach Notification

All Users. We will notify affected individuals where required by applicable law, and otherwise where we determine notification is appropriate, without unreasonable delay and consistent with the legitimate needs of law enforcement.

Washington residents. Notification in compliance with RCW 19.255.010, including notice to affected Washington residents no more than 30 calendar days after discovery of the breach, and notice to the Washington Attorney General no more than 30 calendar days after discovery where the breach affects more than 500 Washington residents.

California residents. Notification in compliance with Cal. Civ. Code § 1798.82, including notice to affected California residents within 30 calendar days of discovery, and notice to the California Attorney General within 15 calendar days after individual notification where more than 500 California residents are affected.

Other states. Notice is provided in accordance with the breach notification law of your state of residence, including any applicable deadline and any requirement to notify a state Attorney General, regulator, or consumer reporting agency.

Methods. Email to your account email address and, where appropriate, in-application notification.

13. Your Privacy Rights

Vport charges no fee for exercising any privacy right and does not discriminate against any User for exercising one. Creators should also read Section 14.

13.1 Rights Available to All Users, Everywhere

| Right | Description | |-------------------------------|----------------------------------------------------------------------------------------------------------| | Access | Request a copy of the Personal Data we hold about you | | Correction | Request correction of inaccurate data | | Deletion | Request deletion of your account and associated Personal Data, subject to the exceptions in Section 13.5 | | Portability | Receive a copy of your data in a portable, machine-readable format | | Withdraw consent | Withdraw any consent at any time, without affecting the lawfulness of prior processing | | Opt out of analytics | Disable third-party analytics collection in-app under Settings → Privacy | | Opt out of marketing | Unsubscribe at any time via the link in any message or under Settings → Notifications | | Deactivate Creator Studio | Unpublish your content and deactivate Creator Studio without deleting your Viewer account |

How to exercise these rights:

• In-app account deletion: open the Vport application on Apple Vision Pro or Meta Quest and go to Settings → Account → Delete Account. This deletes the entire account record together with associated Personal Data. Temporary deactivation is not offered as a substitute for deletion
• On the web: sign in at thevport.com and go to Account → Privacy, where account deletion, data export, correction, and Creator Studio deactivation are available
• By email: write to privacy@thevport.com from your account email address

Deletion is free of charge and available to all Users in all regions. Where we cannot fulfill a request in whole or in part, we will identify the data retained and the specific legal basis for retaining it. You will receive email confirmation of your deletion request.

13.2 California Residents (CPRA/CCPA)

Categories of Personal Information collected in the preceding 12 months. The following maps the statutory categories of Cal. Civ. Code § 1798.140(v) to what Vport collects.

| Statutory category | Examples collected | Source | Disclosed to (business purpose only) | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------|---------------------------------------------------------------------------------------------------------| | Identifiers | Email address, username, account ID, Creator display name, IDFV, app-scoped Meta user ID, installation UUID, IP address, push token | You; your device; the Platform | Hosting, delivery, analytics, email, support, DRM, payments | | Customer records (Cal. Civ. Code § 1798.80(e)) | Account credentials; 18+ eligibility status; Credit balance; purchase and entitlement history; Creator earnings and payout records | You; Apple, Meta, or Stripe | Hosting; payment processors; tax advisors | | Commercial information | Content and Live Events purchased, considered, or accessed; transaction history; Creator revenue records | You; the Platform | Hosting, delivery, DRM, and entitlement providers only — never analytics or advertising (Section 7) | | Internet or other network activity | Screen views, feature interactions, session duration, playback telemetry, Creator Studio activity, crash and performance logs | Your device | Hosting, analytics (excluding titles), crash reporting | | Geolocation data (coarse only) | Country and region inferred from IP address for licensing, eligibility, and fraud prevention | Your IP address | Hosting, delivery, analytics (aggregate reporting) | | Audio, electronic, visual, or similar information | Creator Content uploaded by Creators, and profile images Creators elect to publish. No Viewer audio, image, or likeness is collected; Vport does not access your microphone or camera | The Creator | Delivery and DRM providers; published publicly by the Creator | | Professional or employment information | Creator business name, entity type, and professional biography | The Creator | Payment processor; published publicly where the Creator elects | | Sensitive Personal Information | Account login credentials. Creator taxpayer identifiers and government identification are collected by Stripe, not by Vport (Section 4.3) | You | Not disclosed except as legally required | | Inferences | Aggregate content recommendations only; no profile of characteristics or preferences is built about you as an individual | Aggregate usage | Not disclosed | | Biometric information; Neural Data; precise geolocation; racial, ethnic, religious, philosophical, or union information; genetic data; health data; sex life or sexual orientation; contents of communications; education information | Not collected | — | — |

Purposes are set out in Section 5. Retention is set out in Section 11.

No sale or sharing. In the preceding twelve months, Vport has not sold or shared Personal Information as those terms are defined by the CCPA, and does not do so today.

Right to know. The categories and specific pieces of Personal Information we collect, the sources, the purposes, and the third parties to whom we disclose it.

Right to delete. Request deletion of Personal Information, subject to the exceptions of CPRA § 1798.105(d) and Section 13.5.

Right to correct. Request correction of inaccurate Personal Information.

Right to opt out of sale or sharing. Although we neither sell nor share Personal Information, an opt-out is available in-app under Settings → Privacy, via the "Do Not Sell or Share My Personal Information" link at thevport.com, or by emailing privacy@thevport.com with subject line "Do Not Sell or Share."

Right to limit use of Sensitive Personal Information. All uses of Sensitive Personal Information fall within the permitted purposes of CPRA § 1798.121(b); limitation requests will nonetheless be honored.

Right to non-discrimination. We will not discriminate against you for exercising your privacy rights.

Authorized agents. You may designate an authorized agent to submit requests on your behalf with written authorization.

Right to appeal. If we deny a request, you may appeal by emailing privacy@thevport.com with subject line "PRIVACY APPEAL." If the appeal is denied we will provide instructions for contacting the California Attorney General.

Notice at collection. A short-form notice at collection identifying the categories collected and linking to this Policy is presented at account creation, at Creator Studio activation, and at thevport.com/privacy.

Response timeline. Verified requests are answered within 45 calendar days, extendable by a further 45 days as permitted by law, with notice to you.

Financial incentives. Vport offers no financial incentive conditioned on Personal Information collection.

Annual metrics. If Vport meets the thresholds requiring publication of annual privacy request metrics under 11 CCR § 7102, those metrics will be published at thevport.com/privacy-metrics.

13.3 Other U.S. State Privacy Law Residents

Residents of U.S. states with comprehensive privacy laws currently in effect — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island — have the rights set out below. Residents of states whose laws take effect later, including Louisiana, Oklahoma, Alabama, and Vermont, will have these rights as of the applicable effective date; Vport extends the rights in Section 13.1 to every User immediately.

• Access: confirm whether we process your Personal Data and access it
• Delete: delete Personal Data, subject to Section 13.5
• Correct: correct inaccuracies
• Portability: obtain a copy in a portable format
• Opt out of: targeted advertising, sale of Personal Data, and profiling producing legal or similarly significant effects

Sensitive data. Vport does not collect biometric data, neural data, precise geolocation, health data, or any other category of sensitive data from Users. Account credentials are handled solely for authentication. Creator taxpayer and government identification data is collected by Stripe, not by Vport. If Vport proposes to process any category of sensitive data, it will obtain affirmative opt-in consent first where the law requires it.

Profiling and advertising. We do not engage in profiling in furtherance of decisions producing legal or similarly significant effects. We do not use your data for targeted advertising or cross-context behavioral advertising, and we display no advertising.

Data minimization. Consistent with Maryland's Online Data Privacy Act and comparable standards, Vport limits collection to what is reasonably necessary and proportionate to provide the Services requested, and limits processing of sensitive data to what is strictly necessary. Vport does not sell sensitive data under any circumstances.

Right to appeal. If we decline to act, you may appeal via privacy@thevport.com with "PRIVACY APPEAL" in the subject line. Appeal responses include information on contacting your state Attorney General.

Response timeline. Within legally required timeframes, generally 45 to 60 days as permitted by applicable law.

13.4 Nevada Residents

Under NRS 603A.300 through 603A.360, residents may submit a verified request directing an operator not to sell certain covered personal information. Although Vport does not sell your data, you may submit such a request by emailing privacy@thevport.com with subject line "Nevada Opt-Out Request." We respond within 60 days, extendable by 30 days where reasonably necessary.

13.5 Deletion — Implementation and Exceptions

Upon a verified deletion request:

• Account access is revoked promptly upon verification
• Personal Data is deleted from production databases promptly and purged from backups within 90 days
• Viewing Records, Attendance Records, live telemetry, entitlement records, DRM logs, push tokens, Credit records, Creator Profile information, and support correspondence associated with the account are deleted
• Creator Content published by the account is unpublished and removed from the Services

What we retain, and why:

• Transaction, payout, and tax records: 7 years, as required by IRS recordkeeping rules and applicable limitations periods
• Copyright records: notices, counter-notifications, and repeat infringer records, as required to administer the policy mandated by 17 U.S.C. § 512(i) and to comply with 17 U.S.C. § 512(g)
• Mandatory reports: records reported or preserved under 18 U.S.C. § 2258A, and records associated with an NCII removal request, as required by law
• Enforcement records: the minimum record necessary to enforce a suspension or termination and to prevent circumvention by re-registration
• Security and fraud records: pseudonymized records of abuse, fraud, and security incidents, retained as necessary to protect the Services and other Users. These remain Personal Data (Section 6.7)
• Suppression records: the minimum data needed to ensure we do not re-contact you
• Legal holds: records subject to an active legal hold, an open claim or investigation, or pending legal proceedings

Content already distributed. Removing Creator Content from the Services does not retrieve copies that others may have made, cached, indexed, or downloaded before removal, and does not affect any licence granted to Vport under the Creator Agreement to the extent that licence survives by its terms. Where content has been distributed to Users prior to removal, Vport cannot recall those copies.

Confirmation. You will receive email confirmation of your deletion request identifying anything retained and the basis for retaining it.

14. Creator-Specific Provisions

14.1 Creator Rights

Creators hold the rights described in Section 13.1 and, depending on residence, Sections 13.2 through 13.4, and exercise them through the same controls. Two qualifications apply.

Payout data held by Stripe. Taxpayer identification, government identification, and bank account information are held by Stripe, not by Vport. Requests to access, correct, or delete that information must be directed to Stripe and are governed by Stripe's privacy policy. Vport will identify the correct route on request.

Records Vport must retain. Earnings, payout, and tax records are retained for 7 years. Rights attestations, upload records, and copyright and enforcement records are retained as described in Sections 11 and 13.5, and are not deleted on request where retention is required to administer the repeat infringer policy, to respond to a claim, or to comply with law.

14.2 Creator Content Ownership

Creators retain ownership of their content. The licence granted to Vport, its scope, duration, and survival, and the allocation of commercial risk between the parties, are governed by the Creator Agreement and not by this Policy.

14.3 Earnings and Payout Disputes

Creators may access earnings and payout history in Creator Studio, and may submit disputes to accounting@thevport.com with "PAYOUT DISPUTE" in the subject line.

15. Cookies and Tracking Technologies

15.1 What We Use

Essential, always active: session authentication cookies on thevport.com; on-device local storage in the applications for user preferences such as volume, theme, and resume-playback position; and upload-session state in Creator Studio.

We do not use advertising cookies, conversion pixels, social plugins, or session-replay tools anywhere in the Services.

15.2 Analytics (Firebase)

• Uses the IDFV on visionOS and an app-scoped identifier on Horizon OS; never the IDFA or the Meta Advertising ID
• Configured without cross-app tracking, without Google Signals, and without advertising personalization
• Viewing history, content titles, and event identifiers are not shared with Firebase
• Opt-out is available to every User at any time, in-app under Settings → Privacy or by emailing privacy@thevport.com

15.3 Preference Signals

| Signal | Response | |----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Global Privacy Control (GPC) | Honored as a valid opt-out request on thevport.com. Native visionOS and Horizon OS applications do not receive browser-based preference signals; equivalent in-app opt-out controls are provided under Settings → Privacy | | Universal Opt-Out Mechanism | Honored on thevport.com where a recognized mechanism is received, in every state requiring recognition | | Do Not Track | Not responded to; no industry standard exists |

15.4 App Tracking Transparency and Advertising Identifiers

Vport does not request App Tracking Transparency permission on Apple platforms and does not request or use the Meta Advertising ID. We do not track Users across applications or websites owned by other companies, serve advertising, or share data with data brokers.

16. Age Restriction, Age Assurance, and Children's Privacy

Vport is intended solely for individuals 18 years of age or older, in both Viewer and Creator capacities. The 18-and-over minimum is a conservative service-eligibility and safety policy; it does not mean Vport is an adult-content service. Vport does not permit pornographic, sexually explicit, abusive, exploitative, or other content prohibited by Vport's Content Standards or applicable Platform rules.

Vport does not knowingly maintain accounts for individuals under 18 and does not knowingly retain Personal Data from individuals under 18, except for transient processing necessary to operate the age gate or where retention is required by law. Individuals under 18 may not create an account, access Creator Content through an account, or activate Creator Studio.

16.1 Declared-Age Check at Signup

Age eligibility is determined as the first standalone step of signup through a neutral date-of-birth entry. The date of birth is used solely to determine whether the prospective User is at least 18 years old.

• If the entered date of birth indicates that the person is under 18, signup is terminated before Vport collects account-registration information such as email address or username, no account is created, and the entered date of birth is discarded.
• If the entered date of birth indicates that the person is 18 or older, Vport records only an eligibility result indicating that the age requirement was satisfied, together with the date/time of the check and the declaration method. Vport does not retain the exact date of birth used for this eligibility determination.
• The eligibility result is used only for service access, safety, fraud prevention, and Platform or legal compliance where applicable. It is not used for advertising or sale of Personal Data.

The User's declared-age eligibility is associated with the account, so an eligible User is not required to repeat the age check before each item of Creator Content.

16.2 Content Standards and Platform Age Ratings

Vport maintains accurate content and age-rating information with each Platform, including responses to the Apple age-rating questionnaire and, where applicable, ratings required by other Platforms. If Vport's contractual minimum age exceeds a Platform's calculated age rating, Vport may select the higher available Platform rating consistent with the service's 18-and-over requirement.

Creator upload confirmation. For the current 18-and-over service, Creators are not required to assign a separate 13+, 16+, or 18+ classification to each upload. Instead, at each submission the Creator must confirm that the Creator Content complies with Vport's Content Standards, contains no prohibited or objectionable material, complies with applicable law, and does not infringe or misappropriate third-party intellectual-property or other rights. Creator Content is also subject to the limited pre-publication safety review described in Section 9.6.

Reporting age or safety concerns. Users may use Vport's in-product reporting control to flag Creator Content that they believe is age-inappropriate, prohibited, unsafe, or otherwise inconsistent with Vport's Content Standards. Because Vport restricts the service to users 18 and older, the account-level declared-age mechanism described in Section 16.1 is the age-restriction mechanism used for Creator Content in the current service.

16.3 Discovery of an Underage Account

If Vport later obtains reliable information that an existing account holder is under 18, Vport will promptly disable and delete the account and associated Personal Data, subject only to records that must be retained for security, enforcement, legal claims, or other legal obligations. Where the person is under 13, Vport will not use or retain Personal Data beyond what is permitted or required under the Children's Online Privacy Protection Act and other applicable law.

17. Human Review, Automated Processing, and Artificial Intelligence

17.1 Human Safety Review and Enforcement

Vport's pre-publication review of Creator Content is performed by human reviewers for the limited safety purposes described in Section 9.6. Human reviewers determine whether content may be published, rejected, or escalated under Vport's safety and objectionable-content standards. Enforcement actions involving content restriction, account suspension or termination, or payout withholding are subject to human review, except where immediate action is required by a valid legal notice or an obligation under Section 9.4 or 9.5. Affected Users may contest an enforcement action by writing to legal@thevport.com.

17.2 No Automated Copyright Recognition or Clearance

Vport does not use automated audio or video fingerprinting, content-recognition databases, or comparable automated copyright-matching systems to determine whether Creator Content infringes third-party rights or whether a Creator has obtained required licenses. Vport does not use its safety-review process as a substitute for copyright clearance. Creators are responsible for the rights representations and upload confirmations described in Sections 4.2 and 9.1, and copyright complaints are handled through Vport's notice, counter-notification, and repeat-infringer processes in Section 9.

17.3 No Decisions Based Solely on Automated Processing

Vport does not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you, and does not engage in profiling for that purpose.

17.4 Recommendations

We may use aggregated usage patterns to recommend content and upcoming Live Events. These recommendations produce no legal effects and do not involve profiling producing legal or similarly significant effects.

17.5 No AI or Model Training

Vport does not use your Personal Data, account data, viewing history, attendance records, or support communications to develop, train, or fine-tune generative artificial intelligence models or large language models, and does not sell, license, or otherwise make such data available to any third party for those purposes. Vport does not use Creator Content to train generative artificial intelligence models, and does not license Creator Content to third parties for that purpose, except as expressly permitted by the Creator Agreement.

18. Data Broker Disclosure

Vport is not a "data broker" as defined under the California Delete Act (SB 362, Cal. Civ. Code § 1798.99.80 et seq.), the Texas, Oregon, or Vermont data broker registration laws, or any other applicable data broker registration law. Vport has a direct relationship with every individual whose Personal Data it collects and does not sell personal information. Vport does not share Personal Data with data brokers.

19. Apple Vision Pro Platform Notices

19.1 visionOS Data Boundaries

| Feature | Vport receives | Vport does not receive | |-------------------------------|---------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ARKit / spatial awareness | Abstract positioning data used to place content in your space | Raw spatial mesh, planes, room layouts, environmental photographs | | Hand tracking | Tap, pinch, and select events only | Continuous hand position, hand skeleton models, hand geometry | | Eye tracking | Standard input events at the moment of a deliberate selection | Eye gaze data, gaze direction, dwell data, hover targets, eye-tracking vectors — visionOS does not expose these to any application | | Camera / passthrough | Nothing | Camera feeds, images, video, passthrough content. Main camera access is available only to enterprise applications privately distributed under a managed entitlement; Vport is a public App Store application and does not hold that entitlement | | Personas | Nothing | Persona imagery, facial capture, or facial geometry. Vport does not use Personas or SharePlay | | Optic ID | Nothing | Iris data, biometric templates, or authentication results |

19.2 Apple Privacy Manifest and App Privacy Details

Vport's Apple Vision Pro application includes a Privacy Manifest (PrivacyInfo.xcprivacy) declaring Required Reason APIs used by the application and by included SDKs, with manifests and valid signatures for third-party SDKs where required.

Tracking declaration: NSPrivacyTracking is false. We do not track Users across applications or websites for advertising and do not share data with data brokers.

Data collected and linked to identity:

• Contact info — email address: account creation, authentication, and service communications
• Identifiers — User ID and Device ID: account identifier; IDFV and installation UUID
• Purchases: entitlement and transaction status
• Usage data — product interaction: feature interactions, session duration, playback telemetry, Creator Studio activity
• Diagnostics: crash data and performance data
• Location — coarse location: country and region inferred from IP address, for content licensing, eligibility, fraud prevention, and aggregate analytics
• User content: customer support correspondence, and, for Creators, content and other user content uploaded through Creator Studio

Data not collected by the Vport application:

• Financial info: Viewer payments are processed by Apple through In-App Purchase; Vport receives transaction receipts only. Creator payout data is collected by Stripe
• Precise location: not collected
• Sensitive info: not collected
• Surroundings — environment scanning: not collected
• Body — hands and head: not collected
• Contacts, health and fitness, and browsing history: not collected
• Search history: search queries are not stored; only that the search feature was used is logged as product interaction

These declarations correspond to our App Store Privacy Nutrition Label.

19.3 Other Apple Platforms

Vport does not currently offer applications for iPhone, iPad, Mac, or Apple TV.

20. Meta Quest and Meta Horizon Store Platform Notices

20.1 Horizon OS Data Boundaries

Vport requests no sensor, camera, microphone, or spatial permission on Meta devices. Accordingly:

| Feature | Vport receives | Vport does not receive | |-----------------------------------|-----------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------| | Hand tracking | Tap, pinch, and select events only. The hand tracking permission is not requested | Hand pose, hand skeleton, bone rotations, hand mesh, hand size | | Eye tracking | Nothing. The eye tracking permission is not requested on any Meta device | Abstracted gaze data, gaze direction, raw eye images | | Face tracking | Nothing. Face tracking and microphone permissions are not requested | Facial expression blendshapes, audio-derived expression estimates, raw camera images | | Body tracking | Nothing. Body tracking is not integrated | Skeletal joint data, body pose | | Scene, spatial anchors, depth | Nothing. The scene permission is not requested | Scene mesh, room layout, planes, depth maps, spatial anchors | | Passthrough camera | Nothing. Camera and headset camera permissions are not requested | Passthrough camera frames, images, or video of your surroundings | | Meta account and social graph | An app-scoped user identifier and an entitlement check result only | Meta Horizon username, real name, profile picture, friends list, followers, presence, destinations, parties, rooms, organization-scoped identifier | | Avatars | Nothing. Meta Avatars are not used | Avatar imagery, avatar configuration, or avatar-derived data | | Payments | Transaction and entitlement status only | Payment card numbers, billing addresses, payment credentials |

20.2 Meta Platform Data Commitments

In this Section, "Meta Horizon User Data" means data about or associated with a person, device, or unique identifier obtained from Meta or the Meta Platform SDK, and "Device User Data" means data from headset sensors, including headset position and data calculated about a user's hands, body, abstracted facial expressions, and abstracted gaze. As set out in Section 20.1, Vport does not receive Device User Data and receives only an app-scoped identifier and entitlement status as Meta Horizon User Data.

In connection with distribution on the Meta Horizon Store, Vport commits that it:

• Processes Meta Horizon User Data and Device User Data only as described in this Policy and only for purposes permitted by the Meta Developer Data Use Policy — operating, supporting, and maintaining the Services; generating aggregated and de-identified analytics; and complying with law
• Does not sell, license, rent, lend, or purchase Meta platform data
• Does not use platform data to ascertain the identity of a natural person, build advertising profiles, conduct surveillance, re-identify or de-anonymize individuals, or profile or discriminate on the basis of any protected characteristic
• Does not use any advertising identifier for any purpose
• Deletes platform data when no longer needed for a legitimate business purpose, when you request deletion, when your account is deleted, or when Meta or applicable law so requires
• Maintains administrative, physical, and technical safeguards appropriate to the sensitivity of the data and reports security incidents to Meta as required
• Completes and annually recertifies Meta's Data Use Checkup and, where applicable, Meta's Data Protection Assessment, and answers Meta's data handling questions consistently with this Policy

Meta as independent controller. Meta collects and processes data about you directly as operator of the Meta Horizon platform, the Meta Horizon Store, and Meta's payment system. That processing is governed by Meta's own privacy policies and notices, including its supplemental privacy policy for Meta Platforms Technologies products, and not by this Policy.

20.3 Deletion of Data Collected Through Meta Quest

All Users of the Vport application on Meta Quest — in every country and region, free of charge — may request deletion of all data Vport has collected or stored about them using the in-application control at Settings → Account → Delete Account, at thevport.com under Account → Privacy, or by emailing privacy@thevport.com. Verified requests are acted upon without undue delay and completion is confirmed by email. Where any portion of a request cannot be fulfilled, we identify the retained data and the specific legal basis for retention. See Section 13.5.

20.4 Shared Headsets

Where Meta's App Sharing feature permits more than one Meta account to use Vport on a single headset, each account is treated as a distinct User. Data is kept separate per account, and a deletion request by one account holder does not affect another's data.

21. Accessibility

Available formats: web at thevport.com/privacy; in-application under Settings → Privacy Policy in the Apple Vision Pro and Meta Quest applications.

Accessibility features: we endeavor to make this Privacy Policy accessible and compatible with common assistive technologies, including screen readers, and support high contrast mode where available.

Language: English. Assistance is available at privacy@thevport.com.

22. Contact

Vport, LLC
2510 6th Avenue, Unit 3006
Seattle, WA 98121, USA

• Privacy Officer and data protection inquiries: privacy@thevport.com
• Copyright notices and counter-notifications: dmca@thevport.com
• Content reports, including non-consensual intimate imagery: report@thevport.com
• Legal: legal@thevport.com
• Creator earnings and payouts: accounting@thevport.com

Vport has designated a Privacy Officer accountable for compliance with this Policy and with applicable data protection law. All privacy and data protection inquiries should be directed to privacy@thevport.com.

23. Changes to This Policy

We may update this Privacy Policy from time to time. Where we make material changes we will notify you by email or through the Services at least thirty (30) days prior to the change taking effect, except where a shorter period is required to comply with law, a court or regulatory order, or a Platform requirement, in which case we will give as much notice as is practicable. Prior versions of this Policy in effect while we used third-party platform features are retained and are available on request from privacy@thevport.com.

Continued use of the Services after the effective date of a change constitutes acknowledgment of the updated Policy. Where applicable law requires consent to a change, we will obtain that consent separately and affirmatively, and continued use alone will not be treated as consent.

24. Governing Law and Interpretation

Governing law. The laws of the State of Washington, without regard to conflict of laws principles.

Mandatory local rights preserved. Nothing in this Policy limits or waives any right or remedy available to you under the mandatory law of your state of residence. Where this Policy conflicts with a mandatory requirement of applicable data protection law, that requirement prevails.

Severability. If any provision of this Policy is held invalid or unenforceable, that provision will be modified to the minimum extent necessary or severed, and the remaining provisions will continue in full force and effect.

Dispute resolution. Subject to the dispute resolution provisions of Vport's Terms of Service, which do not limit your right to file a complaint with a state Attorney General or other regulator.

— END OF PRIVACY POLICY —

Vport, LLC
2510 6th Avenue, Unit 3006, Seattle, WA 98121, USA
privacy@thevport.com