Events in Minutes Privacy Policy

Events in Minutes, Inc. ("Events in Minutes," "EIM," "we," "us," or "our") is a Delaware corporation headquartered at 999 Baker Way, San Mateo, CA 94404, USA. We operate an online marketplace that connects people planning corporate and personal events with vetted event professionals. Event Hosts browse priced packages, add services from one or more Vendors to a single cart, and check out; each Vendor then confirms its own Booking. We do this through our website at www.eventsinminutes.com, our free AI event planner Event Copilot, Emma (our AI voice assistant on our phone line), Platform messaging, SMS alerts, and related services (collectively, the "Platform," with the same meaning as in our Terms). This Policy also covers our email and customer support channels.

This Privacy Policy describes how Events in Minutes, Inc. and its corporate affiliates collect, use, disclose, retain, and protect personal information relating to:

• Event Hosts — people who plan events and book Vendor Services through the Platform, whether for a company (corporate events) or for themselves (personal events such as weddings and celebrations);
• Vendors — event professionals (venues, caterers, bar services, DJs, entertainers, photographers, rental companies, and other service providers) who list and provide Vendor Services through the Platform, and the owners, managers, and staff who use a Vendor account;
• Guests — event attendees and other individuals whose personal information we receive in connection with a Booking (for example, on guest lists or in event details) — if this is you, Section 9 is written specifically for you and applies even though you do not have an account with us;
• Event Copilot users — anyone who uses Event Copilot, including people who use it without creating an account (Section 3.3);
• Event businesses we list or contact — businesses (and their owners and contact people) for which we prepare unpublished draft listings and invite to claim them, and businesses that submit their details to us (Section 3.7);
• Business prospects and newsletter subscribers — professional contacts (for example, corporate event planners and executive assistants) we contact about the Platform, and subscribers to our newsletter (Sections 3.7 and 14.4);
• Callers — anyone who calls our phone line (Section 14.5); and
• Website visitors — anyone who browses or interacts with the Platform, including visitors who do not have an account.

It applies to personal information collected through the Platform, our marketing communications (including our newsletter), customer support interactions, and any other interaction with Events in Minutes. Business contact information is covered too: if you deal with us on behalf of a company (as a corporate Event Host, a Vendor's staff member, or a business prospect), this Privacy Policy and the rights in Sections 8–12 apply to you.

Where we operate. The Platform serves events in the United States, and Vendors provide services for events in the United States. Sections 15–17 explain the rights of visitors from the EEA, the United Kingdom, Switzerland, Canada, and Australia whose information we process.

What this Policy does not cover. This Privacy Policy does not apply to third-party websites, applications, or services that we do not own or control, even if you reach them through the Platform. It also does not apply to Vendors' own off-platform data practices: when a Vendor collects personal information from you directly (for example, on the Vendor's own website or at your event), the Vendor's own privacy policy governs that collection. Please review the privacy policies of any third party before providing personal information to them.

In this Privacy Policy, "personal information" means any information that relates to an identified or identifiable individual — for example, your name, email address, phone number, device identifiers, or event details that can be linked to you. It does not include information that has been aggregated or de-identified so that it can no longer reasonably be linked to you (handled as described in Section 5.11).

• Events in Minutes is the "business" (under the California Consumer Privacy Act) and the "controller" (under the GDPR, UK GDPR, and similar laws) for personal information we collect and process to operate the Platform, manage accounts, facilitate Bookings, provide Event Copilot, prepare and offer business listings, conduct our own analytics and marketing, and provide support. This includes the personal information of Guests that we hold: because we determine the Booking-form fields, the retention periods, the recipients, and whether and how Event Copilot processes Guest information, we act as a business/controller for Guest data — we do not claim to be a mere processor or service provider for it. See Section 9.
• Event Hosts act as a joint or independent controller (or "business," where applicable) for the Guest personal information they originate — for example, when a Host compiles a guest list or enters a Guest's dietary needs.
• Stripe, our payment processor, processes payment card data for Event Hosts and — through Stripe Connect — collects and holds the identity, tax, and bank-account information Vendors provide to receive payouts. Stripe acts as our PCI-DSS-compliant payment processor for processing our transactions. Stripe also acts as an independent controller of transaction data for the activities Stripe itself enumerates in its own privacy policy: fraud monitoring and prevention; legal, anti-money-laundering (AML), and know-your-customer (KYC) compliance; determining and utilizing third parties, such as banking partners and payment-method providers; and analyzing, developing, and improving Stripe's own products and services — which means Stripe uses transaction data generated on our Platform to train and improve its own models (such as Stripe Radar fraud models). In addition, Stripe's JavaScript on our website collects online-activity data (information about devices and browsers across business sites that use Stripe), and Stripe's own privacy policy states that its disclosures of this data may be considered a "sale" or "sharing" under U.S. state privacy laws. We cannot opt you out of Stripe's independent-controller activities; they are governed by Stripe's privacy policy and the privacy choices Stripe offers (see Sections 4.3, 10.2, and 20).
• Vendors act as independent controllers/businesses for the personal information they collect or receive in order to perform Vendor Services — including Guest personal information they receive through the Platform. Their handling of that information is subject to the obligations in Section 21 and to their own privacy policies.

(a) Account and Contact Information

• Name, email address, phone number, and, where relevant, company name and job title.
• Password (stored in hashed form).
• For Vendors: business name, business type, business address, service area, business phone and email, and the names and contact details of the people who manage the Vendor account. Vendors also give us a personal mobile phone number at registration as an account contact. If a Vendor ticks the separate, optional "Text me when a customer messages or books" box, we send booking alerts by text to that number (Section 14.1).

(b) Business Verification Information (Vendors)

• Business details we review when vetting Vendors and reviewing Listings: business registration, licenses, permits, certifications, and insurance documents a Vendor provides (including certificates of insurance). We may request and display insurance documents, but we do not verify the adequacy or currency of a Vendor's coverage.
• When someone claims a business listing (Section 3.7), the details used to confirm they are authorized to manage it — such as the claim link we send to the business email we hold, or a one-time code we text to the business phone we hold — and, if we ask for it to resolve an ownership or fraud concern, a document showing the person's authority to act for the business.

We do not collect biometric identifiers or biometric information (such as facial geometry scans, fingerprints, or voiceprints), and we do not run background checks on Members.

(c) Payment and Payout Information

• Event Hosts: payment card details (card number, expiration date, security code, billing address) are entered into and processed by Stripe, our PCI-DSS-compliant payment processor. Events in Minutes does not receive or store full payment card numbers or security codes. We receive limited information from Stripe, such as the card brand, the last four digits, and payment status.
• Vendors: payouts run through Stripe Connect. Vendors give their identity, tax (such as SSN or EIN), and bank-account details directly to Stripe during Stripe Connect onboarding; Stripe holds that information, and our staff do not enter or keep Vendor bank-account details. We receive from Stripe what we need to run payouts and meet tax-reporting duties — for example, payout status, account verification status, and tax-form information Stripe makes available to us.
• Transaction history, invoices, receipts, payout records, refund records, and chargeback or dispute records.

(d) Booking and Event Information

• Event details provided by Event Hosts: event type, date, time, location, guest count, budget, special requests, guest lists, add-ons, and other event specifications, including what you put in your cart and the Listings you request or book.
• Please note: some event details — such as dietary restrictions, food allergies, accessibility or disability accommodations, and religious meal requirements (e.g., kosher or halal catering) — may reveal information about health, disability, or religious beliefs. We treat this "health-adjacent" information with heightened care: see Sections 10.1 and 10.4 (sensitive personal information and the sensitive inferences it can support), Section 11 (consumer health data notice), and Section 15.2 (GDPR special category data). If you are a Guest whose details were provided by an Event Host, see Section 9. Providing these details is never required to use the Platform.
• Booking history, requests, acceptances and declines, confirmations, modifications, cancellations, and refunds.

• Profile and content: profile photo, biography, service descriptions, package details, pricing, availability, portfolio images and videos (Vendors), and other content you upload.
• Reviews and ratings: reviews, ratings, feedback, and dispute information.
• Communications: messages sent between Members through the Platform's messaging system, and messages, emails, phone calls, and chat transcripts with our support team. The Platform blocks email addresses and links in messages, and messages may be screened by automated tools, to keep bookings and payments on the Platform and to prevent fraud and spam (see Section 4.6). Because we are not the intended recipient of Member-to-Member messages, their contents are treated as sensitive personal information under the CCPA (see Section 10.1).
• Phone calls: if you call us at +1 (415) 634-4617, the call may be answered by Emma, our automated AI voice assistant, and the call is recorded and transcribed as described in Section 14.5.
• Details for particular kinds of services. Depending on what you book, you may give us, for the booked Vendor: pickup and drop-off addresses and passenger names (transportation); guest lists, entry lists, or wristband counts for door screening (security — the Platform does not collect ID images or ID numbers; if a security Vendor checks ID at the door, it does so itself; any incident report a security Vendor prepares about the Event is shared between that Vendor and the Event Host, and if it is sent to us or uploaded to the Platform, we keep it with the Booking record and use it only for support, disputes, and safety); skin-sensitivity, product-allergy, or similar notes (beauty services — treated as health-adjacent data under Sections 10.4 and 11); names and ceremony details for an officiant (please do not send us marriage-license numbers or government ID numbers; couples give license details directly to the officiant); first names and ages of children attending a children's party or activity (Section 19); and shipping addresses for attendees who will receive kits for a virtual experience (used only to deliver the kits). We use these details only to arrange and fulfill that Booking and support it, and we share them only with the Vendor(s) performing it (Section 5.1).
• Surveys and promotions: survey responses, feedback, feature requests, and information you give us when you use a promo code.
• Information about other people: if you provide personal information about other individuals — for example, co-planners, guests of honor, or attendee/guest lists — you represent and warrant that you have their permission to share that information with us and with the Vendors you book, and that we may process it as described in this Privacy Policy. This representation allocates responsibility between you and Events in Minutes; it does not limit the rights of the individuals whose information you provide (see Section 9, in particular Section 9.7).

Event Copilot is our free AI event planner — an artificial-intelligence feature, and we label it as one wherever it appears. You describe your event in plain language, and it recommends real, bookable packages from Vendors on the Platform and drafts an event plan. You do not need an account to start. When you use Event Copilot, we collect and process:

• what you type to it: your event description, date, location, guest count, budget, preferences, questions, and instructions;
• what it produces for you: recommended packages, pricing estimates, and event plans;
• your email address, which Event Copilot asks for so it can send your results to you — at that point we show a notice linking to this Privacy Policy and the Terms; and
• interaction information, such as session length, the recommendations you open or add to your cart, and the device and usage data described in Section 3.4.

How we use your Event Copilot email address. We use it only to send you the plan you asked for (and any update to that plan you request). Any other follow-up is marketing. We send marketing email to an Event Copilot email address only if you tick the separate, unticked marketing opt-in box next to the email field, and you can unsubscribe at any time (Section 8.2).

If you later create an account with the same email address, we may link your Event Copilot history to your account so that you can pick up where you left off. Event Copilot conversations are processed by third-party AI model providers acting as our service providers (Section 5.4). How we use Event Copilot data for AI improvement, and your opt-out, are described in Section 4.3. Guest personal information appearing in Event Copilot conversations is subject to the Guest ring-fence in Section 9.4.

We collect some information automatically whenever you use the Platform — including from visitors who do not have an account:

(a) Device and Usage Information

• IP address, device type, operating system, browser type and version, language, time zone, and identifiers set by cookies and similar technologies.
• Pages visited, features used, actions taken (clicks, taps, scrolls, mouse movements), search queries and filters, Listings viewed, items added to your cart, links clicked, referring and exit URLs, and date/time stamps.
• Engagement time: how long visitors actively use the Platform (for example, cumulative active time across pages during a visit).
• Session replay: for U.S. visitors (and visitors in other places where we do not show a cookie banner) from the first page view (unless you turn it off in "Your Privacy Choices"), and for visitors in the EEA, the United Kingdom, Switzerland, and Canada only after they click "Accept" in our cookie banner (Section 13.2), we use PostHog session replay to record how you interact with our pages (pages viewed, clicks, scrolling, mouse movement, and what appears on screen) so that we can find and fix usability problems. Text you type into form fields is masked, and payment card details are entered in Stripe's secure payment form and are never recorded. Session replay does not record Event Copilot conversations, Platform messages, guest lists or other Guest details (in dashboards, booking views, or checkout), or dietary, allergy, accessibility, or similar details. See Section 13.5.
• Error, performance, and diagnostic information.

(b) Marketing Attribution

• When you arrive from a link, we store the marketing source that brought you to our site — such as campaign tags in the link you clicked (UTM parameters) and the referring page — in your browser's local storage, and we associate it with your account and Bookings, so that we can understand which content and campaigns are useful.

(c) Location Information

• Approximate location derived from your IP address (country, state/region, city, postal code), and your browser's time zone (stored in a first-party cookie so that dates and times display correctly).
• We do not collect precise geolocation from your device. If a future feature asks for it, your browser will ask your permission first and we will update this Privacy Policy before collecting it.

(d) Cookies, Pixels, and Similar Technologies

• First-party and third-party cookies, pixels, tags, and local storage, including the Google, Meta, LinkedIn, and PostHog technologies named in Section 13. See Section 13 for details and our Cookie Notice for the list of individual cookies.

• Stripe: payment status, card brand and last four digits, refund and chargeback notifications, fraud and risk signals, and, for Vendors, Stripe Connect account and payout status and tax-form information.
• Sign-in providers: if you sign up or log in with Google or LinkedIn, we receive the basic profile information that provider shares with your permission (typically your name, email address, and profile photo) and use it to create and secure your account.
• Advertising and analytics partners: campaign performance, conversion measurement, and audience information from Google, Meta, and LinkedIn.
• Other users: information other people provide about you — for example, when an Event Host adds you to a guest list (see Section 9 if this is you), a Vendor account owner adds you as a team member, or a Member or third party submits a complaint or report involving you.
• Publicly available sources: business websites, public business profiles and directories, public review and rating sites, public social media profiles, and business registries. We use these to vet Vendors, to show public third-party ratings on Vendor profiles where available, and to prepare unpublished draft listings for event businesses (Section 3.7).
• B2B data providers: professional contact information (name, job title, company, business email, and business phone) about people who plan corporate events, obtained from a business-contact data provider (currently Apollo.io), which we use for business-to-business outreach about the Platform (Section 3.7). We maintain a suppression list and use it to avoid emailing people who have opted out (Section 3.7).

We collect only what we reasonably need for the purposes described in Section 4. For high-risk fields: we never receive or store full payment card numbers or card security codes (Stripe handles them); passwords are stored only in hashed form; and Vendors give their SSN or EIN and bank-account details to Stripe, not to us.

Draft listings we prepare for event businesses ("Claim Your Business"). To help event businesses join the Platform, we may prepare an unpublished draft profile and draft packages for a business before the business has an account. To do this we collect business information from the business's own website, its public business profiles, and its public social media accounts: the business name, address, service area, phone number, email address, website, description, services, prices, and photos, and the names of owners or managers where the business publishes them. We may use automated and AI tools, including the AI model providers described in Section 5.4, to help draft listing text and select photos from this public information. We then email the business a link to claim the draft, and the business reviews and approves every draft before anything is published.

• Nothing is public or bookable until the business claims and publishes it. Draft profiles and packages are not shown to Event Hosts, not included in search results, and not indexed by search engines. When a business claims its draft, it confirms or corrects the details and confirms or removes each photo before anything is published.
• Unclaimed drafts are deleted. If a business does not claim its draft, we delete the draft and its photos no later than 90 days after our first invitation email. We keep only the minimum needed to honor opt-outs (below).
• Removal on request. A business can ask us at any time to delete its draft or stop contacting it — by using the link in our email or by emailing support@eventsinminutes.com with the subject line "Remove My Business." We do it without asking the business to sign up.
• How we contact businesses. We contact businesses about claiming a draft by email only, following the U.S. CAN-SPAM Act (Section 14.4). Every email identifies Events in Minutes, includes our postal address, and has an unsubscribe link. We keep unsubscribed and removed businesses on a permanent suppression list, which we use to avoid contacting them again. We do not send cold text messages or make cold calls to businesses. We send a text message to a business phone number only when a person claiming the business asks for a one-time verification code (Section 14.1).
• We do not sell or share business data. We do not sell, rent, or exchange the business information we collect for draft listings with any third party or data cooperative.

Businesses that submit their details to us. If you fill in our "Tell us about your business" form, register as a Vendor, or contact us about listing, we collect the details you provide (your name, business name, contact details, category, location, and anything else you tell us) and use them to review your business, set up your account, and contact you about listing.

Business prospects. We contact professionals who plan corporate events — for example, office managers, executive assistants, and event planners — about the Platform. We obtain their professional contact information (name, job title, company, business email, and business phone) from a B2B data provider (currently Apollo.io), from their public professional profiles, or directly from them. We use it only for business-to-business outreach about the Platform, by email, following CAN-SPAM (and, for Canadian recipients, CASL — Section 16.3). Each email has an unsubscribe link, and unsubscribed contacts go on our permanent suppression list. If you ask us to delete your prospect information, we delete it and keep only a minimal record of your email address (hashed where feasible), which we use to avoid contacting you again. Business contacts have the same privacy rights as anyone else under this Privacy Policy (Sections 8–12).

Newsletter subscribers. If you subscribe to our newsletter, The Empowered EA, we collect your email address (and any name you give) and send the newsletter through Beehiiv. You can unsubscribe through the link in every issue.

• Create, maintain, authenticate, and secure your account.
• Show Listings, prices, availability, and search results; run the cart and checkout; send booking requests to each Vendor; and record each Vendor's acceptance, decline, or confirmation.
• Facilitate Bookings, Member-to-Member messages, and transactions between Event Hosts and Vendors.
• Process payments, refunds, chargebacks, and Vendor payouts through Stripe and Stripe Connect.
• Provide Event Copilot's planning assistance, package recommendations, and plans, and email your results to you.
• Display Vendor profiles, Listings, reviews, and ratings (including public third-party ratings where available) to Event Hosts and the public.
• Review Vendor applications and Listings, and prepare and offer unpublished draft listings to event businesses (Section 3.7).
• Provide customer support and respond to inquiries, including by phone (Section 14.5).

• Vet Vendors, review business credentials, licenses, and permits, and request (and where applicable display) insurance documents Vendors provide.
• Confirm that a person claiming a business listing is authorized to manage it, and resolve ownership disputes.
• Detect, prevent, and investigate fraud, unauthorized access, payment abuse, and other illegal or harmful activity.
• Track Vendor reliability, including Vendor cancellations of confirmed Bookings (see Section 4.4).
• Enforce our Terms and Community Standards.
• Monitor for, and respond to, security incidents and vulnerabilities.

We are transparent about how data is used to run and improve our AI features, including Event Copilot:

• How Event Copilot works. To answer you, Event Copilot sends your inputs, together with information about Listings on the Platform, to third-party AI model providers acting as our service providers (Section 5.4). These providers process data on our behalf under contract, and we do not authorize them to use our inputs or outputs to train their general models; where a provider offers settings for this, we choose the settings that do not permit such training.
• What we use to improve our features. We may review Event Copilot conversations and results to fix errors, improve recommendations, and evaluate quality — but we do not use health-adjacent details (such as dietary restrictions, allergies, accessibility needs, and beauty skin-sensitivity notes) for that improvement work — before any such review we remove or redact those details and Guest names and contact details, or exclude the conversation — and we may use aggregated and de-identified Platform data, including de-identified Event Copilot data, to develop, train, evaluate, and improve our own recommendation and matching features. De-identification meets the standard in Section 5.11.
• Large language models. We do not use personal information to train large language models — our own or anyone else's. Event Copilot runs on third-party models that we use as a service; we do not build or train them.
• What we do not do. We do not use your identifiable Event Copilot conversations or other identifiable personal information to train general-purpose AI models — ours or any third party's. We do not license Vendor photos or Member content to third parties for AI training.
• Guest information is excluded. Guest personal information (Section 9) — including Guest details that appear within an Event Host's Event Copilot conversations — is never used to train or improve Event Copilot or any other AI model unless it has first been de-identified in accordance with Section 5.11. See the Guest ring-fence in Section 9.4.
• Safeguards: de-identification and aggregation before training use; access restricted to personnel who need it; the security measures described in Section 7; and contractual limits on our AI model providers.
• Your opt-out: you may opt out of the use of your data (including de-identified Event Copilot data derived from you) for AI improvement and training at any time by emailing support@eventsinminutes.com with the subject line "AI Training Opt-Out." You do not need an account; we verify the request as described in Section 10.6 (or, for Guests, Section 9.3). We apply your opt-out going forward and confirm to you when it has been applied. The opt-out does not stop Event Copilot from answering you.
• A note on Stripe. Separately from our practices, Stripe — as an independent controller (Section 1.4) — analyzes and develops its own products and services using transaction data processed through our Platform, including training its fraud and risk models (such as Stripe Radar). That is Stripe's own processing: our AI-training opt-out does not reach it, and it is governed by Stripe's privacy policy and the choices Stripe offers.

We use automated systems for:

• Search ranking and recommendations. The order of search results and Event Copilot's recommendations are generated automatically, based on factors such as relevance to your search, location, date, guest count, price, availability, ratings, response time, booking-completion and cancellation history (declined Booking Requests are not counted), and reliability.
• Vendor reliability. When a Vendor cancels a confirmed Booking, our systems record it, apply the vendor cancellation fee set out in the Terms, and may display an "Unreliable" flag on the Vendor's profile and lower the Vendor's ranking, as the Terms describe.
• Fraud and risk screening. Automated checks on sign-ups, claims, payments, payouts, and messages can flag activity for review, hold a payout, or block a message.

Automatic vendor cancellation consequences, and our position on significant decisions. When a Vendor cancels a confirmed Booking, the vendor cancellation fee and the "Unreliable" flag are applied automatically under a fixed formula and fixed criteria set out in the Terms; any Vendor can ask for human review of them through the channel below, and a person on our team decides that review. Other than that, we do not use solely automated processing to make decisions that produce legal or similarly significant effects about you (such as refusing you access to the Platform): suspensions, account closures, and removals of a Listing are decided or confirmed by a person on our team. Automated flags may temporarily hold a payout or Booking while a person reviews it.

Your right to human review. If an automated system affects your account, a payout, a Booking, your ranking, or a reliability flag, you may ask for human review, contest the result, and give us information supporting your position by emailing support@eventsinminutes.com with the subject line "Automated Decision Review" or by calling +1 (415) 634-4617. A member of our team will review the decision, consider your information, and tell you the outcome and the main reasons for it. Residents of certain states and countries have additional rights to opt out of, or appeal, profiling: see Sections 10, 12, 15, and 16. California's automated decisionmaking technology regulations are in effect; where they apply to a significant decision we make using such technology, we will provide the pre-use notice and the opt-out or appeal rights they require no later than January 1, 2027, the compliance date for those requirements.

• Personalize your experience, including inferring preferences from your usage and Event Copilot interactions and recommending Vendors, packages, and content. (We never use Guest personal information or sensitive personal information for personalization, marketing, or advertising — Sections 9.4 and 10.4.)
• Send promotional emails and our newsletter (delivered via Beehiiv) where permitted by law (Section 14.4). You can opt out at any time (Section 8.2). We do not send marketing text messages.
• Run promotions and promo codes.
• Contact businesses about listing on the Platform and contact business prospects about booking through the Platform (Section 3.7).
• Measure our marketing (including the attribution information in Section 3.4(b)) and deliver and measure interest-based advertising through Google (Google Ads), Meta, and LinkedIn — see Section 10.2 for what this means under U.S. privacy laws and how to opt out.

• The Platform blocks email addresses and links in messages, to keep bookings and payments on the Platform, as the Terms require.
• Use automated tools to screen Platform messages for fraud, spam, scams, off-platform steering, and threats to safety.
• Have a person review messages where needed to investigate a report, resolve a dispute, provide support you request, enforce our Terms, or comply with law. We keep messages as stated in Section 6.
• Review support communications, including call recordings and transcripts (Section 14.5), for quality assurance and to improve our support.

For users in the EEA, UK, and Switzerland, this scanning is based on our legitimate interests in fraud prevention and platform safety, subject to a balancing of interests and your right to object (see Section 15.1) — we do not treat your use of the messaging features as consent to monitoring.

We will never sell the contents of your Member-to-Member communications. Because we are not the intended recipient of Member-to-Member messages, we treat their contents as sensitive personal information (Section 10.1) and use them only for the purposes described in this Section 4.6 and to deliver the messages themselves. Session replay does not record Platform messages (Section 13.5).

• Process payments, refunds, and Vendor payouts; screen transactions for fraud, anti-money-laundering (AML), and sanctions compliance (with Stripe).
• Meet tax reporting obligations, including the issuance of IRS Form 1099-K (by Stripe or us, as applicable) to Vendors where required.
• Manage refunds, chargebacks, vendor cancellation fees, and amounts owed under the Terms.

• Comply with applicable laws, regulations, legal process, and governmental requests.
• Respond to subpoenas, court orders, and law enforcement requests (see Section 5.8).
• Establish, exercise, or defend legal claims.
• Maintain records as required by applicable law.

Because each Vendor in your cart confirms its own Booking, we share information Vendor by Vendor:

• Request to Book Listings. When you check out, each Vendor whose Listing is in your cart receives your Booking Request with your name and the event details needed to decide whether to accept, such as event type, date, time, location, guest count, the package and add-ons requested, and the general nature of any special requirements. Vendors that have not accepted a Booking Request receive no health-adjacent details (such as dietary, allergy, accessibility or beauty-allergy notes) and no guest lists. You are charged for that Vendor only if the Vendor accepts. When the Vendor accepts, it receives the further details it needs to perform the Booking, including any health-adjacent details and guest-list entries for that Booking.
• Instant Book Listings. The Booking is confirmed at checkout, and the Vendor receives the information above at that time.
• What the Vendor receives can include guest-list information where you provide it, and dietary restrictions, allergy information, accessibility needs, and similar health-adjacent details where you provide them, so the Vendor can fulfill them, as well as the service-specific details described in Section 3.2 (for example, pickup addresses for a transportation Vendor or kit shipping addresses for a virtual-experience Vendor).
• Photos and videos of your Event. Photographers, videographers, and other Vendors who capture your Event create their deliverables themselves; the people who appear in them are captured by the Vendor, not by us, and the Vendor is an independent controller of its deliverables (Section 21). If a Vendor or you upload Event photos to the Platform (for example, in a review or portfolio), they are handled as Listing or review content (Section 5.2).
• The Event Host receives: the Vendor's business name, service descriptions, relevant service-area information, and the Vendor contact details the Platform makes available for the Booking.
• Messages. Event Hosts can message every Vendor they book (or are considering) through the Platform; Vendors and Event Hosts see the messages they exchange.

Vendors' use of this information is limited by Section 21.

Vendor profiles, listings, portfolios, reviews, and ratings are publicly visible on the Platform. Publicly visible content may be indexed, cached, and republished by search engines and other third parties we do not control. Even after you or we remove content from the Platform, copies may remain visible in search-engine caches, archives, or third-party sites, and we cannot guarantee its removal from those external sources.

Vendors that receive personal information about Event Hosts or Guests through the Platform may use it only to perform the booked Vendor Services and related communications, and are bound by the obligations described in Section 21, which we may audit and enforce through suspension or removal from the Platform.

We disclose personal information to service providers that process it on our behalf under contracts requiring confidentiality and data protection, including:

• Payments and payouts: Stripe (including Stripe Connect for Vendor payouts). Correcting payout account information: Stripe holds the payout and verification information Vendors give it; Vendors can update it through Stripe's onboarding and account tools, or ask us to action a correction with Stripe by emailing support@eventsinminutes.com (subject line "Payout Account Correction").
• Hosting, content delivery, and security: cloud hosting and database providers, and Cloudflare (image storage and delivery, content delivery, and security).
• Product analytics and session replay: PostHog. (Google Analytics 4 is covered with our advertising partners in Section 5.6, because Google may combine that data with its advertising services.)
• AI model providers: third-party AI model providers that process Event Copilot inputs to generate responses, which process data on our behalf under contract and which we do not authorize to use our inputs or outputs to train their general models (Section 4.3).
• Email and newsletter delivery: transactional email providers; Beehiiv (our newsletter); and our business-outreach email tools, including Apollo.io (Section 3.7).
• SMS delivery: text-message delivery providers for booking alerts and verification codes (Section 14.1).
• Phone and voice: telephone, AI voice-assistant, and workflow-automation providers that answer and route calls and prepare call summaries (Section 14.5).
• Business tools: customer support, ticketing, productivity, and workflow-automation tools used by our team.

Advertising platforms (Google Ads, Meta, and LinkedIn) are covered separately in Section 5.6, because under some state laws they are not treated as service providers.

We may share personal information with our corporate affiliates (entities under common ownership or control with Events in Minutes, Inc.), who must handle it consistently with this Privacy Policy, and with our professional advisors — attorneys, accountants, auditors, and insurers — as necessary to obtain professional services or protect our legal interests.

Our website uses advertising and measurement pixels and tags from Google (Google Ads / DoubleClick, and Google Analytics 4, whose data Google may combine with its advertising services), Meta (the Meta Pixel), and LinkedIn (the LinkedIn Insight Tag), loaded through Google Tag Manager (Section 13). They send identifiers (such as cookie IDs, IP address, and, where you are signed in to those services, your account with them) and information about your activity on our site (such as pages viewed and conversion events like starting checkout) to those companies, which use it to measure our ads, build audiences, and show ads to you on other sites and apps. Under the CCPA and similar state laws, these disclosures are "sharing" for cross-context behavioral advertising and may be a "sale." You can opt out — see Sections 8.5 and 10.2. Guest personal information and health-adjacent details are never included in these disclosures (Sections 9.4 and 10.4).

Where an Event takes place at a venue located within a building, complex, or community that is owned or managed by someone other than the booked Vendor, we (or the Vendor) may provide booking information — contact details, event date/time and logistics, certificates of insurance, and access or guest lists — to the owner, management company, staff, reception, or caretaker of that building, complex, or community, as reasonably necessary for venue access, security, deliveries, and event logistics. These recipients may use the information only for those purposes.

We may disclose personal information if we believe in good faith that disclosure is reasonably necessary to: (a) comply with applicable law, regulation, legal process, or governmental request; (b) respond to a lawful subpoena, court order, or law enforcement request; (c) respond to tax authorities in connection with our reporting obligations; (d) protect the rights, property, or safety of Events in Minutes, our Members, Guests, or the public; (e) detect, prevent, or address fraud, security, or technical issues; (f) enforce our Terms of Service; or (g) protect against imminent harm to any person.

Notice to you. Unless we are legally prohibited from doing so (for example, by a nondisclosure order), or notice would be futile, ineffective, or would create a risk of harm to any person, we will make reasonable efforts to notify you of legal requests for your personal information so that you have an opportunity to object.

If Events in Minutes is involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, your personal information may be disclosed, transferred, or acquired as part of that transaction. Before your personal information becomes subject to a different privacy policy as a result of such a transaction, we will notify you by email to the address associated with your account and/or by posting a prominent notice on the Platform, and we will describe any choices you have regarding your personal information. Guest personal information may be transferred only to a successor that remains bound by the Guest ring-fence (Section 9.4).

We share personal information with other parties when you direct us to or provide your consent.

We may use and share aggregated, anonymized, or de-identified data — data that cannot reasonably be used to identify you — for analytics, research, benchmarking, AI development (Section 4.3), and other lawful purposes. Consistent with California Civil Code § 1798.140(m), whenever we use or share de-identified data we: (i) take reasonable measures to ensure that the data cannot be associated with, or re-identified to, any individual or household; (ii) publicly commit — as we do here — to maintain and use the data only in de-identified form and not to attempt to re-identify it (except as permitted by law solely to test whether our de-identification processes work); and (iii) contractually prohibit any recipient of the data from attempting to re-identify it and require the recipient to make the same commitments.

Members can review and update most account and profile information by logging in. Anyone can ask us to access, correct, or delete personal information — including deleting an account — by emailing support@eventsinminutes.com. (If you do not have an account, use the request channels in Sections 9.3, 10.6, 11.4, or 12.3.)

Opt out of promotional emails, business-outreach emails, and our newsletter by clicking "unsubscribe" in any such email, or by emailing support@eventsinminutes.com. Opting out of marketing does not stop transactional and service messages (booking requests and confirmations, receipts, your Event Copilot plan, and security alerts). For booking-alert texts, reply STOP (see Section 14).

Email support@eventsinminutes.com with the subject line "AI Training Opt-Out" (see Section 4.3). No account is required.

We use only approximate location derived from your IP address and your browser's time zone (Section 3.4(c)). You can limit IP-based location by using a VPN or similar tool, which may make search results less relevant.

You can opt out of the disclosure of your personal information for targeted (cross-context behavioral) advertising — which is "sharing" and may be a "sale" under U.S. state privacy laws — by any of the following, none of which requires you to log in or create an account:

• Clicking "Your Privacy Choices" (our "Do Not Sell or Share My Personal Information" link) in the footer of every page of www.eventsinminutes.com and turning advertising off — this stops the Meta, Google Ads, and LinkedIn tags and Google Analytics (whose data Google may combine with its advertising services — Section 10.2) from loading in that browser;
• Turning on the Global Privacy Control (GPC) in your browser or extension — when we receive a GPC signal, we do not load those advertising tags or Google Analytics for that browser, and where you are signed in we also apply the opt-out to your account (Section 8.6); or
• Emailing support@eventsinminutes.com with the subject line "Opt Out of Sale/Sharing."

You can also use industry tools — the Digital Advertising Alliance (www.aboutads.info/choices) and the Network Advertising Initiative (www.networkadvertising.org/choices) — and the ad settings that Google, Meta, and LinkedIn offer in your accounts with them. Because opt-outs set through cookies apply to one browser, please repeat your choice on each browser or device you use (or use GPC, or sign in so we can apply it to your account).

Some browsers transmit "Do Not Track" (DNT) signals. Because there is no uniform standard for DNT, we do not respond to DNT browser signals. We do honor the Global Privacy Control (GPC) signal as a valid request to opt out of "sale," "sharing," and targeted advertising for the browser that sends it — and for your account where you are signed in — for residents of California and of every other state, and we apply it in the same way for all visitors. When your browser sends GPC, the Meta Pixel, Google Ads tags, LinkedIn Insight Tag, and Google Analytics do not load in that browser, and if you are signed in, we record the opt-out on your account. When GPC is detected, the "Your Privacy Choices" preference center shows that your opt-out request has been honored. GPC does not turn off PostHog product analytics or session replay, which PostHog runs for us as a service provider and which are never sold or shared; to stop them, turn analytics off in "Your Privacy Choices" (Section 13.3).

Where we ask for your consent, we design the choice to be genuine: consent checkboxes are never pre-ticked; consent to marketing email from Event Copilot is a separate box (Section 3.3); where we show a cookie banner (to visitors in the EEA, the United Kingdom, Switzerland, and Canada), it presents "Accept" and "Reject" options with equal prominence (Section 13.2); for U.S. visitors, turning analytics, session replay, or advertising off in "Your Privacy Choices" takes the same number of steps as turning it on; and our opt-out mechanisms do not require you to log in. Declining consent for optional processing will not degrade the core service you receive.

For the Guest personal information we hold, Events in Minutes is the "business" (CCPA) and the "controller" (GDPR and similar laws): we determine the Booking-form fields, the retention periods, the recipients, and whether and how Event Copilot processes the information — so we are responsible to you for it, and we do not claim to be a mere processor or service provider. The Event Host is a joint or independent controller for the Guest information the Host originates (for example, compiling the guest list or entering your dietary needs). The Vendor becomes an independent controller of Guest information it receives to perform the booked Vendor Services, and the data-handling limits in Section 21 apply expressly to Guest information.

• What we receive: your name; your contact details where the Event Host provides them (email address and/or phone number); guest-list entries; dietary restrictions, food allergies, and accessibility needs where provided; and event details (date, venue, headcount context).
• Where it comes from: the Event Host, who represents to us that they have permission to share it (see Section 9.7 for what that representation does — and does not — mean for you). For dietary, allergy, and accessibility details (and for children's information), we go further: the Event Host must obtain your consent — or, for a child, the consent of a parent or guardian — before providing them to us, and that consent must be explicit where the law requires it (including in the EEA, UK, Switzerland, Washington, and Nevada); if you are in the EEA, UK, or Switzerland that relayed explicit consent — withdrawable at any time via Section 9.3 — is our Art. 9(2)(a) processing basis (see Section 15.2).
• Why we process it: to fulfill the Booking — communicating requirements to the booked Vendor, coordinating event logistics, and providing support — and to comply with law. Nothing else (see the ring-fence in Section 9.4).
• Who receives it: the booked Vendor(s); where necessary for venue access and logistics, the building or venue management described in Section 5.7; our service providers acting on our behalf (Section 5.4); and recipients required by law (Section 5.8).
• How long we keep it: per Section 6 — guest-list and Booking details follow the booking-and-transaction-records row; dietary, allergy, and accessibility details follow the shorter consumer-health-adjacent row; records of a Guest's privacy request follow the privacy-rights-request row.

Notice to Guests in the EEA, UK, and Switzerland (GDPR Article 14). This section serves as the information notice required by Article 14 GDPR for personal data we obtain from a source other than you. In many cases we do not hold contact details for a Guest, or providing the notice to each Guest individually would involve disproportionate effort; in those cases we rely on Article 14(5)(b), and this publicly available notice serves as the appropriate measure to protect your rights, freedoms, and legitimate interests. Where we do communicate with a Guest directly, we provide the Article 14 information at the latest at the time of the first communication with that Guest (Article 14(3)(b)).

You are not required to have an account with us to make a verifiable privacy request. You can exercise every right this Privacy Policy provides — including access, deletion, correction, opt-outs, the consumer health data rights in Section 11, and the state and international rights in Sections 10, 12, and 15 — through a Guest-specific channel:

• Email: support@eventsinminutes.com (or privacy@eventsinminutes.com) with the subject line "Guest Privacy Request", giving your email address and the Booking reference or Event Host's name; or
• Phone: +1 (415) 634-4617 (a standard-rate line).

How we verify you without an account. We verify Guest requests by matching you against the guest-list information we actually hold: the email address or phone number that appears on the guest list or in the Booking details, together with the Event or Booking reference or the name of the Event Host. For example, if your email address appears on a guest list, a request sent from — or confirmed through — that email address, identifying the Event or the Host, will ordinarily be sufficient; for a phone number, we can confirm by calling that number back. We will never require you to create an account, provide government identification, or supply documentation beyond what is proportionate to the sensitivity of the request, and we use verification information solely to verify you. Response timelines are those stated in Sections 10.6, 11.4, 12.3, and 15.3, as applicable to you, and the appeal rights in Sections 11.5 and 12.4 are equally available to Guests.

We commit to the following, categorically. Guest personal information:

• is never used for marketing or advertising (ours or anyone else's), never used to build marketing or advertising profiles, and never used for profiling;
• is never used to train or improve Event Copilot or any other AI model — including where your details appear inside an Event Host's Event Copilot conversations — unless the information has first been de-identified in accordance with the standard in Section 5.11 (California Civil Code § 1798.140(m));
• is not recorded by session replay — guest lists and other Guest details shown in dashboards, booking views, or checkout are excluded from replay (Section 13.5);
• is never sold, and never "shared" for cross-context behavioral advertising, under the CCPA or any similar law — the "Yes — shared" designations in the table in Section 10.1 do not include Guest personal information; and
• is disclosed only to: the booked Vendor(s) and, where reasonably necessary to deliver the Event, the building/venue management described in Section 5.7; our service providers acting on our behalf (Section 5.4), including our corporate affiliates when acting in that capacity; and our professional advisors bound by confidentiality where necessary to protect our legal interests (Section 5.5).

Limited exceptions. This ring-fence does not prevent: (a) disclosures on the legal, safety, and fraud-prevention grounds described in Section 5.8 — for example, complying with legal process, or acting in good faith to protect any person's rights or safety or to protect against fraud; or (b) the transfer of Guest information to a successor in a business transaction described in Section 5.9, provided the successor remains bound by this ring-fence and pre-transfer notice is given as described in Section 5.9 (where we do not hold Guest contact details, by prominent notice on the Platform).

If you ask us to delete your contact details, we delete them from the guest lists and Booking records we hold (subject to the legal-retention exceptions in Section 6 and the Vendor pass-through in Section 9.6), and we keep only a record of your request and our response (the privacy-rights-request row in Section 6) so that we can show we honored it. Because a different Event Host could later give us a guest list that includes you again, you can ask us at any time to delete newly received details too.

• The honest limit. Once a Booking is confirmed, your information is transmitted to the booked Vendor (Section 5.1) and may thereafter persist in the Vendor's own systems, which we do not control. When you ask us to delete your information, we will pass your deletion instruction through to the Vendor, which Section 21 obligates the Vendor to honor; we may audit compliance and may suspend or remove a non-compliant Vendor from the Platform — but because the Vendor is an independent controller, we cannot guarantee the Vendor's compliance, and you may also contact the Vendor directly.
• Our reserved authority. We may delete or de-identify your information from our Platform upon your request even if doing so removes the Event Host's or the Vendor's access to it through the Platform.

When an Event Host uploads a guest list or provides information about you, the Host represents to us that they have permission to do so (Section 3.2). That representation allocates responsibility between Events in Minutes and the Event Host; it is not the source of our lawful basis for processing your information as against you, and it is not a substitute for your rights or for our own notice obligations (including under GDPR Article 14). The Event Host's representation does not limit your rights as described in this section.

The table below describes our practices during the preceding 12 months and currently. Retention periods match Section 6. Look-back disclosure (session replay). Before the effective date of this Privacy Policy, our session replay tool masked text typed into form fields but could record other content shown on screen, which may have included Event Copilot conversations, Platform messages, guest-list entries, and dietary, allergy, or accessibility details displayed on our pages. That data was processed by PostHog as our service provider, kept for up to 90 days, and was not sold or shared. From the effective date, session replay does not record that content (Section 13.5). Where we collect information — at the Event Copilot email field, at vendor registration, on the claim-your-business pages, at sign-up, and at checkout — we show a notice linking to this Privacy Policy, and this Section 10.1 is our notice at collection. We collect all information described below for the purposes described in Section 4.

The Guest ring-fence and this table. No category marked "Yes — shared" includes Guest personal information or health-adjacent details: guest-list entries, Guest contact details, and Guest dietary, allergy, or accessibility details are categorically excluded from "sale" and "sharing" and from advertising, profiling, and AI-training uses (Section 9.4).

Vendor tax and bank information given to Stripe through Stripe Connect is collected by Stripe under Stripe's own privacy notice; we receive only the payout and tax-form information described in Section 3.1(c). Any taxpayer identification number or bank detail in that information is treated as sensitive personal information (Section 10.1, sensitive personal information row) and used only for payouts and tax reporting, disclosed only to Stripe and tax authorities, and never sold or shared.

We do not collect or process sensitive personal information for the purpose of inferring characteristics about you (see also Section 10.4).

Actual knowledge of minors' data: the Platform is not directed to children, and we do not knowingly collect personal information from consumers under 16. Where an Event Host (a parent or guardian, or someone with their permission) gives us a child's first name and age for a Booking (Sections 3.2 and 19), we use it only to fulfill that Booking, and we never sell or share personal information of consumers under 16.

We do not sell personal information for money. However, our website uses advertising pixels and tags from Google (Google Ads / DoubleClick), Meta (the Meta Pixel), and LinkedIn (the LinkedIn Insight Tag) (Sections 5.6 and 13). Disclosing identifiers and activity data to them for advertising is "sharing" for cross-context behavioral advertising under the CCPA, and may be a "sale" under the CCPA and other state laws. Accordingly:

• We "share" (and may be deemed to "sell") the categories marked "Yes" in the table in Section 10.1, with Google, Meta, and LinkedIn, for advertising — never Guest personal information, health-adjacent details, other sensitive personal information, claim-flow business data, or business-prospect data from B2B data providers.
• You have the right to opt out. Use the "Your Privacy Choices" link (our "Do Not Sell or Share My Personal Information" link) in our website footer, turn on Global Privacy Control, or use the other methods in Section 8.5. You do not need an account or to log in.
• We never sell or share the personal information of consumers under 16, including children's first names and ages that an Event Host provides for a Booking.
• We do not sell or share data collected by PostHog product analytics or session replay; PostHog processes data for us as a service provider and does not use it for cross-context behavioral advertising. For U.S. visitors, PostHog product analytics and session replay run by default, and you can turn them off at any time in "Your Privacy Choices" (Section 13.3). Google Analytics data may be combined with Google's advertising measurement where our Google Ads account is linked, so we treat Google Analytics data as part of the "sharing" with Google described above. Your opt-out of sale and sharing therefore also stops Google Analytics: turning advertising off in "Your Privacy Choices", sending Global Privacy Control, or emailing us (Sections 8.5 and 8.6) stops the Google Analytics, Google Ads, Meta, and LinkedIn tags in that browser. PostHog product analytics and session replay are controlled separately by the analytics setting in "Your Privacy Choices" (Section 13.3).

The Stripe checkout surface. Separately from our own practices, Stripe's JavaScript on our payment pages collects online-activity data (device and browser information across business sites that use Stripe), and Stripe's own privacy policy states that its disclosures of this data may be considered a "sale" or "sharing". That is Stripe's processing as an independent controller (Section 1.4), not ours: our opt-out tools govern our disclosures, and opting out of Stripe's is done through the privacy choices described in Stripe's privacy policy.

We use sensitive personal information only for the purposes permitted by CCPA regulations § 7027(m) — performing the services you request (including passing dietary, allergy, and accessibility details to the Vendor you book, and delivering Member-to-Member messages to their intended recipients), security and integrity (including the message scanning described in Section 4.6), short-term transient use, quality verification, and legal compliance — and we do not use or disclose it to infer characteristics about you. Because our use is limited to those permitted purposes, the CCPA's "Right to Limit" does not require us to offer a separate limitation link. If you would like us to confirm or further restrict how we use your sensitive personal information, email support@eventsinminutes.com with the subject line "Limit Sensitive Information," and we will respond.

These commitments apply to all users (and Guests), not only California residents. Some event details are not neutral commercial data — they can support sensitive inferences: a dietary restriction can reveal religious observance (for example, kosher or halal requirements) or a medical condition (for example, celiac disease or an anaphylaxis-level food allergy), and an accessibility request can reveal disability status. We therefore commit:

1. We do not draw these inferences. We do not use sensitive personal information to infer characteristics about you, and we do not build religious, health, or disability profiles of anyone.
2. Providing sensitive information is never required. We do not require the provision of sensitive information to use the Platform: dietary, allergy, and accessibility fields are always optional, and leaving them blank will not prevent you from making or completing a Booking.
3. Hard purpose limitation. Where you choose to provide these details, we process them solely to provide the related services — communicating your requirements to the booked Vendor, fulfilling the Booking, and, where you type them into Event Copilot, generating your recommendations and plan — plus security and legal compliance. We do not use them for Event Copilot product-improvement work (Section 4.3). Never for marketing, advertising, or profiling.
4. Removal on request. You can ask us at any time to edit or delete dietary, allergy, and accessibility details from a current or past Booking by emailing support@eventsinminutes.com with the subject line "Sensitive Information Removal." Guests can use the account-free channel in Section 9.3. For an upcoming event, removing these details means the Vendor may no longer be able to meet the requirement, and we will tell you if so.
5. Never sold or shared. Sensitive personal information, including these fields, is categorically excluded from "sale" and "sharing" (Section 10.1).

• Right to Know / Access: request disclosure of the categories and specific pieces of personal information we collected, the categories of sources, our purposes, and the categories of third parties to whom we disclosed, sold, or shared it.
• Right to Delete: request deletion of personal information we collected from you, subject to statutory exceptions (completing your transaction, security and fraud prevention, legal compliance, and other exceptions in Civil Code § 1798.105(d)).
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: see Sections 10.2 and 8.5.
• Right to Limit Use of Sensitive Personal Information: see Section 10.3.
• Right to Data Portability: request your personal information in a portable and, to the extent technically feasible, readily usable format.
• Right to Non-Discrimination: we will not discriminate or retaliate against you for exercising any CCPA right — no denial of services, different prices, or reduced quality.

Submit a request by:

• Email: support@eventsinminutes.com (or privacy@eventsinminutes.com) with the subject line "California Privacy Request" (Guests may instead use "Guest Privacy Request" — Section 9.3);
• Toll-free phone: our toll-free privacy request line, shown on the "Privacy Requests" page linked from our website footer and from Section 24 (our main line, +1 (415) 634-4617, also accepts requests); or
• Mail: Events in Minutes, Inc., Attn: Privacy & Data Protection, 999 Baker Way, San Mateo, CA 94404, USA.

Verification — no account required. You are not required to have an account with us to make a verifiable request. We verify your identity to a reasonable degree of certainty by matching data points you provide against the information we actually hold about you, scaled to the sensitivity of the request:

• If you have an account, we typically match your email address and one or more recent Booking or account details; responding from the email address associated with your account is one convenient option — never a requirement.
• If you do not have an account, we match the contact detail we hold about you:
• Guests: the email address or phone number on a guest list or in Booking details, together with the Event or Booking reference or the Event Host's name (see Section 9.3);
• Event Copilot users: a confirmation link or code sent to the email address you gave Event Copilot;
• Businesses we prepared a draft listing for, and business prospects: a confirmation sent to the business email address (or a call-back to the business phone number) we hold;
• Callers: the phone number you called from, confirmed by a call-back to that number.
• Visitors we know only by cookie or device ID can use the opt-out tools in Section 8.5; for access or deletion of that data we may ask you to confirm from the browser concerned.

We may request additional information for higher-sensitivity requests, use it only for verification, and never require you to create an account or provide more documentation than is proportionate. Opt-out requests do not require verification.

Authorized agents. You may designate an authorized agent to submit requests on your behalf. We will require the agent to provide your signed written permission (or a power of attorney), and we may ask you to verify your own identity or confirm the authorization directly with us.

Timing. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to an additional 45 days), we will notify you of the extension and the reason. We will act on opt-out requests within 15 business days.

Request metrics. Events in Minutes does not buy, receive, sell, or share the personal information of 10 million or more California residents in a calendar year, so the CCPA's request-metrics compilation and publication requirement (regulations § 7102) does not currently apply to us. If that changes, we will publish the required metrics.

Under California Civil Code § 1798.83, California residents may request information about disclosures of personal information to third parties for those third parties' own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes within the meaning of that statute. (Our separate practices regarding advertising partners, and your opt-out rights, are described in Section 10.2.) Questions may be directed to support@eventsinminutes.com.

We do not currently offer financial incentives, loyalty programs, or price or service differences in exchange for the collection, retention, sale, or sharing of personal information. Promo codes we issue are discounts on Bookings; they are not given in exchange for personal information (for example, we do not offer a code for signing up for email or sharing contact details). If we introduce such a program (for example, a referral reward program conditioned on providing personal information), we will first provide a notice of financial incentive describing its material terms — including a good-faith estimate of the value of the personal information involved and a description of how we calculated that value, as required by Civil Code § 1798.125(b)(2) and CCPA regulations § 7016(d) — obtain your opt-in consent before enrolling you, allow you to withdraw at any time, and never employ incentive practices that are unjust, unreasonable, coercive, or usurious.

Event details you choose to provide when planning an event may qualify as "consumer health data" because they can reveal health status, including: dietary restrictions and food allergies; accessibility or disability accommodation needs; skin-sensitivity or product-allergy notes for beauty services; and similar health-adjacent event requirements (for example, a request for a wheelchair-accessible venue or a nut-free menu), including such details you type into Event Copilot.

• Sources: this data comes directly from you, or from an Event Host who provides it about a Guest (see Section 9 — the Host's representation described in Section 3.2 allocates responsibility between the Host and us and does not limit the Guest's rights).
• Purposes: we collect and use it only to provide the products and services you (or your Event Host) request — communicating the requirements to the booked Vendor, fulfilling the Booking, generating Event Copilot recommendations and plans when you type such details into Event Copilot, and providing support — and to comply with law. We do not use these details for Event Copilot product-improvement work (Section 4.3), and session replay does not record them (Section 13.5).
• Sharing: it is shared only with the booked Vendor (to fulfill the requirements), where necessary for venue logistics with building/venue management (Section 5.7), with our cloud hosting and support service providers under contract, with the AI model providers that process Event Copilot inputs on our behalf (Section 5.4) when you type such details into Event Copilot, and as required by law. The categories of consumer health data we share are those listed in Section 11.1; we share it with a corporate affiliate only when the affiliate acts as our service provider under the same limits. We do not use consumer health data for advertising, and we do not sell it.

We collect and share consumer health data only (a) with your consent, or (b) to the extent necessary to provide a product or service that you have requested. Where an Event Host gives us a Guest's dietary, allergy, or accessibility details, we treat them as provided with that Guest's consent (or, for a child, a parent's or guardian's consent), which our Terms require the Event Host to obtain — explicitly where the law requires it — before sharing them; a Guest can withdraw that consent at any time through Section 9.3. Providing dietary, allergy, or accessibility details is always optional (Section 10.4). We will obtain your separate, voluntary consent before collecting or sharing consumer health data for any purpose beyond what is necessary to provide the service requested, and we will not sell consumer health data without the signed, valid authorization required by RCW 19.373.070 — which, as stated above, we do not do.

If you are a Washington or Nevada resident (or your consumer health data was collected there), you have the right to:

• Access your consumer health data, including a list of the third parties and affiliates with whom we have shared it and an active contact (email address or hyperlink) for each;
• Withdraw consent to our collection and sharing of your consumer health data;
• Delete your consumer health data (including from our backups on their routine purge cycle and, by instruction, from our processors — and see Section 9.6 for how we pass deletion instructions to Vendors).

Exercise these rights by emailing support@eventsinminutes.com with the subject line "Consumer Health Data Request" (Guests may also use "Guest Privacy Request"). You do not need an account: we verify non-account-holders as described in Section 9.3, by matching the contact detail and Booking information we actually hold. We will verify and respond within 45 days, extendable once by 45 days where reasonably necessary (with notice to you).

If we deny your consumer health data request, you may appeal by replying to our denial or emailing support@eventsinminutes.com with the subject line "Consumer Health Data Appeal" within a reasonable time after our decision. We will respond in writing within 45 days of receiving your appeal, explaining any action taken or not taken and the reasons. If your appeal is denied, you may contact the Washington State Attorney General (www.atg.wa.gov/file-complaint) or, for Nevada residents, the Nevada Attorney General (ag.nv.gov) to submit a complaint.

Consumer health-adjacent data is retained for the life of the Booking plus 1 year, then segregated and deleted or de-identified/redacted within any retained booking record (see Section 6). The longer 7-year retention of booking and transaction records does not extend to identifiable health-adjacent fields. Health-adjacent details you type into Event Copilot are deleted or redacted no later than 24 months after you provided them, even if the rest of the conversation is kept longer, or sooner on request (Section 10.4(4)).

This section applies to residents of states with comprehensive consumer privacy laws, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MTCDPA), Iowa (ICDPA), Indiana (INCDPA), Tennessee (TIPA), Delaware (DPDPA), New Jersey (NJDPA), New Hampshire (NHDPA), Kentucky (KCDPA), Nebraska (NDPA), Minnesota (MCDPA), Maryland (MODPA), and Rhode Island (RIDTPPA, effective January 1, 2026), and residents of other states as their laws take effect.

Subject to your state's law, you have the right to:

• Confirm and access whether we process your personal data and obtain a copy;
• Correct inaccuracies in your personal data;
• Delete personal data provided by or obtained about you;
• Data portability — obtain a copy in a portable, readily usable format;
• Opt out of (i) targeted advertising, (ii) the "sale" of personal data, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.

Because we use advertising tools described in Section 10.2, our disclosures to advertising partners constitute "targeted advertising" (and in some states a "sale") under these laws, and the opt-out methods in Section 8.5 apply. We honor the Global Privacy Control as a universal opt-out preference signal in every state that requires it (see Section 8.6). For profiling, see Section 4.4: you may opt out of profiling in furtherance of significant decisions and request human review via the channel described there. Guest personal information is never used for targeted advertising, sold, or profiled (Section 9.4).

Voluntary uniform treatment; state-by-state accuracy. We voluntarily extend the rights above to residents of all of the listed states. Note, however, that some statutes are narrower than our voluntary practice: Utah's UCPA does not itself grant a profiling opt-out or an appeal right (it grants a correction right from July 1, 2026), and Iowa's ICDPA does not itself grant a correction right or a profiling opt-out; in Utah and Iowa, the statutory deletion right covers personal data the consumer provided; and Iowa requires notice of targeted advertising and an opt-out of sales but no separate targeted-advertising opt-out right — for residents of those states, we honor those additional rights (including deletion of all personal data we hold about you and the targeted-advertising opt-out) voluntarily, beyond what UCPA and the Iowa law require.

State-specific additional rights:

• Oregon, Minnesota, and Connecticut: residents may additionally request a list of the specific third parties (not just categories) to which we have disclosed personal data (Oregon: any personal data; Minnesota: their personal data; Connecticut: the third parties to which we have sold their personal data, or, if we do not maintain that information in a consumer-specific format, all third parties to which we have sold personal data).
• Delaware and Maryland: residents may additionally request a list of the categories of third parties to which we have disclosed their personal data.
• Maryland: consistent with Maryland's data-minimization rules, we collect and process sensitive data (such as health-adjacent details) only where strictly necessary to provide the service you request, and we never sell sensitive data.
• Minnesota and Connecticut: residents who are subject to profiling in furtherance of decisions with legal or similarly significant effects may additionally question the result of the profiling, be informed of the reasons the decision was made, be told what actions they could take (where feasible) to secure a different result, and have the data used in the profiling reviewed for accuracy.
• Nevada: independent of the consumer health data rights in Section 11, Nevada's website-operator law (SB 220) gives Nevada consumers the right to opt out of the sale of covered information by website operators. Nevada residents may exercise this right through the same channels in Section 8.5 or by emailing support@eventsinminutes.com with the subject line "Nevada Opt-Out."

Email support@eventsinminutes.com with the subject line "State Privacy Request" (or, for Guests, "Guest Privacy Request" — Section 9.3; or use the opt-out methods in Section 8.5), or call +1 (415) 634-4617. You do not need an account: we will verify your identity using the account-optional process described in Section 10.6 (and, for Guests, Section 9.3) and respond within 45 days, extendable once by 45 days where reasonably necessary (with notice to you). Authorized agents may submit opt-out requests where your state's law permits.

If we decline to take action on your request, we will tell you why and how to appeal. To appeal, email support@eventsinminutes.com with the subject line "Privacy Rights Appeal" (or reply directly to our denial) within a reasonable period after receiving our decision. We will respond in writing within the period your state's law requires — 45 days in Colorado, Oregon, Minnesota, and New Jersey, and 60 days in most other listed states — explaining any action taken or not taken and the reasons. If your appeal is denied, our response will include a way to contact your state Attorney General to submit a complaint (for example, Virginia: www.oag.state.va.us; Colorado: coag.gov/file-complaint; Connecticut: portal.ct.gov/ag; Texas: www.texasattorneygeneral.gov/consumer-protection).

Advertising and advertising-linked analytics technologies send identifiers and activity data to Google, Meta, and LinkedIn, which is "sharing" and may be a "sale" (Sections 5.6 and 10.2).

United States (and other locations without a prior-consent requirement). We do not show a cookie banner. From your first page view, our site runs strictly necessary and functional technologies (such as the `eim_tz` time-zone cookie), PostHog product analytics and PostHog session replay, Google Analytics, and the Meta, Google Ads, and LinkedIn advertising tags described in Section 13.1. We tell you this here and in the Summary at the top of this policy, which is linked from every page, so that you know before you browse. You can turn PostHog analytics and session replay off, and turn advertising and Google Analytics off (your opt-out of "sale" and "sharing"), at any time in "Your Privacy Choices" in the footer of every page; your choice is stored in your browser and, if you are signed in, on your account. When your browser sends Global Privacy Control, the advertising tags and Google Analytics do not load (Section 8.6).

EEA, United Kingdom, Switzerland, and Canada. When you first visit, a cookie banner explains these technologies and offers "Accept" and "Reject" options with equal prominence. Only strictly necessary technologies run until you click "Accept"; functional technologies, PostHog product analytics and session replay, Google Analytics, and advertising tags are set only after you accept, and none of them run if you click "Reject." Continued browsing is not treated as consent. This is how we obtain the prior consent the law requires in those places. You can change your choice at any time through "Your Privacy Choices" in the footer. We store your choice for 12 months, then ask again.

Wherever you are, you can turn advertising off at any time (Section 8.5), and a Global Privacy Control signal stops the advertising technologies from loading in that browser — even if you clicked "Accept."

You can manage cookies through:

• "Your Privacy Choices" in our footer — our preference center, with two settings: analytics, which turns PostHog product analytics and session replay on or off, and advertising, which turns Google Analytics and the Google Ads, Meta, and LinkedIn tags on or off; turning advertising off is also your opt-out of "sale" and "sharing" (Section 8.5);
• Global Privacy Control (Section 8.6);
• Browser settings (blocking or deleting cookies);
• Industry and platform tools: DAA (www.aboutads.info/choices), NAI (www.networkadvertising.org/choices), and the ad settings in your Google, Meta, and LinkedIn accounts.

Blocking strictly necessary cookies may stop parts of the Platform (such as sign-in or the cart) from working.

Google Analytics 4 does not log or store IP addresses. Google's use of data is governed by Google's own privacy policy. You can also opt out of Google Analytics across websites with the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout).

We use PostHog in two ways. Product analytics (page views, events, engagement time, and marketing attribution, sent mostly through our own domain; some pages send directly to PostHog's servers in the United States) and session replay run for U.S. visitors (and visitors in other places where we do not show a cookie banner) from their first page view, and for visitors in the EEA, the United Kingdom, Switzerland, and Canada only after "Accept." Session replay records how you interact with our pages (clicks, scrolling, page views, and what appears on screen) so that we can see where people get stuck. Text you type into form fields is masked, and payment card details are entered in Stripe's secure payment form and are never recorded. Session replay does not record Event Copilot conversations, Platform messages, guest lists or other Guest details (in dashboards, booking views, or checkout), or dietary, allergy, accessibility, or similar details. Session replay also captures technical information such as console messages and network timing (not the contents of requests). PostHog also processes the engagement-time and marketing-attribution information described in Section 3.4. PostHog processes this data for us as a service provider; we keep session replays for 90 days (Section 6) and do not sell or share them. Look-back disclosure (session replay). Before the effective date of this Privacy Policy, our session replay tool masked text typed into form fields but could record other content shown on screen, which may have included Event Copilot conversations, Platform messages, guest-list entries, and dietary, allergy, or accessibility details displayed on our pages. That data was processed by PostHog as our service provider, kept for up to 90 days, and was not sold or shared. From the effective date, session replay does not record that content. You can stop PostHog product analytics and session replay at any time by turning analytics off in "Your Privacy Choices" (or, where a banner is shown, by clicking "Reject"), and you can ask us to delete this data through the rights channels in Sections 10 and 12.

The pixels and tags described above (Google, Meta, and LinkedIn), Google Analytics, and PostHog session replay collect information about your interactions with our pages while you use them and transmit it to those companies' servers — Google, Meta, and LinkedIn for advertising and measurement, and PostHog for us as our service provider. For U.S. visitors these technologies run from the first page view, without a cookie banner; we disclose them in the Summary at the top of this policy and here, and you can turn them off at any time in "Your Privacy Choices" (Section 13.3) or stop the advertising tags with Global Privacy Control (Section 8.6). For visitors in the EEA, the United Kingdom, Switzerland, and Canada, they run only after "Accept" (Section 13.2). These technologies do not run on the payment fields provided by Stripe, where you enter card details, and card details are never recorded. In session replay, text you type into form fields is masked, and Event Copilot conversations, Platform messages, guest lists and other Guest details, and dietary, allergy, accessibility, or similar details are not recorded.

We do not send marketing or promotional text messages. We send only these kinds of texts:

• Vendor booking alerts. At Vendor registration, or later in Vendor account settings, a Vendor can choose to receive booking alerts — for example, when a customer messages or books — at the personal mobile number the Vendor gave us at registration (or updates in account settings), by ticking a separate checkbox ("Text me when a customer messages or books") that is unticked by default. We log the number, the time, and the disclosure shown when you opt in. We send at most one text every 2 hours. Message and data rates may apply. Reply STOP to cancel and HELP for help.
• One-time verification codes. Only when a person claiming a business listing, or confirming that they are authorized to manage it, taps "Text me the code," we send a single verification code to the business phone number we hold. We send a code only when someone asks for it, and each request produces one message. These codes are never used for marketing.

• Agreeing to receive texts is not a condition of creating an account, registering as a Vendor, or buying anything. Vendors can use the Platform without booking-alert texts.
• Message and data rates may apply; check with your carrier.
• Booking alerts: no more than one text every 2 hours. Verification codes: one message per request.
• Reply STOP to any message to stop texts of that type (you will receive one confirmation message and no further texts of that type). Reply HELP for help, or contact support@eventsinminutes.com.
• We do not share your mobile number or text-message opt-in data with third parties or affiliates for their own marketing purposes.

Text messages are available on major U.S. carriers. Carriers are not liable for delayed or undelivered messages.

• Transactional and service email (booking requests and confirmations, receipts, your Event Copilot plan, and security notices) is sent as part of the service.
• Marketing email and our newsletter (The Empowered EA, sent through Beehiiv) are sent to people who sign up for them or, where the law allows, to existing customers; Event Copilot users receive marketing email only if they tick the separate opt-in box (Section 3.3).
• Business-to-business outreach. We email event businesses about claiming a draft listing, and corporate event planners about booking through the Platform (Section 3.7). These emails follow the U.S. CAN-SPAM Act (and, for Canadian recipients, CASL — Section 16.3): they identify Events in Minutes as the sender, use honest subject lines, say that they are an invitation or advertisement, include our postal address (999 Baker Way, San Mateo, CA 94404), and contain a working unsubscribe link.
• Unsubscribing. Every marketing and outreach email has an unsubscribe link. We honor unsubscribes promptly, within 10 business days, and keep unsubscribed addresses on a permanent suppression list, which we use to avoid emailing people who have opted out.

When you call Events in Minutes (including when you "Call Emma" or use the "Contact Emma" button on our website), your call may be answered by Emma, our automated AI voice assistant, rather than a person. Emma is separate from Event Copilot, our web-based AI planner (Section 3.3). At the start of the call, the assistant tells you that you are speaking with an automated assistant and that the call is recorded and transcribed. If you continue the call after that notice, you agree to the recording; if you do not want the call recorded, you can hang up and email support@eventsinminutes.com instead, or ask during the call to speak with a person, and a member of our team will call or email you back.

We use the recording and transcript to understand your request; to prepare an event brief for you (or, if you are a business that wants to list on the Platform, a sign-up email); to provide support; for quality assurance; and to resolve disputes. Calls are processed by our telephone, AI voice-assistant, and workflow-automation providers acting as our service providers (Section 5.4) under contract; as with our AI model providers (Section 4.3), we do not authorize them to use call recordings or transcripts to train their general models. We keep recordings and transcripts as stated in Section 6. We do not make cold calls or use automated or prerecorded calls for marketing.

We do not intentionally collect "special categories of personal data" (Art. 9). However, event details you volunteer — such as dietary restrictions, allergies, accessibility needs, or religious meal requirements — may reveal health, disability, or religious information (see Section 10.4 for the inferences these details can support and our commitments). We process such data only to the extent strictly necessary to fulfill the Booking you have requested (including transmitting it to your chosen Vendor), on the basis of your explicit consent (Art. 9(2)(a)), which you give through a separate statement shown next to these optional booking fields ("I agree that Events in Minutes may share these details with the Vendors I book so they can meet them") and, for Event Copilot, a statement shown above the message box before you send health-adjacent details ("If you share dietary, allergy, accessibility or similar details, you agree that we and our AI providers may process them to plan your event"). You can leave the fields blank or not share such details with Event Copilot, and you may withdraw consent at any time by deleting the details from your Booking or contacting us (Section 24); withdrawal does not affect processing that already took place.

Health-adjacent Guest details provided by an Event Host. Where an Event Host provides dietary, allergy, or accessibility details about a Guest (Section 9.2), we require the Event Host to obtain the Guest's explicit consent before providing those details to us, and we process them under Art. 9(2)(a) on the basis of that relayed explicit consent — the Guest's consent, not the Host's warranty or representation to us, is the legal basis for the processing. A Guest may withdraw that consent at any time, without an account, through the Guest Privacy Request channel in Section 9.3; on withdrawal we will stop processing the details (subject only to Art. 9-compatible retention required by law) and pass the withdrawal through to the booked Vendor under Section 9.6.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection — including to direct marketing (Art. 21); the right not to be subject to solely automated decisions with legal or similarly significant effects except as permitted by Art. 22 (see Section 4.4 for our automated-processing disclosure and human-review channel); the right to withdraw consent at any time; and the right to lodge a complaint with your supervisory authority — your local EEA data protection authority, the UK Information Commissioner's Office (ico.org.uk), or, in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) (edoeb.admin.ch).

To exercise these rights, email support@eventsinminutes.com. You do not need an account: Guests and other non-account-holders are verified as described in Section 9.3, and Section 9.2 contains the Article 14 notice for Guests whose data we obtain from an Event Host. We will respond within one month, extendable by up to two further months for complex or numerous requests, with notice to you within the first month.

Your personal data is transferred to and processed in the United States and other countries that may not provide the same level of data protection as your home jurisdiction. We use the following safeguards:

• EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF: several of our providers and partners — including Google, Meta, LinkedIn, and Stripe — are certified under the DPF, and for transfers to those providers we may rely on their DPF certification as the transfer mechanism, with SCCs as a fallback.
• Standard Contractual Clauses (SCCs) adopted by the European Commission (Implementing Decision (EU) 2021/914), supported, where required, by transfer risk assessments and supplementary measures (such as encryption and access controls).
• UK: the UK International Data Transfer Agreement (IDTA) and/or the UK Addendum to the EU SCCs, with transfer risk assessments where ICO guidance requires them.
• Switzerland: transfers rely on the Swiss-U.S. DPF or on the EU SCCs with the FDPIC-recognized Swiss addendum (adapting references to the FADP and recognizing the FDPIC as the competent authority).

You may request a copy of the applicable transfer safeguards by emailing support@eventsinminutes.com.

We have not appointed a Data Protection Officer under Article 37 GDPR or a representative in the EU or the UK under Article 27 GDPR/UK GDPR. Please direct all data protection inquiries to support@eventsinminutes.com, Attn: Privacy & Data Protection.

• Meaningful consent: we obtain meaningful consent for collection, use, and disclosure, except where the law permits otherwise (e.g., fraud prevention, legal compliance). For visitors in Canada (every province, including Quebec), we show a cookie banner: only strictly necessary technologies run until you click "Accept," and functional cookies, PostHog product analytics and session replay, Google Analytics, and advertising tags run only after you accept (Section 13.2). You can withdraw consent at any time by clicking "Reject" or through "Your Privacy Choices" (Section 13.3). Global Privacy Control is honored as an opt-out of advertising tags and Google Analytics (Section 8.6); it does not by itself withdraw analytics consent, which you can do through "Your Privacy Choices."
• Access and correction: you may request access to your personal information and correction of inaccuracies via support@eventsinminutes.com (no account required — see Sections 9.3 and 10.6 for verification).
• Accountability for cross-border transfers: your personal information is processed by service providers in the United States (Section 5.4). We remain accountable for it and use contracts requiring a comparable level of protection.
• Withdrawal of consent: you may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; withdrawal may limit certain features.
• Breach reporting: we report breaches of security safeguards creating a real risk of significant harm to the Office of the Privacy Commissioner of Canada (OPC) and affected individuals, and we keep records of all breaches for at least 24 months (see Section 18).

For Quebec residents:

• Person in charge of the protection of personal information: as provided by Law 25, this function is exercised by Events in Minutes' highest-ranking officer, the Chief Executive Officer, who may be contacted at support@eventsinminutes.com, Attn: Person in Charge of the Protection of Personal Information / Responsable de la protection des renseignements personnels, 999 Baker Way, San Mateo, CA 94404, USA.
• Automated decision-making: if we make a decision about you based exclusively on automated processing (see Section 4.4), we will inform you at or before the time of the decision, and you may submit observations to a member of our staff who can review the decision, and ask what personal information was used, the principal factors involved, and to have that information corrected.
• Cross-border communication: because the Platform is operated from the United States, personal information of Quebec residents is processed outside Quebec. Before communicating such information outside Quebec, we assess whether it will receive adequate protection, as Law 25 requires, and we rely on written agreements with our service providers to protect it.
• Tracking technologies: as for all visitors in Canada (Section 16.1), technologies that identify, locate, or profile you — including PostHog product analytics, session replay, Google Analytics, and advertising tags — are off by default and run only after you click "Accept" (Section 13.2).
• French language: Quebec residents may request a French-language version of this Privacy Policy and conduct privacy-related communications with us in French by contacting support@eventsinminutes.com (subject: "Version française / French Version").

We comply with Canada's Anti-Spam Legislation: we send commercial electronic messages (including our Beehiiv newsletter and business-to-business outreach) to Canadian recipients only with express consent or valid implied consent (for example, a business email address that is conspicuously published without a statement that it does not wish to receive unsolicited messages, where our message is relevant to the recipient's business role); every message identifies Events in Minutes, Inc. and provides our contact information; and every message includes a functional unsubscribe mechanism that we honor within 10 business days (in practice, promptly).