Gravy Pass Privacy Policy

This Privacy Policy and Notice at Collection ("Privacy Policy") explains how Atar Growth, Inc. d/b/a Gravy Pass ("Atar Growth," "Gravy Pass," "us," "our," and "we") collects, uses, and discloses Personal Information (as defined below). This document is intended to provide clear and accessible information about our data practices and your rights.

This Privacy Policy applies to Personal Information we collect through gravypass.com and other Gravy Pass websites, through Gravy Pass technology made available on partner websites or applications, and through customer support, marketing, and other interactions with us (collectively, the "Services"). It does not apply to information collected directly by advertisers, partners, or third-party reward or redemption providers under their own privacy policies. Separate privacy notices may apply to job applicants, employees, and contractors.

Gravy Pass Services

Gravy Pass is a United States-only rewards service operated by Atar Growth. It allows eligible adults age 18 or older to engage with qualifying offers, promotions, and related content ("Offers") from third-party advertisers and partners and, when applicable, earn rewards subject to offer terms, validation, and program rules. Some offers and reward redemptions are fulfilled by third-party partners.

Your Choices and Their Implications

There is no obligation for you to sign up to Offers. If you choose to engage with any Offers, we may share your Personal Information, where applicable, with the party identified in the Offer, enabling them to fulfill the Offers and provide you with further information related to such Offers, as elaborated below under 'Collection and Use of Personal Information'. Importantly, there are no negative consequences if you choose not to sign up to an Offer, nor will it prevent you from accessing future services from that company—no further action will be taken regarding that Offer.

SMS Messaging and Consent

Gravy Pass may offer the ability to receive SMS messages from us at the phone number (866) 377-1970. If you choose to opt in to SMS communications:

• You provide your express written consent to receive promotional, transactional, and informational text messages from Gravy Pass.
• Message frequency may vary depending on your activity and engagement with our services.
• Standard message and data rates may apply.
• You acknowledge that consent is not a condition of purchasing any goods or services.
• You can opt out at any time by texting STOP to (866) 377-1970 or by contacting privacy@atargrowth.com.
• For help, text HELP to (866) 377-1970 or contact support@gravypass.com.

Your consent to receive SMS messages is separate from any other consents you may have provided. We will never automatically opt you into SMS messaging - this requires your explicit action and consent through our opt-in process. You will have the opportunity to confirm your phone number and consent before receiving marketing messages.

Phone numbers provided when opting-in to SMS alerts via the website form are used solely by Atar Growth to send you information about your account and mission opportunities, and are not shared with third parties for their marketing purposes.

Commitment to Your Privacy

Your privacy is a top priority at Gravy Pass. We are committed to safeguarding your personal data and ensuring its confidentiality and security. We take comprehensive steps to protect the data entrusted to us by our partners and users. For more information on how we safeguard your data, see "Security Measures" below.

Definition of Personal Information

"Personal Information" or "Personal Data" is information about you which can: - Be used to identify, contact, or locate you; - Be combined with other information that is linked to you; - Is defined as "Personal Data" or "Personal Information" by applicable laws or regulations relating to the collection, use, storage, or disclosure of information about you.

Personal Information includes: - Contact information (e.g., email address, telephone number) - Online information (e.g., IP addresses, device identifiers) - Other data which can be used individually or in combination with other data to identify an individual (such as gender, marital status, age, or postcode).

Types of Personal Information We Collect

We collect and process the following categories of Personal Information in connection with the Services:

How We Use Personal Information

We use Personal Information to operate the Services, administer offers and rewards, communicate with you, prevent fraud, improve the Services, and comply with our legal obligations. Examples include:

Information from one Gravy Pass service may be combined with information from other Gravy Pass services to support account administration, offer validation, fraud prevention, and a more consistent user experience. We may also supplement the information we collect with data from third parties to help validate information and support service operations.

Collection and Use of Personal Information

Our Services enable us to display Offers from Partners and Advertisers, support your participation in those Offers, and administer Gravy Pass rewards. Below, we explain how Personal Information is used by Atar Growth and when it is disclosed to Partners, Advertisers, third-party reward or redemption providers, and service providers.

(i) Use of Personal Information by Atar Growth

We use your Personal Information for the following purposes:

• Providing, maintaining, protecting, and improving the Services, including account administration and core site functionality.
• Tracking offer engagement, attributing conversions, calculating provisional rewards, validating eligibility, and supporting reward redemption workflows.
• Sharing necessary information with Partners, Advertisers, and third-party reward or redemption providers to operate Offers and fulfill reward-related requests.
• Communicating with you about your account, Offers, rewards, redemptions, support requests, and updates to our Services.
• Sending marketing communications if you have requested or consented to receive them.
• Maintaining records, complying with law, enforcing our Terms, and defending our legal rights.
• Validating information, verifying identities in appropriate situations, and investigating fraud, suspicious activity, or policy violations.
• Managing business-to-business relationships when you interact with us on behalf of your employer or another organization.
• Using your phone number for SMS communications if you have expressly opted in, as described in the SMS Messaging and Consent section.

We may specify additional purposes for collecting your Personal Information at the time of collection.

(ii) Sharing Personal Information with Partners and Advertisers

• Engaging with Offers: When you interact with an Offer on a Partner's site or within our Services, we may share the Personal Information you provide, along with offer and attribution data, with the relevant Partner or Advertiser to display, validate, or fulfill the Offer.
• Accepting Offers or Rewards: If you request or accept an Offer or reward, we may share identifiers, contact information, Offer-selection details, and related validation information with the relevant Partner, Advertiser, or third-party reward or redemption provider as reasonably necessary to administer that request.

• Electronic Communications: When you opt to accept an Offer or request redemption-related follow-up, we disclose the information reasonably necessary for the relevant Partner, Advertiser, or third-party reward or redemption provider to contact you about that Offer or request. Information disclosed to those recipients is governed by their privacy policies.

Further Disclosure of Personal Information

• To Third-Party Agents and Processors: We may disclose your Personal Information to service providers that support the Services, such as hosting providers, analytics providers, CRM platforms, messaging vendors, fraud-prevention services, customer support tools, data validation services, and authentication or security providers, primarily based in the United States.
• During Promotions and Contests: Personal Information may be shared with Advertisers or Partners if you participate in a contest or promotion through their platforms.
• Within Atar Growth: Your information may be shared with Atar Growth affiliates, advisors, and personnel that support business operations.
• Legal Requirements: We disclose Personal Information as required by law, such as to comply with subpoenas or legal processes.
• Security and Legal Rights: To address fraud, security issues, or to protect our legal rights, including defending against legal claims.
• Business Transitions: In the case of a merger, acquisition, reorganization, asset sale, or similar corporate event, Personal Information may be part of the transferred assets.

We ensure that the use of your Personal Information aligns with the disclosures provided in this Privacy Policy and is subject to appropriate confidentiality and security measures.

United States Service and Data Processing

Gravy Pass is offered only to adults age 18 or older who reside in the United States. Our systems and service providers are primarily located in the United States, and Personal Information we collect is processed and stored in the United States.

Security Measures

The security of your Personal Information is a top priority for Atar Growth.

Implementing Robust Security Measures

We implement rigorous technical and organizational measures to protect your Personal Information against loss, misuse, unauthorized access, modification, or disclosure. These measures are designed to provide a security level commensurate with the risk associated with processing your Personal Information. However, it's important to acknowledge that no method of transmitting or storing information online is completely secure. While we strive to protect your Personal Information, we cannot guarantee its absolute security.

Specific Security Practices

Our security practices include:

• Restricting Access: We limit access to Personal Information wherever practical, ensuring only authorized personnel can view such data.
• Encryption: We use industry-standard encryption to protect data both in transit and at rest, safeguarding against unauthorized access.
• Secure Network: We maintain a secure network with no direct access between the internet and the systems that process your data, enhancing overall security.
• Pseudonymization Techniques: Techniques such as hashing email addresses or device IDs are employed to minimize risks associated with data processing.
• Regular Security Assessments: We regularly perform scans and penetration tests on our applications and networks to identify and address potential vulnerabilities.
• Third-Party Security Requirements: We demand that any third parties with whom we conduct business uphold equivalent security and confidentiality measures to protect data integrity.

These precautions are part of our commitment to ensuring the security of your Personal Information and maintaining your trust in our practices.

Retention of Personal Information

We retain Personal Information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to operate the Services, validate offers and rewards, prevent fraud, comply with law, and resolve disputes. Retention periods vary by category of data and the nature of your relationship with us.

• Account and profile information: retained while your account is active and for a reasonable period afterward to maintain records, comply with law, resolve disputes, and enforce our Terms.
• Offer engagement, attribution, and reward records: retained for as long as necessary to validate activity, administer provisional or finalized rewards, investigate reversals or fraud, and satisfy contractual, audit, or legal obligations.
• Device, tracking, and fraud-prevention data: retained for as long as needed to detect abuse, validate offer activity, protect the Services, and investigate security incidents.
• Communications and support records: retained for as long as needed to respond to requests, maintain service history, and protect legal rights.
• Information we receive from third-party reward or redemption providers: retained only to the extent we receive it, and only as long as needed to administer your account, resolve support issues, comply with law, and defend legal claims.

Responsibility of Partners and Advertisers

Atar Growth is not responsible for the retention practices of advertisers, partners, or third-party reward or redemption providers that collect information directly from you. You should consult their privacy policies to understand how they manage information they collect and retain.

For more details on how you can exercise your rights concerning your Personal Information, please refer to the 'Your Rights in Relation to Your Personal Information' section.

Use of Tracking Technologies

We use cookies, pixels, local storage, device identifiers, and similar technologies to operate the Services, attribute offer completions, measure performance, prevent fraud, and maintain account and reward functionality.

These technologies are a core part of how Gravy Pass works. They help us connect your activity to the correct Offer, prevent duplicate or invalid reward claims, remember your session and preferences, and diagnose service issues.

Because attribution and validation are required for the rewards experience, we do not currently offer a separate opt-out from Tracking Technologies that are necessary to operate the Services. If you disable cookies or similar technologies in your browser or device, some features may not work and you may not receive credit for qualifying activity.

Exclusions

When we provide your Personal Information to a third-party, such as an Advertiser or Partner in relation to an Offer, that information will be managed according to the third party's own privacy policy, not this Privacy Policy. We recommend that you consult the privacy policies of our Advertisers and Partners for more details on their handling, use, disclosure, transmission, or storage of your Personal Information.

This policy does not cover the practices of companies that Gravy Pass does not own or control, or to individuals that are not employed or managed by Gravy Pass, even if Offers, coupons, or links to their websites may appear within our services.

As a provider of offers and rewards technology, Gravy Pass does not endorse any specific Partner or Advertiser, nor do we assume responsibility for their products or services. We provide the opportunity to engage with Offers and rewards, subject to the applicable terms, validation requirements, and third-party rules.

Your Privacy Rights

Depending on where you live and subject to applicable law, you may have the following rights regarding Personal Information we control:

• Access and Information Rights: You may request access to, or copies of, Personal Information we process or control, along with information about the categories collected, sources, purposes, and categories of recipients.
• Correction: You may request correction of inaccurate Personal Information.
• Deletion: You may request deletion of Personal Information, subject to applicable exceptions.
• Sensitive Information: Where applicable law provides that right, you may request that we limit certain uses of sensitive Personal Information.
• Consent Withdrawal: If you previously consented to receive marketing communications from us, you may withdraw that consent at any time.
• Appeals and Complaints: If you are dissatisfied with our response to a request, you may appeal as described below.
• Non-Discrimination: You will not be discriminated against for exercising any of your privacy rights. However, we may deny certain requests or only partially fulfill them based on our legal rights and obligations.

How to Exercise Your Rights

To exercise any of these rights or if you have questions about these rights or our privacy practices, please contact us via email at privacy@atargrowth.com. You may also designate an authorized agent to make requests on your behalf where permitted by applicable law.

If you are dissatisfied with the response to your request, you can appeal by sending an email to privacy@atargrowth.com with the subject line "Personal Information Requests Appeal".

Please note that different rights may apply to employees, contractors, or job applicants, and are covered under separate privacy notices provided at relevant times.

Opting Out and Unsubscribing

We provide the option for you to opt out of seeing future third-party Advertiser Offers on our sites.

To Opt Out from Advertiser Offers:

Please send an email to privacy@atargrowth.com with the subject "Opt Out". We will keep a copy of your email address on file to maintain a record that you have opted out. If you have used multiple email addresses with our Partners, you will need to opt out separately for each email address to ensure those addresses are removed from future third-party Advertiser Offer flows that we control.

Note: Even after opting out, you may still need to unsubscribe directly from any mailing lists of our Partners or Advertisers to stop receiving electronic communications from them.

Opting Out from Partner Offers:

Opting out from third-party Advertiser Offers does not affect offers from Partners that are native to the Partner's site. You cannot opt out from seeing first-party Partner Offers that are part of the native experience on their sites.

Opting Out of SMS Messages:

If you have opted in to receiving SMS messages from Gravy Pass, you can opt out at any time by: - Texting STOP to (866) 377-1970 - Emailing privacy@atargrowth.com with the subject line "SMS Opt Out" and including the phone number you wish to opt out - Contacting our customer support team

Once you opt out, you will receive a confirmation message, and we will no longer send you SMS messages. Please note that if you have subscribed to SMS messages from multiple Gravy Pass services or campaigns, you may need to opt out of each separately by following the specific opt-out instructions provided in each campaign.

California Privacy Rights

For residents of California, this section supplements the rest of this Privacy Policy and describes our notice at collection and related California privacy disclosures.

Collection and Use of Personal Information

Depending on your interactions with Gravy Pass, we may collect the following categories of Personal Information for business and commercial purposes described in this Privacy Policy:

• Identifiers: Such as your name, email address, phone number, postal address, online identifiers, and account identifiers.
• Personal Information Described in California Civil Code Section 1798.80(e): Such as contact details and other information you provide in connection with account creation, support, or reward-related requests.
• Protected Classification Characteristics: Such as age or date of birth when needed to confirm eligibility.
• Commercial Information: Records relating to Offers you view, request, complete, redeem, reverse, or dispute, as well as related account activity.
• Internet or Other Electronic Network Activity Information: Including browser, device, session, referral, and interaction data associated with your use of the Services.
• Geolocation Data: General location information derived from your IP address, ZIP code, or similar information.
• Professional Information: Such as job title and business contact information if you interact with us on behalf of a business.
• Sensitive Personal Information: Such as account credentials and other information necessary to secure your account or support the Services.
• Inferences: Limited inferences about your likely interests or eligibility based on your interactions with Offers and the Services.

Sources of Personal Information

We collect these categories of Personal Information from the following sources:

• Directly from You: Information you provide during your interactions with us.
• Automatically from Your Devices: As you interact with our services.
• Service Providers: Data collected through external services that support our business.
• Advertisers and Partners: Information shared during your interaction with those entities or their Offers.
• Third-Party Reward or Redemption Providers: Limited status, eligibility, support, or fraud-related information associated with your reward requests.
• Third-Party Data Providers: Including data validation, authentication, analytics, and fraud-prevention providers.
• Corporate Affiliates: Information shared within the Atar Growth corporate family for business operations.

Disclosure of Personal Information

The collected Personal Information may be disclosed to:

• Corporate Affiliates: For consolidated business operations.
• Service Providers: Such as hosting providers, technology vendors, analytics vendors, customer support providers, fraud-prevention providers, and legal advisors.
• Advertisers and Partners: To operate, validate, and fulfill Offers or related communications you request.
• Third-Party Reward or Redemption Providers: To administer reward requests, eligibility checks, fraud reviews, and redemption support.
• Legal Compliance and Protection: Entities involved in legal compliance, fraud prevention, and securing our rights.
• Potential Acquirers: In the event of a business sale or merger.

California Disclosure About Data Disclosures

Atar Growth does not sell Personal Information. We also do not disclose Personal Information for cross-context behavioral advertising. When we disclose information to advertisers, partners, service providers, or third-party reward or redemption providers, we do so to operate the Services, validate Offer participation, prevent fraud, communicate about Offers or rewards you request, or help fulfill rewards and redemptions.

We use and disclose sensitive Personal Information only for permitted purposes, including providing the Services, maintaining account security, preventing fraud, and complying with law.

Age Restrictions

Gravy Pass is intended only for adults age 18 or older who reside in the United States. We do not knowingly collect Personal Information from anyone under 18. If you believe a minor has provided Personal Information to us, please contact privacy@atargrowth.com and we will take appropriate steps to investigate and delete the information as required.

Privacy Concerns and Complaints

We take your concerns very seriously. If you have any concerns or complaints about your privacy or data use, please contact our privacy team for assistance at privacy@atargrowth.com.

Updates to This Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in our privacy practices. Changes will be posted on our website.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact our privacy team at privacy@atargrowth.com.

Version: March 2026