NIWERS CALIFORNIA PRIVACY NOTICE

Effective Date: pending — company being formed Version: 2026-05-v1.0

Introduction

This California Privacy Notice supplements our Privacy Policy and applies solely to California residents. It is provided pursuant to:

• The California Consumer Privacy Act of 2018 (CCPA), as amended by
• The California Privacy Rights Act of 2020 (CPRA), codified at California Civil Code § 1798.100 et seq.

This Notice describes how Niwers (Fitcheck LLC d/b/a Niwers, "we", "us") collects, uses, and discloses personal information of California residents and your rights under California law.

1. Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information from California residents (CCPA categories):

2. Sources of Personal Information

We collect personal information from:

• Directly from you — when you create an account, list products, make purchases, communicate, or use features
• Automatically — when you interact with the Niwers Platform (cookies, device IDs, analytics)
• From third parties — authentication providers (Apple, Google), payment processors (Stripe), identity verification services

3. Purposes for Collection

We use personal information for the following business purposes (CCPA-defined):

• Performing services — fulfilling the contract with you (account creation, order processing)
• Auditing customer interactions — quality assurance
• Detecting and protecting against security incidents — fraud, abuse, IP infringement
• Debugging — fixing errors and crashes
• Short-term, transient use — including non-personalized advertising
• Service performance — analytics, A/B testing
• Maintenance and improvement — quality, error correction
• Verification of services or quality
• Internal research — for technical development and demonstration

4. Sale and Sharing of Personal Information

4.1. Niwers Does Not Sell Personal Information for Money

Niwers does not sell your personal information for monetary consideration.

4.2. Possible "Sharing" Under CPRA

The CPRA defines "sharing" broadly to include disclosures for cross-context behavioral advertising, even without monetary exchange.

Currently, Niwers does NOT engage in cross-context behavioral advertising sharing. If we begin in the future, we will:

• Update this Notice
• Provide an opt-out mechanism
• Honor Global Privacy Control (GPC) signals

4.3. Past 12 Months — No Sale or Sharing

In the past 12 months, Niwers has NOT sold or shared personal information of California residents within the meaning of CCPA/CPRA.

4.4. Service Provider Disclosures (Not Sales)

Disclosures to our service providers (Stripe, Cloudflare, Supabase, etc.) for business purposes are not considered sales or sharing under CCPA/CPRA, as they are bound by contract to use information only for our specified purposes.

4.5. Minors

We do not sell or share the personal information of consumers we know to be under 16 without affirmative authorization.

5. Sensitive Personal Information (SPI)

5.1. SPI We Collect

5.2. Use of SPI

We use SPI only as necessary to:

• Provide services you request
• Verify identity (INFORM Act)
• Process payments
• Comply with legal obligations
• Prevent fraud and security incidents

5.3. Right to Limit SPI Use

California residents have the right to limit the use and disclosure of SPI to those purposes set out in CCPA/CPRA § 1798.121.

To exercise this right, contact privacy@niwers.com or use Settings → Privacy Rights → Limit SPI Use.

6. California Consumer Rights

As a California resident, you have the following rights:

6.1. Right to Know (Access)

You may request that we disclose:

• The categories of personal information collected
• The specific pieces of personal information collected about you (verified copy)
• The categories of sources
• The business or commercial purposes
• The categories of third parties to whom we disclose information

You can request information for the past 12 months (or longer for certain Sellers' tax records).

6.2. Right to Delete

You may request deletion of personal information.

Exceptions (we may retain information to):

• Complete a transaction in progress
• Detect security incidents, prevent fraud
• Exercise free speech (CCPA-protected)
• Comply with legal obligations (tax retention, INFORM Act records, court orders)
• Internal uses reasonably aligned with consumer expectations

6.3. Right to Correct

You may request correction of inaccurate personal information.

6.4. Right to Opt-Out of Sale or Sharing

You may opt out of any future sale or sharing of personal information.

Currently, Niwers does not sell or share personal information. When/if we do:

• A "Do Not Sell or Share My Personal Information" link will be displayed
• We will honor Global Privacy Control (GPC) signals

6.5. Right to Limit SPI Use

See Section 5.3.

6.6. Right to Data Portability

You may request a copy of your personal information in a portable, machine-readable format (e.g., JSON or CSV).

6.7. Right to Non-Discrimination

We will not:

• Deny services
• Charge different prices
• Provide different quality of services
• Suggest different services

based on your exercise of CCPA rights.

6.8. Right to Limit Retention

We retain information only as long as reasonably necessary, as detailed in our Privacy Policy.

7. How to Exercise Your California Rights

7.1. Two Designated Methods

Method 1: In-App Privacy Portal

• Open the Niwers app or website
• Go to Settings → Privacy Rights
• Select the right you want to exercise
• Submit the request

Method 2: Email

• Send to privacy@niwers.com
• Subject: "California Privacy Rights Request"
• Include: your full name, account email, the specific right(s) you wish to exercise
• For verification, you may need to confirm specific account details

7.2. Verification

We will verify your identity by:

• Matching information you provide with our records
• For sensitive requests (Right to Know, Specific Pieces, Delete): possible additional verification (e.g., signed declaration under penalty of perjury)

7.3. Authorized Agents

You may designate an authorized agent to make requests on your behalf:

• Provide written authorization signed by you
• Verify the agent's identity
• Verify your identity directly

7.4. Response Times

We will:

• Acknowledge receipt within 10 business days
• Respond within 45 calendar days (with possible extension of 45 additional days, with notice)
• For requests we cannot fulfill, we will explain why

7.5. No Fees

Verifying and responding to your requests is free, except in cases of manifestly unfounded or excessive requests.

8. Notice at Collection

Pursuant to California Civil Code § 1798.100(b):

At or before the point of collection, we provide notice of:

• The categories of personal information we collect
• The purposes for collection
• Whether information is sold or shared (currently no)
• The retention periods (or criteria)
• Where to view this Notice

This Privacy Notice serves as our Notice at Collection.

9. Financial Incentive Programs

Niwers does not currently offer financial incentives or price/service differences in exchange for personal information.

10. Children Under 16

We do not knowingly:

• Sell or share personal information of California consumers under 16
• Collect personal information from California residents under 13 (also COPPA)

For users 13–16, we obtain affirmative authorization before any sale or sharing (currently not applicable).

11. Annual CCPA Metrics

In compliance with CCPA's metrics disclosure requirement (for businesses processing 10M+ Californians' data), Niwers will publish annual privacy metrics if/when we meet the threshold.

12. Categories of Recipients (Past 12 Months)

We have disclosed personal information to the following categories of third parties for business purposes:

• Service providers (Stripe, Cloudflare, Supabase, Sentry, Resend, customer support)
• Other Users (public profile information, posts)
• Sellers and Buyers (transaction-related information)
• Government and law enforcement (in response to valid legal process)
• Affiliates (within the Niwers corporate group, if applicable)

13. Updates to This Notice

We update this Notice as required by law and operations. Last Updated date reflects most recent revision. Material changes will be communicated.

14. Contact Us

15. California Resident Verification

To exercise rights, you may need to confirm:

• Your registered email address
• Phone number on file
• Recent transaction details (for verified requests)
• Signed declaration under penalty of perjury (for sensitive requests)

Version: 2026-05-v1.0 Effective Date: pending — company being formed