PRIVACY POLICY

Whale Group LTD ("Company," "we," "us," or "our") operates various software products under distinct trade names ("Trading Names"), including our current product Pumio. We are committed to protecting your privacy and ensuring compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable global privacy frameworks.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our websites or use our mobile applications (available on the Apple App Store and Google Play Store).

---

1. Data Controller

For the purposes of all applicable data protection laws, the Data Controller is:

• Entity: Whale Group LTD
• Company Number: 17318249
• Registered Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Email: support@pumio.io

2. Information We Collect

#### A. Information You Voluntarily Provide to Us When you interact with our Services, we may collect:

• Account Information: Name, email address, username, and password during registration.
• User-Generated Content (UGC): Photos, videos, text, or profile information you upload to the platform.

We do not ask you to submit payment card numbers, bank account details, or Payoneer credentials to Whale Group LTD.

#### B. Transaction and Ledger Data (Platform Records) To operate Diamond purchases, in-platform spends, Creator earnings, and payouts, we maintain operational records such as:

• Diamond pack purchases and credits (including store or checkout references where provided by Revolut, Apple, or Google);
• Diamond spends (creator support, Diamond-paid subscriptions, unlocks);
• Creator Pending (Hold) and Available balances, hold release events, and withdrawal requests;
• Limit, fraud-review, and compliance metadata related to earnings clearance and payouts (for example, whether a hold requires additional review).

These records are not payment card data. We do not store full card numbers or Payoneer KYC documents.

#### C. Information Processed by Third Parties (Data We DO NOT Collect or Store) We use specialized third parties for payment and payout processes:

• Payment Card and Checkout Data (Web): We do not collect, process, or store your credit or debit card details. Card payments on the web are handled directly by Revolut through its Merchant API.
• Tax and Invoicing (Web): Quaderno processes tax calculation and customer invoicing for web sales. We do not receive or store full card numbers through Quaderno.
• Mobile In-App Purchases: Diamond pack purchases in our apps are processed entirely by Apple Inc. or Google LLC. We do not receive your card data from those stores.
• Creator Payouts and KYC: Creator identity verification and payout account details are handled entirely by Payoneer when a Creator registers or requests a first withdrawal. We do not receive, view, or store government IDs, bank credentials, or full Payoneer account details. We may receive only non-sensitive status or reference data needed to route payouts.

#### D. Information Collected Automatically

• Device and Usage Data: IP address, device type, operating system version, browser type, and app performance metrics.
• Analytics: We use Google Analytics (GA4) for engagement and conversion insights. See our Cookie Policy for details.

3. How We Use Your Information (Legal Basis)

• To Provide and Maintain Services: Contractual obligation to you as a User.
• To Process Purchases: Coordinating with Revolut (web), Apple/Google (mobile Diamond packs), and Quaderno (web tax/invoicing)—without storing payment credentials ourselves.
• To Operate Diamond Economy and Creator Earnings: Recording purchases, spends, Pending/Available balances, hold releases, and withdrawals (contractual necessity / legitimate interest).
• To Facilitate Creator Payouts: Routing earnings through Payoneer using operational references only (legal obligation / contractual necessity).
• AML, Fraud Prevention, and Enforcement: Applying hold periods, withdrawal limits, and review flags; detecting abuse; enforcing Terms of Service and the Creator Agreement (legitimate interest / legal obligation).
• To Improve Services: Aggregated analytics via Google Analytics (legitimate interest).
• Safety and Compliance: Enforcing content policies (legal obligation / legitimate interest).

4. How Your Data is Shared and Disclosed

We do not sell your personal data. We share information only with approved vendors under confidentiality obligations:

• Revolut: Processes web card payments; holds checkout and payment data.
• Quaderno: Tax calculation and invoicing for web sales.
• Apple and Google: Process mobile in-app Diamond pack purchases.
• Payoneer: Creator identity verification, compliance, and payouts; holds payout credentials and KYC documentation.
• Content Delivery Networks (CDNs): Host media uploaded to the platform.
• Google Analytics: Anonymized or aggregated behavioral data for product insights.
• Legal Disclosure: When required by courts of England and Wales or other valid authorities.

5. Data Retention

• Account and Content Data: Retained while your account is active. After termination (for example, a permanent ban), we may retain identifiers (email, device IDs) to enforce the ban and prevent re-registration.
• Transaction and Ledger Data: Retained as needed to operate the Services, complete payouts, handle disputes/chargebacks, and meet legal and accounting obligations.
• Payment and Payout Credentials: Not stored by Whale Group LTD; retention is governed by Revolut, Apple, Google, and Payoneer policies.
• Media on CDN: Stored while the account is active; deleted according to CDN caching cycles after account deletion.

6. International Data Transfers

As a UK company with a global user base, your data may be processed outside the United Kingdom or EEA (for example, by Revolut, Quaderno, Payoneer, Apple, Google, or Google Analytics). We use appropriate safeguards, including Standard Contractual Clauses where required.

7. Your Privacy Rights (UK GDPR)

If you reside in the United Kingdom or European Union, you may have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Erasure ("right to be forgotten") where applicable.
• Object to or restrict certain processing.
• Data portability where applicable.

Contact support@pumio.io to exercise these rights. You may lodge a complaint with the Information Commissioner's Office (ICO) (www.ico.org.uk).

8. Mobile Platforms and Privacy Consents

• iOS: We comply with Apple's App Tracking Transparency (ATT) and request permission before cross-app tracking for analytics where required.
• Google Play: Data safety disclosures are published in the Google Play Console in line with Google's Developer Program Policies.

9. Changes to This Privacy Policy

We may update this Privacy Policy to reflect regulatory or product changes. The "Last Updated" date at the top will indicate the current version.