This Privacy Notice for Pengine LLC (doing business as Pengine) ("we," "us," or "our") describes how and why we collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://pengine.io or any website of ours that links to this Privacy Notice.
• Use the Pengine platform. Pengine is a software platform that enables users to create and manage print-on-demand products through integration with their Shopify store and other supported e-commerce platforms. Users can upload custom designs and apply them to physical products offered through the platform. When a customer places an order through the user's connected store, the order is transmitted to Pengine's system and forwarded to third-party production partners, who handle printing, packaging, and shipment to the end customer.
• Engage with us in other related ways, including any sales, marketing, or events.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have questions or concerns, please contact us at admin@pengine.io.

This summary provides key points from our Privacy Notice. You can find more detail on any topic using the table of contents below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the features you use.

Do we process any sensitive personal information? We do not process sensitive personal information.

Do we collect any information from third parties? We may obtain contact information about prospective customers (leads) from third-party sources to support our marketing and outreach. We do not collect information about our existing users from outside sources.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for marketing and advertising, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific categories of third parties, including for targeted advertising. See the section on sharing below.

How do we keep your information safe? We use reasonable organizational and technical measures to protect your personal information. However, no electronic transmission or storage can be guaranteed to be 100% secure.

What are your rights? Depending on your state of residence, applicable privacy law may give you certain rights regarding your personal information.

How do you exercise your rights? The easiest way is by contacting us at admin@pengine.io. We will consider and act on any request in accordance with applicable data protection laws.

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register on the Services, express interest in our products and Services, participate in activities on the Services, or otherwise contact us. The personal information we collect may include:

• Names
• Phone numbers
• Email addresses
• Usernames and passwords
• Billing addresses

Sensitive information. We do not process sensitive information.

Payment data. When you make purchases, payment is processed by Stripe, our third-party payment processor. Payment card details are collected and stored by Stripe, not by Pengine. You may review Stripe's privacy notice at https://stripe.com/privacy.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information, such as your IP address and/or browser and device characteristics, is collected automatically when you use our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, country, and information about how and when you use our Services. This information is primarily needed to maintain the security and operation of our Services and for our internal analytics and reporting. We also collect information through cookies and similar technologies, as described in Section 4.

This information includes:

• Log and usage data. Service-related, diagnostic, usage, and performance information our servers automatically collect, such as your IP address, device information, browser type, timestamps, pages and features used, and error reports.
• Device data. Information about the computer, phone, tablet, or other device you use to access the Services, such as IP address, device identifiers, browser type, hardware model, operating system, and internet service provider.

Information we obtain from other sources

In Short: We obtain contact information about prospective customers from third-party sources for marketing and outreach.

To support our marketing and business-development efforts, we may obtain contact information about prospective customers ("leads") from third-party sources, such as lead-generation providers, marketing partners, and publicly available sources. This information is generally limited to business contact details and may include names, business email addresses, phone numbers, job titles, and company information. We use this information to market our Services and to reach out to prospective customers. We do not use these sources to collect or supplement information about our existing users.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for marketing and advertising, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including to:

• Facilitate account creation and authentication and otherwise manage user accounts.
• Deliver and facilitate delivery of services to the user.
• Respond to user inquiries and offer support to users.
• Send administrative information to you, such as changes to our terms and policies.
• Fulfill and manage your orders, including the payments, returns, and exchanges made through the Services.
• Send marketing and promotional communications and conduct outreach. We may process your information, including contact information for prospective customers obtained from third-party sources, to send marketing communications and reach out about our Services, in accordance with applicable marketing preferences. You can opt out at any time (see Section 8).
• Market our Services and measure our advertising. We may process your information, including through the Meta Pixel and the Google Ads tag on our website, to promote Pengine, measure how our advertising performs, and show you our ads on other websites and platforms. See Section 4.
• Protect our Services, including fraud monitoring and prevention.
• Identify usage trends and measure marketing effectiveness so we can improve our Services and campaigns.

In Short: We may share information in specific situations described below and/or with the following categories of third parties.

Vendors, consultants, and other third-party service providers. We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us and require access to such information to do that work. We have contracts in place with these third parties designed to safeguard your personal information; they may not use it for purposes other than those we instruct.

The categories of third parties we may share personal information with include:

• Ad networks
• Data analytics services
• Communication and collaboration tools
• Order fulfillment service providers (our production partners)
• Payment processors
• Sales and marketing tools
• User account registration and authentication services
• Website hosting and cloud computing services
• Performance monitoring tools
• Finance and accounting tools
• Data storage service providers

We may also share your personal information in the following situations:

• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.
• Affiliates. We may share your information with our affiliates, in which case we will require them to honor this Privacy Notice. Affiliates include our parent company and any subsidiaries or companies under common control with us.
• Business partners. We may share your information with our business partners to offer you certain products, services, or promotions.

In Short: We use cookies and similar technologies to operate our Services, analyze usage, and deliver advertising.

We use cookies and similar tracking technologies (such as web beacons and pixel tags) to collect and store information when you interact with our Services. We use the following categories:

• Essential cookies that are necessary to operate the Services, maintain security, prevent crashes, and remember your preferences.
• Analytics cookies that help us understand how the Services are used so we can improve them. We use Google Analytics for this purpose. To opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout.
• Advertising and conversion-tracking technologies, including the Meta Pixel and the Google Ads tag, that we and the advertising platforms we work with, including Meta and Google, use to measure how our advertising performs, understand which visitors take action after seeing our ads, and show you our ads on other websites and platforms (retargeting).

To the extent these advertising and targeting technologies are deemed a "sale" or "sharing" (including targeted advertising, as defined under applicable US state laws), you can opt out as described in Section 10. We also honor the Global Privacy Control (GPC) opt-out signal. Most web browsers are set to accept cookies by default; you can usually adjust your browser settings to remove or reject cookies, though doing so may affect certain features of the Services.

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if that is not possible (for example, because it is stored in backup archives), we will securely store it and isolate it from further processing until deletion is possible.

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the personal information we process. However, despite our safeguards, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot guarantee that unauthorized third parties will never be able to defeat our security and improperly access your information. Transmission of personal information to and from our Services is at your own risk, and you should only access the Services within a secure environment.

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18, or that you are the parent or guardian of such a minor and consent to that minor's use of the Services. If we learn that personal information from users under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data. If you become aware of any data we may have collected from children under 18, please contact us at admin@pengine.io.

In Short: You may review, change, or terminate your account at any time, and depending on your state of residence you may have additional rights described in Section 10.

Account information. If you would at any time like to review or change the information in your account or terminate your account, you can log in to your account settings and update your user account. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and/or comply with applicable legal requirements.

Opting out of marketing communications. You can unsubscribe from our marketing and promotional communications at any time by clicking the unsubscribe link in our emails, replying "STOP" or "UNSUBSCRIBE" to our SMS messages, or contacting us at admin@pengine.io. You will then be removed from our marketing lists. We may still communicate with you for non-marketing purposes, such as service-related messages necessary for the administration of your account.

Withdrawing consent. If we are relying on your consent to process your personal information, you have the right to withdraw that consent at any time by contacting us at admin@pengine.io or updating your preferences. This will not affect the lawfulness of processing before its withdrawal.

If you have questions or comments about your privacy rights, you may email us at admin@pengine.io.

Most web browsers and some mobile operating systems and applications include a Do-Not-Track ("DNT") feature you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals. California law requires us to disclose that, because there is currently no industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have specific rights regarding your personal information. These rights may be limited in some circumstances by applicable law.

Categories of personal information we collect

The table below shows the categories of personal information we have collected within the past twelve (12) months.

We will use and retain the collected personal information in Categories A, B, D, and F for as long as the user maintains an account with us. We retain prospective-customer lead information (Categories A and I) until it is no longer relevant for our marketing purposes or the individual opts out, whichever occurs first.

Sources of personal information. We collect personal information directly from you, automatically through your use of the Services, and (for prospective-customer leads only) from third-party sources such as lead-generation providers, marketing partners, and publicly available sources. See Section 1 for more detail.

How we use and share personal information

We share your personal information with advertising platforms through the Meta Pixel and the Google Ads tag on our website, as described in Section 4.

We may use your personal information for our own business purposes, such as undertaking internal research for technological development and demonstration. This is not considered "selling" of your personal information.

In the preceding twelve (12) months, we have shared the following categories of personal information with third parties for targeted advertising purposes: Category A (Identifiers), Category D (Commercial information), and Category F (Internet or other similar network activity). We have also disclosed these categories to service providers for business purposes. The categories of third parties to whom we disclose personal information are described in Section 3.

Your rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law. These rights include:

• The right to know whether we are processing your personal data.
• The right to access your personal data.
• The right to correct inaccuracies in your personal data.
• The right to request deletion of your personal data.
• The right to obtain a copy of the personal data you previously shared with us.
• The right to non-discrimination for exercising your rights.
• The right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Depending on the state where you live, you may also have additional rights, such as the right to obtain a list of the categories of third parties to which we have disclosed personal data, and the right to limit the use and disclosure of sensitive personal data.

How to exercise your rights

To exercise these rights, you can contact us by emailing admin@pengine.io or by referring to the contact details at the bottom of this document. We will honor your opt-out preferences if you enact the Global Privacy Control (GPC) opt-out signal on your browser.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof of valid authorization to act on your behalf.

Request verification. Upon receiving your request, we will need to verify your identity to confirm you are the person about whom we have information. We will only use personal information provided in your request to verify your identity. If we cannot verify your identity from the information already maintained by us, we may request additional information for verification and fraud-prevention purposes.

Appeals. If we decline to take action regarding your request, you may appeal our decision by emailing us at admin@pengine.io. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" law. California Civil Code Section 1798.83 permits our users who are California residents to request, once a year and free of charge, information about the categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of those third parties in the immediately preceding calendar year. To make such a request, please contact us at admin@pengine.io.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to stay informed of how we protect your information.

If you have questions or comments about this notice, you may email us at admin@pengine.io or contact us by post at:

Pengine LLC [Company address]

Based on the applicable laws of your state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please email us at admin@pengine.io.