Eyozi State Privacy Rights Supplement

Effective Date: August 6, 2026 Last Updated: August 6, 2026

This Supplement forms part of the Eyozi Privacy Policy and provides disclosures required by specific state laws. Terms used here have the meanings given in the main Privacy Policy.

1. Our Baseline: Rights for Every User

Rather than granting different rights depending on where you live, Eyozi extends the same core rights to every user in the United States. Some state laws only apply to companies above certain size thresholds, and some may not currently apply to Eyozi. We grant these rights regardless.

Every Eyozi user may:

• Access their personal information and receive a copy
• Correct inaccurate information
• Delete their personal information, subject to the safety-related exceptions in Section 10.1 of the Privacy Policy
• Port their data in a machine-readable format
• Limit the use of sensitive information to what is necessary to provide the Services
• Withdraw consent previously given
• Appeal a denied request
• Not be discriminated against for exercising any of these rights

Submit any request to info@eyozi.life. We respond within 45 days.

2. Disclosures Applicable to All Users

2.1 Sale and Sharing

Eyozi does not sell personal information. Eyozi does not share personal information for cross-context behavioral advertising or targeted advertising. Eyozi does not process personal information for profiling in furtherance of decisions producing legal or similarly significant effects. Eyozi displays no advertising.

None of this has occurred in the preceding twelve months.

Because we do not sell or share for advertising, we do not maintain a "Do Not Sell or Share My Personal Information" link — there is nothing to opt out of. We nonetheless honor Global Privacy Control (GPC) and other universal opt-out signals where technically feasible.

2.2 Sensitive Data

We process sensitive data only as necessary to provide the Services you requested and to operate the safety features you enabled. See Privacy Policy Section 7.

Several states require opt-in consent before processing sensitive data. By enabling a feature that requires sensitive data — such as logging a check-in, entering your city, or turning on the Morning Check-In Safety System — you provide that consent. You may withdraw it at any time by disabling the feature, deleting the data, or closing your account.

Biometric information is treated separately, and requires your written release. It is processed only if you choose to purchase the Power Plan, only for determining whether you are 18 or older, and only by our verification provider. Before any facial scan is captured, we show you what is collected, the purpose, and how long it is kept, and you must affirmatively agree by ticking a box. We record that you agreed and when. Beginning the check is not by itself treated as consent, and the check cannot start until the release is given. You may decline simply by not purchasing the Power Plan — which costs you nothing you already have. See Section 2.4 and Section 7.1 of the Privacy Policy.

2.3 Categories of Information — Collected, Disclosed, Sold

Note on the three age verification rows. These apply only to consumers who choose to purchase the paid Power Plan. Telson Media never receives or stores the facial image, the facial geometry template, the identity document, or the date of birth — the verification provider captures them directly and reports back only whether the consumer is 18 or older. Free Standard Plan accounts are never subject to any of it. See Section 7.1 of the Privacy Policy.

2.4 Biometric Information

Several states regulate biometric identifiers specifically, separately from their general privacy laws. This section states our practices in the terms those laws use.

Purpose. A facial scan and the facial geometry derived from it are collected for one purpose: determining whether a consumer is 18 years of age or older before selling them access to the Power Plan. They are not used for identification, authentication, security, surveillance, profiling, advertising, or the training of any artificial intelligence or machine learning model.

Term. Collection occurs once. Once a consumer has been determined to be 18 or older, the check is never repeated.

No sale, no profit. We do not sell, lease, trade, or otherwise profit from biometric information. We have never done so.

No disclosure. We do not disclose biometric information to any party other than the verification provider that captures it. We would do so only with the consumer's consent, or where compelled by valid legal process or by law.

What we hold. Telson Media holds no biometric information at all. We hold only the outcome of the check, its date, the method used, and a reference number.

Retention and destruction. Our verification provider retains the facial image, the facial geometry template, and any identity document for 6 months from the date of the check, and then destroys them. Its retention is in every case further capped by applicable biometric-privacy law where that law requires earlier destruction. A consumer may request deletion before the 6 months elapse by emailing info@eyozi.life.

Telson Media holds no biometric information at any point, and after 6 months none exists at our provider either.

Consumers who never purchase the Power Plan are never subject to any biometric collection.

2.5 Users Aged 13 to 17

An Eyozi account requires a minimum age of 13. A user aged 13 to 17 may hold a free Standard Plan account only, and only with the agreement of a parent or legal guardian as required by Section 3.1 of the Terms and Conditions.

Several states impose additional duties regarding minors. Our practices are the same in every state:

• We do not sell or share the personal data of any user, of any age, for any purpose. We display no advertising and use no targeted advertising.
• We do not profile minors for decisions producing legal or similarly significant effects.
• We do not collect precise geolocation from any user, of any age.
• Every feature that exposes a user to other people is closed to minors. Community Discovery, messaging, and Meetups require the Power Plan, which requires verified proof of being 18 or older. A minor cannot be seen by another user, contacted by one, or arrange to meet one.
• No minor is subject to biometric collection, because a minor cannot purchase the Power Plan.

A parent or legal guardian may email info@eyozi.life to review, correct, or delete their minor's personal data, or to close the account. We verify these requests before acting on them.

3. State-Specific Provisions

California

Applicable law: California Consumer Privacy Act, as amended by the CPRA.

• All rights in Section 1 apply, plus the right to know categories and specific pieces of personal information collected, sources, business purposes, and categories of third parties.
• Right to limit use and disclosure of sensitive personal information. We use sensitive personal information only for purposes permitted without a right to limit — namely, to provide the Services you requested, to ensure security and integrity, and to perform services on our own behalf. We do not use it to infer characteristics about you.
• Biometric information. Under the CCPA, biometric information is "sensitive personal information" when processed for the purpose of uniquely identifying a consumer. We do not process it for that purpose. The facial scan is used only to determine whether a consumer is 18 or older, never to identify anyone. We apply the limits in Section 2.4 regardless.
• Consumers under 16. We do not sell or share the personal information of any consumer, and we have no actual knowledge of selling or sharing the personal information of a consumer under 16. Our Power Plan, and therefore every feature involving other users, is closed to anyone under 18.
• Shine the Light (Civ. Code §1798.83): we do not disclose personal information to third parties for their own direct marketing purposes.
• No financial incentives. We do not offer financial incentives or price differences in exchange for personal information.
• Notice of Right to Opt Out: not applicable — we do not sell or share personal information.
• California residents may also have rights under California's consumer health data provisions; see our Consumer Health Data Privacy Policy.
• Complaints: California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General (oag.ca.gov/contact/consumer-complaint-against-business-or-company).

Washington

Applicable law: My Health My Data Act (RCW 19.373).

This law applies to Eyozi regardless of company size and provides Washington consumers with a private right of action. Full disclosures required by this Act appear in our separate Consumer Health Data Privacy Policy, which is a standalone notice as the Act requires.

Key points: we do not sell consumer health data; we do not use geofencing; and Washington consumers may confirm, access, withdraw consent, and delete consumer health data.

Biometric identifiers — H.B. 1493 (RCW 19.375). The facial scan used for Power Plan age verification is not enrolled in any database for the purpose of identifying an individual. It is used solely to determine whether a consumer is 18 or older, is never sold or leased, and is described in Section 2.4. Washington consumers who do not purchase the Power Plan are never subject to it.

Complaints: Washington State Attorney General, atg.wa.gov/file-complaint.

Illinois

Applicable law: Biometric Information Privacy Act, 740 ILCS 14 ("BIPA").

Illinois has no comprehensive consumer privacy law, but BIPA governs biometric identifiers and biometric information and provides Illinois residents with a private right of action. It applies to Eyozi only where an Illinois resident purchases the Power Plan and completes the age check.

• Written release, obtained before collection. Before any facial image is captured, we display in writing that a scan of facial geometry is being collected, the specific purpose, and the length of term, and the consumer must affirmatively agree by ticking a box. The check cannot begin until they do. We record the fact of that agreement, the date and time, and the version of the notice shown. This release is obtained from every consumer who begins an age check, not only Illinois residents.
• The biometric identifier collected is a scan of facial geometry, derived from a facial image captured during age verification.
• The purpose is to determine whether the consumer is 18 years of age or older. It is used for no other purpose.
• The term is a single collection. The check is not repeated once a consumer has passed.
• Telson Media does not itself possess, store, or transmit any biometric identifier. It is captured by our verification provider, which is contractually restricted to processing it on our behalf and for that purpose alone.
• We do not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.
• We do not disclose biometric identifiers except to that provider, or with consent, or as compelled by valid legal process.
• Retention schedule and destruction guidelines. The facial image and the scan of facial geometry are retained by our verification provider for 6 months from the date of the check, and are then permanently destroyed. They are destroyed sooner if the consumer requests it, or if the purpose for collecting them is satisfied earlier. No biometric identifier is retained beyond 6 months for any reason.

An Illinois resident who does not purchase the Power Plan is never subject to biometric collection of any kind.

Complaints and requests: info@eyozi.life. Illinois residents may also contact the Illinois Attorney General at illinoisattorneygeneral.gov.

Nevada

Applicable law: Nevada SB 370 (consumer health data) and NRS 603A.

• We do not sell consumer health data. Nevada consumers may submit a verified opt-out request at info@eyozi.life, though no sale occurs.
• Consumer health data disclosures appear in our Consumer Health Data Privacy Policy.
• We do not use geofencing.

Colorado

Applicable law: Colorado Privacy Act.

• All rights in Section 1 apply.
• We obtain opt-in consent before processing sensitive data.
• We honor universal opt-out mechanisms, including Global Privacy Control.
• Appeals: as described in Privacy Policy §12.5. If an appeal is denied, you may contact the Colorado Attorney General at coag.gov/file-complaint.

Connecticut

Applicable law: Connecticut Data Privacy Act, as amended effective July 1, 2026.

• All rights in Section 1 apply.
• Opt-in consent required for sensitive data, including consumer health data.
• We honor universal opt-out mechanisms.
• Connecticut's consumer health data provisions apply; see our Consumer Health Data Privacy Policy.
• Complaints: Connecticut Attorney General, portal.ct.gov/AG.

Virginia

Applicable law: Virginia Consumer Data Protection Act.

• All rights in Section 1 apply. Opt-in consent required for sensitive data.
• Appeals: if denied, contact the Virginia Attorney General at oag.state.va.us.

Texas

Applicable law: Texas Data Privacy and Security Act.

• All rights in Section 1 apply. Texas has no revenue threshold for applicability.
• Opt-in consent required for sensitive data.
• Required notice: "We do not sell your sensitive personal data. We do not sell your biometric personal data." Both statements are accurate. We do not sell any personal data of any kind.
• Capture or Use of Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code §503.001. A facial scan is captured for Power Plan age verification only, for the sole purpose of determining whether you are 18 or older, as described in Section 2.4. We do not sell, lease, or otherwise disclose it except to our verification provider, with your consent, or as permitted by law.
• Complaints: Texas Attorney General, texasattorneygeneral.gov/consumer-protection.

Oregon

Applicable law: Oregon Consumer Privacy Act.

• All rights in Section 1 apply, plus the right to obtain a list of the specific third parties to whom we have disclosed personal data. Request at info@eyozi.life.
• Opt-in consent required for sensitive data. Universal opt-out signals honored.

Maryland

Applicable law: Maryland Online Data Privacy Act.

• All rights in Section 1 apply.
• Maryland prohibits the sale of sensitive personal data entirely. We do not sell any personal data, sensitive or otherwise.
• We limit collection of personal data to what is reasonably necessary to provide the Services.

Minnesota

Applicable law: Minnesota Consumer Data Privacy Act.

• All rights in Section 1 apply, plus the right to question the result of profiling, to be informed of the reasons for a profiling decision, and to review the personal data used.
• Minnesota consumers may request a list of specific third parties to whom personal data was disclosed.
• Regarding Trust Scores, see Privacy Policy §13.

Delaware, New Hampshire, New Jersey, Montana, Nebraska, Tennessee, Iowa, Utah, Indiana, Kentucky, Rhode Island

These states have comprehensive consumer privacy laws providing rights substantially similar to those in Section 1, which Eyozi grants to all users.

Where these laws provide additional or differing rights — including opt-in consent for sensitive data, recognition of universal opt-out mechanisms, and rights of appeal — Eyozi honors them. Residents may direct complaints to their state Attorney General.

All Other States

If you live in a state not listed above, you still have every right described in Section 1. We apply the same standard nationwide.

4. Changes to This Supplement

State privacy laws change frequently. We review this Supplement at least annually and whenever a new state law affecting Eyozi users takes effect. Material changes are notified as described in Privacy Policy §17.

5. Contact

info@eyozi.life — include your state of residence so we can apply the correct requirements.