Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Vadera Capital Corporation ("Vadera," "we," "us," or "our") collects, uses, shares, and protects information when you use our website, mobile and web applications, the Pulse analytics features, and related services (collectively, the "Services"). It applies to anyone who creates an account, connects a third-party account, or otherwise uses the Services.

Vadera is a financial technology company and is not a bank. Banking services, where offered, are provided by our sponsor bank partner. This Policy governs Vadera's own processing of your information and should be read together with our Terms of Service.

By using the Services, you agree to this Policy. If you do not agree, do not use the Services.

2. Definitions

Personal Information

Information that identifies, relates to, or could reasonably be linked to you or your account.

Connected Account Data

Data from a social media or other third-party account you connect to Vadera through official authorization (OAuth), accessed on a read-only basis and with your consent.

De-Identified and Aggregated Data

Data that has been stripped of identifiers and pooled across users so that it no longer identifies, and cannot reasonably be used to identify, any individual or account.

Platform

A third-party service you authorize Vadera to connect to, such as Instagram, Facebook, TikTok, LinkedIn, YouTube, or X.

Pulse / Pulse Score

Vadera's proprietary analytics metric and the features that produce it.

3. Information We Collect

3.1 Information you provide. Account registration details such as name, email, phone number, and password; profile information; business information; communications you send us; and information you submit for support, verification, or banking enrollment.

3.2 Connected Account Data. When you connect a Platform, we receive data from that Platform through official OAuth authorization, on a read-only basis, limited to the scopes you approve. This may include your own content performance, audience and engagement metrics, follower counts, account metadata, and similar first-party signals from the account you control. We access only the account data you authorize. We do not scrape Platforms, and we do not collect or rank data about people who have not connected and consented.

3.3 Banking and verification information. Where you enroll in banking or verification features, we and our partners may collect identity, financial, and "know your customer" information as required by law and by the sponsor bank partner. That processing is also governed by the partner's disclosures.

3.4 Automatically collected information. Device, browser, and usage information; IP address; log data; and similar technical information collected through cookies and comparable technologies to operate, secure, and improve the Services.

4. Platform-Specific Disclosures

Connected Account Data is obtained and used in accordance with each Platform's developer terms and policies. For every Platform, the following applies: access is through official OAuth, read-only, limited to authorized scopes, and revocable by you at any time. If you revoke a Platform's authorization, or its token lapses, that Platform's inputs leave your Pulse Score and we stop accessing new data from it.

• Meta (Instagram / Facebook): We use Meta Platform Data only as permitted by Meta Platform Terms and Developer Policies, and we do not sell or transfer it to data brokers.
• TikTok: We use TikTok API data only as permitted by TikTok Developer Terms and do not sell, share, or transfer it to third parties or data brokers.
• LinkedIn: We use LinkedIn member data only as permitted by the LinkedIn API terms and do not sell, rent, or transfer it.
• YouTube / Google: Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google API data or use it for advertising.
• X (Twitter): We use X data only as permitted by the X Developer Agreement and Policy and do not redistribute or sell it off-platform.

GOOGLE / YOUTUBE LIMITED USE: Vadera's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Additional Platforms may be added over time. When a Platform is added, this section is updated and the same commitments apply: official OAuth, read-only, scope-limited, revocable, and used in accordance with that Platform's terms.

5. How We Use Information

We use the information described above to:

• operate your account and provide the Services;
• compute, display, and improve your Pulse Score and related analytics, insights, and Standing;
• provide business tools and, where applicable, banking and verification features through our partners;
• communicate with you, provide support, and send service and, where permitted, marketing messages about our own products;
• maintain security, prevent fraud and abuse, and enforce our terms;
• develop, test, and improve the Services and build new features and products;
• create De-Identified and Aggregated Data as described in Section 6; and
• comply with legal obligations and protect our rights and the rights of others.

6. De-Identified and Aggregated Data

We create De-Identified and Aggregated Data from the data we hold. This is data that has been stripped of identifiers and pooled across many users so that it no longer identifies, and cannot reasonably be used to identify, any individual or account. We produce it to a defined internal standard that includes minimum cohort sizes and the removal of any field that could single out a person.

We may use, retain, analyze, share, license, and sell De-Identified and Aggregated Data and products derived from it - including benchmark reports, industry trend datasets, anonymized percentile bands and Standing surfaces, and modeled insights - for any lawful business purpose, including commercial purposes, without further notice to you. Because this data does not identify you, it is not treated as Personal Information.

WHAT WE NEVER DO: We do not sell, rent, license, or transfer your identifiable Connected Account Data, or other identifiable Personal Information obtained through a Platform's API, to third parties. Our commercialization is limited to De-Identified and Aggregated Data and the products derived from it.

By using the Services and connecting your accounts, you agree that your data may be used in de-identified, aggregated form to build, operate, improve, and commercialize Vadera products and benchmarks, while your identifiable platform data is never sold.

7. How We Share Information

We share Personal Information only as described below:

• Service providers - vendors and processors who perform services for us (hosting, analytics, communications, payments, identity verification, customer support) under contracts that limit their use of the data to providing those services.
• Banking partners - our sponsor bank partner and related financial-infrastructure providers, where you use banking or verification features, as needed to deliver those features and meet legal requirements.
• Legal and compliance - to comply with law, regulation, legal process, or enforceable governmental request; to enforce our terms; and to detect, prevent, or address fraud, security, or technical issues.
• Corporate transactions - in connection with a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a successor policy.
• With your direction - we share information with third parties when you direct us to or otherwise consent.

We do not share identifiable Connected Account Data for the purpose of a third party's own independent commercial exploitation or resale.

8. Data Retention

We retain Personal Information for as long as your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. When you revoke a Platform authorization or it lapses, that Platform's inputs are removed from your live Pulse Score. When you delete your account, we delete or de-identify Personal Information within a reasonable period, except where retention is required by law or for legitimate business records. De-Identified and Aggregated Data may be retained and used indefinitely.

9. Security

We use administrative, technical, and physical safeguards designed to protect Personal Information. No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for activity under your account.

10. Your Rights and Choices

• Disconnect accounts - disconnect any Platform at any time through your account settings or the Platform itself. This stops further access and removes that Platform's inputs from your live score.
• Access and deletion - request access to, correction of, or deletion of your Personal Information, subject to legal limits.
• Marketing - opt out of marketing communications using the unsubscribe mechanism in those messages.
• Cookies - manage cookies through your browser settings.

To exercise these choices, contact support@vaderacapital.com. We will respond as required by applicable law.

11. State Privacy Rights (United States)

Depending on where you live, you may have additional rights under state privacy laws, including the California Consumer Privacy Act as amended (CCPA/CPRA) and comparable statutes. These may include the right to know what Personal Information we collect, to access or delete it, to correct it, and to opt out of certain processing.

De-Identified and Aggregated Data is not Personal Information and is handled as described in Section 6. To the extent any of our processing is treated as a "sale" or "sharing" of Personal Information under applicable state law, you may opt out by contacting support@vaderacapital.com or using any opt-out mechanism we make available. We honor opt-out preference signals where required.

We do not knowingly process the Personal Information of California residents under 16 for sale or sharing without required consent.

12. Children

Age requirements vary by feature. Banking and financial features are intended for users 18 and older. Pulse and social analytics features are available to users who meet the minimum age required by the third-party Platform they are connecting — for example, users who are old enough to hold an Instagram, TikTok, or other supported social media account under that platform's own terms. We do not knowingly collect Personal Information from children under 13. If we learn that we have collected Personal Information from a child under 13 without verifiable parental consent, we will delete it promptly. Users between 13 and 17 may only use Pulse and social analytics features and may not access banking or financial features.

13. International Users and Data Location

Vadera is based in the United States and our primary infrastructure is hosted in Helsinki, Finland. If you access the Services from outside the United States, you understand that your information may be transferred to, stored in, and processed in the United States, Finland, and other locations with data-protection laws that differ from those in your jurisdiction. By using the Services, you consent to these transfers.

14. Changes to This Policy

We may update this Policy from time to time. The "Effective Date" above reflects the latest version. Material changes will be communicated through the Services or by other reasonable means. Your continued use after an update constitutes acceptance of the revised Policy.