Baela Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Baela LLC ("Baela," "we," "us," or "our") collects, uses, shares, and protects personal information in connection with the Baela platform, including our website and mobile applications at baela.app and related services (collectively, the "Service").

Baela is a provider-first, two-sided online marketplace and software platform that connects independent beauty and wellness professionals ("Providers") with clients who book their services ("Clients"). Bookings take place at a Provider's location or as a mobile or in-home visit. The Service is intended for users who are at least 18 years old.

This Privacy Policy applies to all users of the Service, including Providers, Clients, and visitors. It explains the categories of information we collect, how we use and share that information, and the rights and choices available to you. It does not apply to the practices of third parties that we do not own or control, including third-party services that you access through the Service.

Our Role as a Controller

For the personal information we collect through the Service, Baela acts as a "controller" or "business" (as those terms are defined under applicable privacy laws), meaning we determine the purposes and means of processing that information. We engage service providers and processors who process certain personal information on our behalf and under our instructions, as described below. In some cases, third parties (such as our payment processor and our consumer reporting agency) act as independent controllers or businesses with respect to information they collect or generate; their handling of that information is governed by their own privacy policies and applicable law.

Because Baela is pre-launch, this Privacy Policy describes our intended practices. We will update it as the Service develops and as we finalize the bracketed items above.

2. Information We Collect

We collect information that you provide directly, information generated through your use of the Service, and information we receive from third parties such as our payment processor, identity verification vendors, and consumer reporting agencies. The table below summarizes the principal categories. The subsections that follow provide additional detail.

2.1 Account and Profile Information

When you create an account, we collect information such as your name, email address, phone number, password, and profile photo. If you register as a Provider, we also collect business details, including the services you offer, your prices, your service area, and your location mode (for example, whether you serve Clients at your own location, as a mobile or in-home visit, or both).

2.2 Identity and Verification Information (KYC)

To verify identity and to meet legal, regulatory, and payment-network requirements, we collect identity verification information. This may include a government-issued identification document and related verification data. Identity verification is collected and processed mainly for Providers through our payment processor and/or a third-party identity verification vendor, and may also involve light identity verification for Clients in certain cases. Some of this information may be processed directly by these vendors on our behalf or as independent controllers.

2.3 Background-Check Information (Providers)

For Providers, we obtain background-check information in the form of consumer report data from a third-party consumer reporting agency ("CRA"), with the Provider's consent. This may include criminal records, identity verification records, and other information permitted by law. See Section 5 (Background Checks and the FCRA) for details on how this information is handled and the rights that apply.

2.4 Booking and Transaction Information

When bookings are made through the Service, we collect information about the services booked, appointment times, service locations and addresses (including a Client's address for in-home visits), amounts charged, deposits, payouts, and tips.

2.5 Payment Information

Payments are processed by a third-party payment processor (Stripe). We receive limited payment metadata, such as transaction amounts, status, and partial identifiers. We do not collect or store full payment card numbers. See Section 7 (Payment Information).

2.6 Location Data

For mobile and in-home visits, and with your device permission, we collect location data to support safety and fulfillment. This includes live location sharing during a visit, location shared through our one-tap SOS feature, and geolocation and timestamps captured at check-in and check-out. See Section 6 (Location Data and Safety Tools).

2.7 Content

We collect content that you create or upload, including photos, "Stories" and reels, reviews, and other profile content. Content you make public, such as a Provider profile or a published review, may be visible to other users and visitors.

2.8 Communications

We collect in-app messages exchanged between Providers and Clients, as well as your communications with our support team. In-app messages are monitored and retained for safety, fraud prevention, and dispute-resolution purposes. Please do not share sensitive information in messages that you do not want collected, monitored, or retained for these purposes.

2.9 Device and Usage Information

We automatically collect certain information when you use the Service, including your IP address, device identifiers, app and usage analytics, and information collected through cookies and similar technologies. See Section 8 (Cookies and Tracking Technologies).

3. How We Use Your Information

We use personal information for the following purposes:

• Provide and operate the marketplace. Create and manage accounts, display Provider listings, enable discovery and booking, and connect Providers and Clients.
• Verify Providers and run background checks. Verify identity and, with consent, obtain consumer reports from the CRA to support trust and safety.
• Process bookings, payments, and payouts. Handle bookings, payments, payouts, deposits, tips, refunds, and related accounting.
• Enable safety tools. Provide features such as live location sharing during a visit, one-tap SOS that connects to 911 and shares location, and check-in and check-out.
• Prevent and detect fraud and abuse. Identify, investigate, and prevent fraudulent, harmful, unauthorized, or unlawful activity, and protect the integrity and security of the Service.
• Enforce our Terms and policies. Enforce our Terms of Service and conduct policy, investigate potential violations, and document actions taken (such as warnings, restrictions, or removals).
• Provide support. Respond to your questions, requests, and reports, and resolve disputes.
• Communicate with you. Send transactional messages (such as booking confirmations, receipts, and security notices) and, where permitted, marketing communications that you can opt out of.
• Improve the Service. Analyze usage, develop new features, and improve performance, safety, and user experience.
• Comply with law. Meet our legal, regulatory, tax, and contractual obligations, and respond to lawful requests.

Where required by law, we will rely on an appropriate legal basis for each use, and we will obtain your consent where consent is required (for example, for location access, background checks, or certain marketing).

4. How We Share Your Information

We share personal information only as described below. We do not sell your personal information, as explained at the end of this section.

4.1 Service Providers and Processors

We share information with vendors that perform services on our behalf and under contract, including:

• our payment processor (Stripe) for payments, payouts, and related identity verification;
• our consumer reporting agency for Provider background checks;
• identity verification vendors;
• the emergency-response / 911 integration provider that supports our SOS feature;
• cloud hosting and infrastructure providers;
• analytics providers;
• communications providers (for email, SMS, and push notifications); and
• mapping and location providers.

These vendors are permitted to use the information only to provide services to us and are required to protect it.

4.2 Between Users

To fulfill a booking, we share the information necessary for the Provider and Client to complete the appointment. For example:

• the Provider and Client may see each other's name and relevant contact information;
• for in-home or mobile visits, the Provider receives the Client's service address;
• the Provider may see a Client's rating or booking history on the Service; and
• safety and SOS-related data may be shared with emergency responders and with any trusted contacts you have designated, as described in Section 6.

Public profile content, including a Provider's listing and published reviews, may be visible to other users and visitors.

4.3 Safety, Legal, and Compliance

We may share information when we believe in good faith that doing so is necessary or appropriate to:

• respond to an emergency, including sharing location and related information with 911 and emergency responders through our emergency-response integration;
• comply with applicable law, regulation, legal process, or a lawful request from law enforcement or government authorities supported by valid legal process;
• enforce our Terms and policies, or protect the rights, property, or safety of Baela, our users, or the public; and
• detect, prevent, or investigate fraud, security incidents, or other harmful or unlawful activity.

4.4 Business Transfers

If Baela is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to the terms of this Privacy Policy or a successor policy.

4.5 With Your Consent

We may share information for other purposes with your consent or at your direction.

4.6 Aggregated and De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you. Where we de-identify information, we maintain it in de-identified form and do not attempt to re-identify it except as permitted by law.

4.7 No Sale of Personal Information; AI and Automated Processing

Baela does not sell your personal information. We also do not "share" your personal information for cross-context behavioral advertising as those terms are defined under California law, and we do not use Provider or Client content to train third-party artificial intelligence models.

We use artificial intelligence to provide and improve the Service. This includes helping Providers generate marketing and promotional content (such as captions, hashtags, and graphics) from their own listings, photos, and booking information, and supporting fraud detection and safety. AI features that generate content for a Provider operate on that Provider's own content and data. We describe these features by what they actually do and do not represent that they do more. To the extent any processing involves automated decision-making or profiling that produces legal or similarly significant effects, you may have rights as described in Section 9, and we keep consequential decisions subject to human review.

5. Background Checks and the FCRA (Providers)

To support trust and safety, Baela obtains background-check information about Providers from a third-party consumer reporting agency. These background checks are "consumer reports" under the federal Fair Credit Reporting Act ("FCRA") and may be subject to analogous state laws.

• Consent. Before we obtain a consumer report, we provide the Provider with a clear and conspicuous disclosure and obtain the Provider's written authorization, as required by the FCRA.
• Source. The report is prepared by a third-party CRA, which acts as an independent business with respect to the information it collects and generates. The CRA's practices are governed by its own privacy notices and by the FCRA.
• Your rights under the FCRA. You have rights under the FCRA, including the right to receive a copy of any consumer report obtained about you, the right to dispute inaccurate or incomplete information with the CRA, and the right to a summary of your rights under the FCRA. Additional rights may apply under state law.
• Adverse action. If we intend to take an adverse action (such as declining or removing a Provider) based in whole or in part on a consumer report, we will follow the FCRA's adverse-action process. This generally includes providing a pre-adverse-action notice with a copy of the report and a summary of FCRA rights, allowing a reasonable period to respond or dispute, and then, if applicable, providing a final adverse-action notice.

6. Location Data and Safety Tools

For mobile and in-home visits, Baela offers safety features that use location data. These features require your device permission and operate as described below.

• Live location sharing. During an active visit, you may share your live location so that it is visible to the other party to the booking and/or to designated trusted contacts, to support safety and fulfillment.
• One-tap SOS to 911. Our SOS feature lets you connect to 911 with one tap and share your location through a third-party emergency-response integration. When you trigger SOS, your location and related information may be shared with emergency dispatchers, emergency responders, and any trusted contacts you have designated.
• Check-in and check-out. We capture geolocation and timestamps when you check in and check out of a visit, to confirm fulfillment and support safety and fraud prevention.

We use location data for safety, to fulfill bookings, and to detect and prevent fraud. We share it as described in Section 4, including with emergency responders, trusted contacts, and our emergency-response and mapping vendors.

These safety features are tools designed to help, not guarantees of safety. They depend on factors outside our control, including device functionality, network connectivity, location accuracy, permissions, and the availability and response of emergency services and third-party providers. Baela does not provide emergency, security, or medical services, and you should not rely on these tools as a substitute for contacting emergency services directly or exercising your own judgment about your safety.

7. Payment Information

Payments, payouts, deposits, refunds, and tips are processed by our third-party payment processor, Stripe. When you provide payment information, it is collected and processed by the payment processor in accordance with its own privacy policy and applicable payment-card and data-security standards.

Baela receives limited payment metadata, such as transaction amounts, status, and partial card or account identifiers, but does not collect or store full payment card numbers. The payment processor may also collect identity verification information from Providers in order to enable payouts and meet legal and payment-network requirements.

8. Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies (such as SDKs, pixels, local storage, and device identifiers) to operate the Service, remember your preferences, keep you signed in, measure and analyze usage, secure the Service, and improve your experience.

You can control cookies and similar technologies through your browser or device settings, including by blocking or deleting cookies. Some features of the Service may not function properly if you disable certain technologies.

Do Not Track and Global Privacy Control. Some browsers offer a "Do Not Track" (DNT) signal. Because there is no common industry standard for DNT, we do not currently respond to DNT signals. We honor the Global Privacy Control (GPC) as an opt-out of sale or sharing of personal information where required by applicable law.

9. Your Privacy Rights and Choices

Depending on where you live and applicable law, you may have rights regarding your personal information. We honor these rights as described below and as required by law.

9.1 General Rights

Subject to applicable law and verification, you may request to:

• Access the personal information we hold about you and learn how we use and share it;
• Correct inaccurate personal information;
• Delete personal information, subject to legal and operational exceptions; and
• Port a copy of certain personal information in a portable format.

To exercise these rights, contact us using the methods in Section 17, including by email at privacy@baela.app or through available in-app settings.

9.2 California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA/CPRA"), provides you with the following rights:

• Right to know the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclose it;
• Right to delete personal information we have collected, subject to exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of personal information. Baela does not sell or share personal information as those terms are defined under the CCPA/CPRA;
• Right to limit the use and disclosure of sensitive personal information to those uses permitted by law. The categories of sensitive personal information we may collect include government-issued identifiers, precise geolocation, and account log-in credentials. We use sensitive personal information only for the purposes permitted under the CCPA/CPRA, such as providing the Service, ensuring safety and security, and preventing fraud; and
• Right to non-discrimination for exercising your rights.

The categories of personal information we collect, our sources, purposes, and the categories of recipients are summarized in Section 2 and Section 4.

9.3 Minnesota Privacy Rights (Minnesota Consumer Data Privacy Act)

If you are a Minnesota resident, the Minnesota Consumer Data Privacy Act ("MCDPA") provides you with rights regarding your personal data, including the right to:

• confirm whether we process your personal data and access that data;
• correct inaccurate personal data;
• delete personal data;
• obtain a portable copy of your personal data;
• opt out of the processing of personal data for targeted advertising, the sale of personal data, or certain profiling that produces legal or similarly significant effects; and
• obtain a list of the specific categories of third parties to which we have disclosed personal data, and question the result of profiling and be informed of the reasons for it, as provided under the MCDPA.

9.4 Colorado Privacy Rights (Colorado Privacy Act)

If you are a Colorado resident, the Colorado Privacy Act ("CPA") provides you with rights regarding your personal data, including the right to:

• confirm whether we process your personal data and access that data;
• correct inaccurate personal data;
• delete personal data;
• obtain a portable copy of your personal data; and
• opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Colorado residents may exercise the opt-out right through a recognized universal opt-out mechanism, such as the Global Privacy Control, which we honor as required by the CPA. If we decline to act on your request, you may appeal as described in Section 9.8.

9.5 New York and Residents of Other States

New York has not enacted a comprehensive consumer data privacy law that grants the access, correction, deletion, and portability rights provided under California and Minnesota law. New York residents are, however, protected by the New York SHIELD Act, which requires businesses to maintain reasonable data-security safeguards and to provide notification in the event of a data breach affecting their private information. We maintain safeguards as described in Section 12 and will provide breach notifications as required by law.

As a matter of practice, and regardless of your state of residence, we extend the core privacy choices described in Section 9.1 to all users. You may request to access, correct, delete, or obtain a portable copy of your personal information, and you may opt out of marketing as described in Section 10. If you are a resident of another state that has enacted a comprehensive privacy law, you may have additional rights, and we will honor those rights as required by applicable law.

9.6 How to Submit and Verify a Request

To submit a privacy request, contact us at privacy@baela.app or use available in-app tools. To protect your information, we will take steps to verify your identity before responding, which may require you to confirm information associated with your account. We will respond within the timeframes required by applicable law.

9.7 Authorized Agents

Where permitted by law, you may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your identity directly.

9.8 Appeals

If we decline to act on your request, you may appeal our decision. To appeal, contact us at privacy@baela.app. We will respond to your appeal within the period required by applicable law and will explain our decision.

9.9 Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights, including by denying the Service, charging different prices, or providing a different level or quality of service, except as permitted by law.

10. Marketing Communications and Opt-Out

With your permission where required, we may send you marketing communications about Baela features, offers, and updates. You can opt out at any time by following the unsubscribe instructions in our emails, adjusting your notification preferences in the app, or replying STOP to text messages (where applicable). Even if you opt out of marketing communications, we will still send you transactional and service-related messages, such as booking confirmations, receipts, and security or account notices.

11. Data Retention

We retain personal information for as long as necessary to provide the Service and for the purposes described in this Privacy Policy, including to maintain your account, fulfill and document bookings, support safety, prevent fraud, resolve disputes, and comply with our legal, tax, accounting, and regulatory obligations. Certain information, such as transaction records, safety-related data, communications retained for safety and dispute purposes, and background-check records, may be retained longer where required or permitted by law.

When personal information is no longer needed, we will delete, anonymize, or de-identify it in accordance with our retention practices.

12. Data Security

We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction. However, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for using the Service in a secure manner. If you believe your account has been compromised, please contact us promptly.

13. Children's Privacy

The Service is intended only for users who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will take steps to delete it. If you believe a person under 18 has provided us with personal information, please contact us at privacy@baela.app.

14. Third-Party Links and Services

The Service may contain links to, or integrations with, third-party websites, products, and services that we do not own or control, including our payment processor, identity verification vendors, the consumer reporting agency, the emergency-response integration, and mapping providers. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use. We are not responsible for the privacy practices of third parties.

15. International Users and Data Location

Baela is based in the United States, and the Service is intended for users in the United States. If you access the Service from outside the United States, you understand that your personal information may be transferred to, stored, and processed in the United States and other locations where we or our service providers operate, which may have data-protection laws that differ from those in your jurisdiction.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will revise the "Last updated" date above and, if the changes are material, we will provide additional notice as required by law (for example, by email or through the Service). Your continued use of the Service after an updated Privacy Policy becomes effective means you accept the updated policy.

17. Contact Us and How to Submit a Privacy Request

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

• Company: Baela LLC
• Privacy email: privacy@baela.app
• Mailing address: available on request
• In-app: through available privacy and account settings

To submit a privacy rights request, please use the email address above or the in-app tools, and include enough information for us to verify your identity and respond to your request.