ADVENTURE ON, INC. — PRIVACY POLICY

Effective Date: April 3, 2026
Website: adventureon.app | Contact: maruf@adventureon.app
Entity: Adventure On, Inc. | Delaware Corporation

This Privacy Policy explains how Adventure On, Inc. ("Adventure On," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you use the Adventure On mobile application, website (adventureon.app), and related services (collectively, the "Platform"). By using the Platform, you agree to the practices described in this Policy. If you do not agree, do not use the Platform.

Adventure On is both a content-organization and planning tool AND an online travel agency (OTA) facilitating travel bookings. This dual nature means we collect and process different types of information for different purposes, described below.

1. INFORMATION WE COLLECT

1.1 Information You Provide Directly

• Account Registration: name, email address, username, password, profile photo (optional), travel profile preferences (e.g., surfer, mountaineer, wellness traveler), and hobbies.

• Booking Information: when you book travel, we collect traveler names, dates of birth, passport/ID information (where required by Travel Suppliers), contact information, and billing address. Payment card information is collected directly by Stripe and is not stored by Adventure On.

• Travel Preferences: destinations you save, itineraries you create, travel dates, number of travelers, accommodation preferences, and activity preferences.

• User Content: trip notes, reviews, photos, and other content you submit.

• Communications: messages you send to us via support, email, or in-app messaging.

1.2 Information Collected Automatically

• Device and Usage Data: IP address, device type, operating system, browser type, device identifiers, app version, and crash/error logs.

• Usage Analytics: pages visited, features used, time spent, search queries, videos saved, and interaction data within the Platform.

• Location Data: with your permission, precise GPS location to show nearby travel content, map features, and location-based recommendations. You can disable location access in your device settings.

1.3 Information from Third Parties

• Social Login: if you sign in using Apple, Google, or another third-party provider, we receive basic profile information (name, email) from that provider.

• Social Content Metadata: when you save a travel video or post from Instagram, TikTok, or another platform, our AI systems analyze publicly available metadata and content to extract location tags, experience types, and trip context. We store metadata and references — we do not re-upload, host, or store the original video files on our servers.

• Travel Supplier Data: booking confirmations, itinerary updates, and status changes received from Duffel, airlines, hotels, and tour operators in connection with bookings you make.

• Analytics and Advertising Partners: usage and engagement data from analytics providers we use to improve the Platform.

2. HOW WE USE YOUR INFORMATION

2.1 To Provide and Operate the Platform

• Create and manage your account

• Process travel bookings and payments through Duffel and Stripe

• Generate AI-powered personalized itineraries based on your saved content and travel profile

• Provide map views, folder organization, and community discovery features

• Display saved travel content and inspiration in your personalized feed

• Communicate booking confirmations, updates, and changes

• Provide customer support

2.2 For Personalization

• Tailor your discovery feed to your travel identity (surfer, mountaineer, wellness traveler, etc.)

• Recommend destinations and experiences based on your save history and preferences

• Show community travel trends from users with similar travel profiles (Community Pulse)

2.3 For Safety and Security

• Detect and prevent fraudulent bookings and account activity

• Verify identity for booking purposes

• Comply with anti-money laundering and fraud prevention obligations

• Monitor for security vulnerabilities

2.4 For Legal and Business Purposes

• Comply with applicable laws, including seller of travel regulations, tax laws, and financial regulations

• Respond to legal process, court orders, and government requests

• Enforce our Terms of Service

• Conduct internal analytics and business planning

2.5 For Marketing (With Your Consent Where Required)

• Send you promotional emails and in-app notifications about new features, destinations, and offers

• Retarget you with relevant travel content on third-party platforms

• You may opt out of marketing communications at any time by clicking "unsubscribe" in any marketing email or adjusting your notification settings in the app.

2.6 AI Processing

We use AI (including Anthropic's Claude, Google's Gemini, and other AI models) to analyze saved video content to extract location and experience data, generate personalized itinerary suggestions, and power the trip-planning assistant. These AI tools provide travel suggestions and organization features for your convenience. These are recommendations only and do not constitute "automated decisions" with legal effects. You remain in control of all booking decisions and can adjust your travel profile at any time in the app settings.

3. HOW WE SHARE YOUR INFORMATION

3.1 Travel Suppliers

When you book travel, we share necessary booking data (name, contact info, traveler details, passport information where required) with the relevant Travel Supplier (airline, hotel, tour operator) to fulfill your booking. This is necessary for the performance of your travel contract.

3.2 Duffel

Flight and hotel bookings on the Platform are powered by Duffel Technologies Limited ("Duffel"). To facilitate your bookings, we share necessary personal information—including your name, email address, date of birth, and traveler details—with Duffel, who then forwards this information to the relevant airlines, hotels, and travel suppliers to fulfill your reservation. Duffel's privacy policy applies to their processing of your data.

3.3 Stripe

Payment processing is handled by Stripe, Inc. Stripe receives your payment information directly and processes it under Stripe's Privacy Policy. Adventure On does not receive or store your full card number.

3.4 Analytics and Service Providers

We share data with third-party service providers who help us operate the Platform, including:

• MailGun: We use MailGun to send transactional emails, such as booking confirmations and ticket updates. Your email address and booking details are shared with MailGun for this purpose.

• Other Providers: We also work with analytics providers, cloud hosting providers, and customer support tools. These providers are contractually prohibited from using your data for their own purposes.

3.5 Legal Requirements

We may disclose your information where required by law, subpoena, court order, or government request, or where we believe disclosure is necessary to protect rights or safety, detect or prevent fraud, comply with legal obligations, or defend against legal claims.

3.6 Business Transfers

If Adventure On undergoes a merger, acquisition, financing, or sale of assets, your information may be transferred to the acquiring entity. We will notify you via email or prominent notice on the Platform before your information becomes subject to a different privacy policy.

3.7 With Your Consent

We may share your information for other purposes with your explicit consent.

4. DATA RETENTION

We retain your personal information for as long as necessary to maintain your account, fulfill bookings and resolve disputes, and comply with legal obligations (including tax and financial record-keeping, generally 7 years). Booking records are retained for at least 7 years to comply with financial and travel regulatory requirements. You may request deletion of your account data at any time (see Section 7), subject to legal retention obligations.

5. DATA SECURITY

We use industry-standard security measures including TLS encryption for data in transit, encryption at rest for sensitive data, access controls limiting employee access to personal data, and regular security reviews. No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data. In the event of a data breach affecting your rights, we will notify you as required by applicable law.

6. TECHNOLOGIES AND MOBILE IDENTIFIERS

We use mobile identifiers and similar technologies to maintain your session, remember your preferences, and provide core app functionality. We do not use third-party tracking cookies for behavioral advertising. You can manage app-level permissions through your device settings.

7. YOUR RIGHTS AND CHOICES

7.1 Access and Correction

You may access and update most of your account information directly in the app. To request access to other personal data we hold, contact maruf@adventureon.app.

7.2 Deletion

You may delete your account and all associated personal data directly within the app by navigating to Settings. Upon deletion, your account record and associated personal data will be removed, subject to legal retention obligations (e.g., we are required to retain booking and financial records for a minimum of 7 years as required by law).

7.3 Portability

You may request a copy of your personal data in a portable format by contacting maruf@adventureon.app.

7.4 Opt-Out of Marketing

Unsubscribe from marketing emails using the unsubscribe link in any email, or adjust notification settings in the app. Note: transactional communications (booking confirmations, safety alerts) cannot be opted out of while your account is active.

7.5 Location Data

You can disable location access for Adventure On in your device settings at any time. This will limit certain location-based features but will not affect core booking functionality.

8. CHILDREN'S PRIVACY

AdventureOn is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it immediately. By using the Platform, you represent that you are at least 13 years of age.

9. U.S. STATE PRIVACY RIGHTS

9.1 California Residents — CCPA / CPRA

California residents have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: you may request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell/share, and the purposes for such collection.

• Right to Delete: you may request deletion of personal information we hold about you, subject to legal exceptions.

• Right to Correct: you may request correction of inaccurate personal information.

• Right to Opt-Out of Sale/Sharing: we do not sell personal information for monetary consideration. We may share personal data through advertising technologies in ways that constitute "sharing" under CPRA. California residents may opt out at any time by contacting maruf@adventureon.app. We honor Global Privacy Control (GPC) signals.

• Right to Limit Use of Sensitive Personal Information: you may limit our use of sensitive personal information (such as precise location data) to what is necessary to provide the service.

• Non-Discrimination: exercising your CCPA/CPRA rights will not result in discriminatory treatment.

To submit a request, contact maruf@adventureon.app. We will verify your identity before processing requests and respond within 45 days (extendable by an additional 45 days with notice).

9.2 Other State Privacy Laws

Residents of Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Texas (TDPSA), and other states with comprehensive privacy laws have similar rights including access, correction, deletion, portability, and opt-out of targeted advertising. To exercise these rights, contact maruf@adventureon.app.

10. INTERNATIONAL USERS

AdventureOn is intended for users located within the United States. We do not intentionally target or collect information from residents of the European Union or other jurisdictions outside the U.S. If you access the Platform from outside the U.S., you do so at your own risk and are responsible for compliance with local laws.

11. THIRD-PARTY LINKS AND SERVICES

The Platform contains links to third-party websites and services, including social media platforms, Travel Suppliers, and Stripe. This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party services you access through the Platform.

12. PUSH NOTIFICATIONS

Push notifications are sent only when a user’s saved item has finished processing. We do not send promotional or other unrelated notifications at this time. You can manage or disable push notifications at any time through your iOS device Settings.

13. IN-APP PURCHASES AND SUBSCRIPTIONS

Adventure On+ is offered as an auto-renewable subscription through Apple In-App Purchase, powered by RevenueCat. Plans are available at $7.99 per month or $59.99 per year. Subscriptions will automatically renew unless canceled at least 24 hours before the end of the current period. You can view, manage, or cancel your subscription anytime in your Apple ID account settings.

14. IN-APP ACCOUNT DELETION

Adventure On provides in-app account deletion in compliance with Apple App Store Guideline 5.1.1(v). Users who wish to delete their account and associated personal data may do so by navigating to Settings within the app. The deletion flow allows users to initiate and complete full account deletion without leaving the app. Upon deletion, the account record and associated personal data are removed, subject to legal retention requirements for booking and financial records.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on the Platform with a new effective date, and by email if the changes materially affect how we use your personal data. Your continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Policy.

16. HOW TO CONTACT US

For privacy requests, questions, or concerns:

Adventure On, Inc.
131 Continental Dr., Suite 305, Newark, DE 19713 (Registered Agent)
Email: maruf@adventureon.app
Website: adventureon.app

We aim to respond to all privacy requests within 5 business days of receipt. Formal CCPA/state law requests will receive a response within the applicable legal timeframe.