Section 1 : Device Data Collected by CITYDATA

In general, CITYDATA collects information about End Users' devices ("Device Data") from Customers that integrate CITYDATA's products into their apps either through a software development kit ("SDK") or from Customers that otherwise share Device Data with CITYDATA. Device Data collected by CITYDATA may include the following:

• Location data of End Users' devices, such as latitude-longitude coordinates obtained through GPS tools, WiFi data, Bluetooth beacons, cell tower triangulation or other techniques;
• The associated device identifier of End Users' devices, such as the Identifier for Advertisers or IDFA for iOS devices and Advertiser ID for Android/Google devices;
• Other information about End Users' devices, such as: device type (e.g., tablet, smartphone), hardware model, operation system and version, mobile browser type (e.g., Chrome, Firefox, Safari), mobile network information, and mobile sensor information including speed, bearing, orientation, time zone, timestamp and altitude;
• Usage data about how End Users use CITYDATA's products and services (through Customers' apps using CITYDATA's GeoSDK), such as: access time, access location, activity and internet protocol address;
• Predicted or inferred data about End Users, such as census block group, characteristics or interests; and/or
• Any other information End Users voluntarily provide to CITYDATA or to CITYDATA's Customers.

Section 2 : How CITYDATA Uses Device Data

Device Data is generally used to operate, maintain and improve CITYDATA's products and services for Customers. CITYDATA's products and services help developers, and other companies and organizations in the public and private sectors to learn about End Users based on the Device Data. For example, CITYDATA may enable Customers to:

• measure performances of Customers' physical location, product, content, service;
• perform competitive analysis for Customers' business category or industry vertical;
• identify the census block groups where End Users may be interested in Customers' products, content, or services;
• understand the impact of public sector projects for economic development, urban planning, internet-of-things, mobility and transportation;
• understand how people move through cities, districts and neighborhoods;
• understand how people move across cities and across countries, and;
• understand the impact of natural and human-made disasters;

Section 3 : Device Data Opt-in and Opt-out

Opt-in

Before CITYDATA collects Device Data from an End User's device, the End User must first opt-in to share the device's location data. An End User is opted in when the End User downloads an app that includes CITYDATA's GeoSDK and gives CITYDATA permission to collect Device Data.
Apps on Apple devices, like iPhones, and Android/Google devices, like Samsung Galaxy, ask for permission to collect data in different ways. Older Android phones running older Android operating systems require an End User to accept any permissions that the app asks for before the End User can install the app. Thus, if the app has been downloaded, the End User is opted in. Newer Android phones allow End Users to opt-in after downloading the app. Apple apps also allow End Users to download the app without first opting in, however, Device Data is collected only after End Users opt-in.

Opt-out

End Users can choose to opt-out of sharing Device Data with CITYDATA by disabling location sharing or ad tracking on their devices. End Users can also disable location sharing with specific apps by reviewing the settings for each app, or by choosing to not share location when prompted after first downloading the app, or by uninstalling the app. If an End User opts-out of location sharing or ad tracking, CITYDATA does not collect Device Data from the End User's device.

At this time CITYDATA does not collect data from the web browser on mobile devices and does not honor web browser Do Not Track ("DNT") signals or similar mechanisms.

For iOS, ad tracking can be disabled by navigating to Settings > Select Privacy > Select Advertising > Enable the "Limit Ad Tracking" setting. For Android, navigate to Google Settings app > Select Ads > Enable "Opt out of interest-based advertising." You can learn more about how to opt-out your mobile device by visiting the NAI web site.

Section 4 : Information Collected from Customers

CITYDATA collects information that Customers provide when Customers set up an account, use CITYDATA's products or services and/or the Website or communicate with CITYDATA.

For example, CITYDATA may request Customer's contact and billing information (e.g., name, postal address, email address and password and telephone number) and applicable business information when Customers register for an account or purchase CITYDATA's products or services.

Some of the features of the Website may be accessed by a Customer only after the Customer creates an account with CITYDATA.

Section 5 : Information Collected from Visitors

Contact Information

CITYDATA may collect Visitors' contact information. Visitors are not required to create an account or provide any contact information in order to browse the Website and learn more about CITYDATA's products and services. However, if a Visitor requests or downloads any documents, blogs, and other information or subscribes to CITYDATA's newsletter, the Visitor may be required to provide certain contact information such as an email address, name and telephone number. CITYDATA only uses Visitors' contact information to fulfill the request and does not share this contact information with any third party, other than service providers if necessary to fulfill the request, or as otherwise described in this Privacy Policy. For example, if a Visitor subscribes to CITYDATA's newsletter, CITYDATA may provide the Visitor's contact information to a service provider that manages and delivers the newsletters.

Use Information

When a Visitor is using the Website, CITYDATA may log information related to the Visitor's usage of the Website, such as IP address, browser type, browser language, referring/exit pages and URLs, platform type, number of clicks, domain names, landing pages, pages viewed and the order of those pages, the amount of time spent on particular pages by using standard third-party services like Google Analytics. CITYDATA also may log the Visitor's type of mobile device and the mobile device's IP address, operating system, and the type of mobile browsers. This data is used to manage the Website, including diagnosing problems, tracking usage and improving the Website.

Tracking Technologies

CITYDATA may use "cookies" to measure the effectiveness of the Website and email communication. Services of an independent company may be used to measure the effectiveness of how Visitors use the Website. To do this, CITYDATA may use web beacons, pixels, and cookies provided by third-party marketing companies like Facebook, Hubspot and MailChimp. The type of information CITYDATA may collect include pages visited, videos viewed, etc. This information helps CITYDATA learn things like what pages are most attractive to Visitors. Because cookies are stored on Visitors' computer or device, Visitors can set their browser to decline cookies and can delete them from their computer or device.

Section 6 : How CITYDATA Shares Information

CITYDATA provides Customers with access to a proprietary web application (the "Platform") that provides the Customers with a visual mapping and tracking tool to analyze Device Data. In general, the Platform presents the Device Data in an aggregated and segmented form and does not provide a method for a Customer to identify, track or view End Users' individual devices.

For example, the Platform may enable a Customer to view an aggregated list of End Users' devices that visited a particular shopping mall on a particular weekend, or the Platform may provide a local government, as one of CITYDATA's Customers, with recreation and parks analytics based on a group of End Users' devices.

CITYDATA may provide a Customer with tools to track End Users' devices based on privacy-compliant mobile device identifiers (e.g., IDFA or ADID). However, these tools are provided only if the Customer already has the ability to track End Users' devices (without CITYDATA's tools) and has an app that's using CITYDATA's GeoSDK.

Overall, the following list explains the ways in which CITYDATA may disclose Device Data and information collected from Visitors and Customers.

• CITYDATA may disclose Device Data to Customers for the purposes of learning more about End Users and engaging with End Users based on Device Data;
• CITYDATA may disclose Visitors' contact information, use information and tracking technologies to service providers who work on behalf of CITYDATA to maintain, operate and improve the Website or to fulfill Visitors' requests;
• CITYDATA may disclose Customers' contact and billing information to service providers when necessary to provide CITYDATA's products or services to the Customers;
• CITYDATA may disclose any information as required by law, such as to comply with a subpoena or similar legal process;
• CITYDATA may disclose any information when CITYDATA believes in good faith that disclosure is necessary to protect CITYDATA's legal and contractual rights or safety of others, investigate fraud, or respond to a lawful request by public authorities, including to meet national security or law enforcement requirements;
• CITYDATA may disclose any information if CITYDATA is involved in a merger, acquisition, or sale of all or a portion of assets;
• CITYDATA may disclose Device Data associated with an End User if the End User grants CITYDATA permission; or
• CITYDATA may disclose information collected from a Visitor or Customer if the Visitor or Customer grants CITYDATA permission.

Section 7 : Data Retention and Security

CITYDATA stores the Device Data and information collected from Visitors indefinitely for the purposes of operating, maintaining, improving and providing CITYDATA's products and services, for the purposes of maintaining, operating and improving the Website and for other business purposes that CITYDATA considers reasonably necessary. CITYDATA uses reasonable physical, managerial, and technical safeguards to preserve the integrity and security of the Device Data and information collected from Visitors and Customers. CITYDATA minimizes collection of identifiable information, and utilizes industry-standard end-to-end encryption for the transmission of information.

Section 8 : Rights of End Users, Customers, and Visitors

Under certain conditions, an End User, Customer, or Visitor may request and obtain from CITYDATA twice a year, free of charge, upon the receipt of confirmation of identity, categories of information collected about the End User, Customer, or Visitor; categories of sources from which End User, Customer, or Visitor information is collected; CITYDATA's purposes for collecting End User, Customer, or Visitor information; categories of third parties with whom CITYDATA shares information; and specific pieces of End User, Customer, or Visitor information that CITYDATA has collected about the End User, Customer, or Visitor. CITYDATA does not reidentify or link non-identifiable information.

Under certain conditions, if the information the End User, Customer, or Visitor provided to CITYDATA is incorrect, the End User, Customer, or Visitor may request CITYDATA update it.

End Users, Customers, or Visitors may obtain from CITYDATA the rectification of inaccurate information by providing a supplementary statement to the CITYDATA privacy team.

Under certain conditions, End Users, Customers, or Visitors may request CITYDATA delete End User, Customer, or Visitor information unless the information is required to complete a transaction; the information is used to detect and protect against security incidents; the information is used to identify and repair errors that impair CITYDATA's products or services; the information is used for CITYDATA's internal uses; or non-deletion is required by law.

An End User, Customer, or Visitor shall have the right, at any time, to direct CITYDATA to stop selling the End User's, Customer's, or Visitor's personal information to third parties. End Users, Customers, and Visitors can opt out of the sale of personal information by selecting "Do Not Sell My Personal Information" via the "Do not sell my personal information" web page.

An End User, Customer, or Visitor may request to see, update and/or remove End User, Customer, or Visitor information by emailing privacy@citydata.ai or via the "Do not sell my personal information" web page.

With respect to Visitors or Customers, CITYDATA will first verify the identity of the Visitor or Customer, then provide and/or remove information collected from that Visitor or Customer. While, to remove Device Data associated with an End User's device, the End User will need to provide CITYDATA with the IDFA (iPhone) or ADID (Android phones). CITYDATA does not store email addresses, names, or phone numbers with End Users' Device Data, so CITYDATA needs the privacy-compliant mobile device identifier to find End Users' device in the database.

If an End User, Customer, or Visitor is a resident of the European Union, the End User, Customer, or Visitor has a right to lodge a complaint with a local supervisory authority when the End User, Customer, or Visitor has an objection to CITYDATA's processing. However, CITYDATA appreciates the opportunity to first address End User, Customer, or Visitor concerns by email at privacy@citydata.ai.

CITYDATA's Data Protection Officer ("DPO") is responsible for overseeing CITYDATA's use of Device Data and monitoring compliance with data protection laws. For any concerns or questions related to CITYDATA's use of the Device Data, the DPO can be contacted by email at dpo@citydata.ai.

CITYDATA will never discriminate against an End User, Customer, or Visitor for exercising any rights under this Privacy Policy.

Section 9 : Children's Privacy

CITYDATA does not knowingly collect information from children under 13 years old or from websites or apps directed to children under 13 years old. CITYDATA's products and services are not directed to persons under 13 years of age.

If CITYDATA learns that information of persons under 13 years of age has been collected or received, then CITYDATA will take the appropriate steps to delete this information.

Section 10 : Dispute Resolution; Binding Arbitration and Class Action Waiver

This Section 10 (Dispute Resolution; Binding Arbitration and Class Action Waiver) only applies to End Users and Visitors (together, "Consumers"). For similar applicable provisions, Customers should refer to CITYDATA's Terms of Service available at https://citydata.ai/terms_of_service.

CONSUMERS SHOULD READ THIS SECTION 10 CAREFULLY. THIS SECTION 10 MAY SIGNIFICANTLY AFFECT CONSUMERS' LEGAL RIGHTS, INCLUDING RIGHT TO FILE A LAWSUIT IN COURT.

10.1 Governing Law. Any claims arising out of or relating to this Privacy Policy (including interpretation, claims for breach, and all other claims, including consumer protection, unfair competition and tort claims) will be subject to the laws of the State of California, United States, without reference to conflict of laws principles.

10.2 Informal Dispute Resolution. Consumers should email CITYDATA at privacy@citydata.ai to address any dispute, controversy or claim arising out of or relating to this Privacy Policy (including its interpretation, formation, performance and breach) or the relationship between Consumers and CITYDATA (collectively, "Disputes"). Most Disputes are quickly resolved in this manner to Consumers' satisfaction. The parties will use best efforts to settle any Dispute directly through consultation and good faith negotiations which will be a precondition to either party initiating a lawsuit or arbitration.

10.3 Formal Dispute Resolution. If the parties do not agree upon a resolution in connection with a Dispute within a period of 30 calendar days from the time informal dispute resolution is initiated pursuant to Section 10.2 (Informal Dispute Resolution), Consumers and CITYDATA expressly agree that the provisions in Section 10.3(a) (Agreement to Arbitrate), Section 10.3(b) (Location), Section 10.3(c) (Class Action Waiver), Section 10.3(d) (Exception – Small Claims Court Claims) and Section 10.3(e) (30 Day Right to Opt Out) apply to Consumers.

(a) Agreement to Arbitrate. If the parties do not agree upon a resolution in connection with a Dispute within a period of 30 calendar days from the time informal dispute resolution is initiated pursuant to Section 10.2 (Informal Dispute Resolution), then either party may initiate binding arbitration as the sole means to formally resolve claims (the "Agreement to Arbitrate"), subject to the terms set forth below. Specifically, all Disputes shall be finally settled by binding arbitration administered by the American Arbitration Association (the "AAA"). The arbitration proceedings shall be governed by AAA's Commercial Arbitration Rules (the "AAA Rules") and, where appropriate, AAA's Supplementary Procedures for Resolution of Consumer-Related Disputes (the "AAA Consumer Rules"). This arbitration provision is made pursuant to a transaction involving interstate commerce, and the Federal Arbitration Act shall apply to the interpretation, applicability, enforceability and formation of this Privacy Policy notwithstanding any other choice of law provision contained in this Privacy Policy. The arbitrator, and not any federal, state or local court or agency, shall have exclusive authority to resolve all disputes arising out of or relating to the interpretation, applicability, enforceability or formation of this Privacy Policy, including without limitation any claim that all or any party of this Privacy Policy are void or voidable, or whether a claim is subject to arbitration. The arbitrator shall be empowered to grant whatever relief would be available in a court under law or in equity. The arbitrator's award shall be binding on the parties and may be entered as a judgment in any court of competent jurisdiction. The arbitration may be conducted in person, through the submission of documents, by phone or online. The arbitrator shall make a decision in writing, and shall provide a statement of reasons if requested by either party. The arbitrator must follow applicable law, and any award may be challenged if the arbitrator fails to do so. The AAA Rules and the AAA Consumer Rules are both available at the AAA website www.adr.org. Consumers' arbitration fees and Consumers' share of arbitrator compensation shall be governed by the AAA Rules and, where appropriate, limited by the AAA Consumer Rules. The parties understand that, absent this mandatory provision, they would have the right to sue in court and have a jury trial. They further understand that, in some instances, the costs of arbitration could exceed the cost of litigation and the right to discovery may be more limited in arbitration than in court.

(b) Location. Arbitration shall be initiated in San Francisco County, California, and Consumers and CITYDATA agree to submit to the personal jurisdiction of any federal or state court in San Francisco County, California, in order to compel arbitration, to stay proceedings pending arbitration or to confirm, modify, vacate or enter judgment on the award entered by the arbitrator.

(c) Class Action Waiver. The parties further agree that any arbitration shall be conducted in their individual capacities only and not as a class action or other representative action, and the parties expressly waive their right to file a class action or seek relief on a class basis. CONSUMERS AND CITYDATA AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN CONSUMERS' OR CITYDATA'S INDIVIDUAL CAPACITY, AND NOT AS A PLANITFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING. If any court or arbitrator determines that the class action waiver set forth in this subsection is void or unenforceable for any reason or that an arbitration can proceed on a class basis, then the arbitration provision set forth above shall be deemed null and void in its entirety and the parties shall be deemed to have not agreed to arbitrate Disputes.

(d) Exception – Small Claims Court Claims. Notwithstanding the parties' decision to resolve all Disputes through arbitration, either party may seek relief in a small claims court for disputes or claims within the scope of that court's jurisdiction. For the avoidance of doubt, nothing herein shall prevent a resident of the European Union from lodging a complaint with a local supervisory authority.

(e) 30 Day Right to Opt Out. Consumers have the right to opt-out and not be bound by the arbitration and class action waiver provisions set forth in Subsection 10.3(a) (Agreement to Arbitrate), Subsection 10.3(b) (Location) and Subsection 10.3(c) (Class Action Waiver) above by sending notice of the decision to opt-out to the following email address: privacy@citydata.ai, Attn: Legal. The notice must be sent within 30 days of Consumers' first access or use of CITYDATA's products and services or the Website; otherwise Consumers will be bound to arbitrate Disputes in accordance with the terms of those Subsections. If Consumers opt-out of these arbitration provisions, CITYDATA also will not be bound by such provisions.

(f) Disputes Not Subject to Arbitration or Class Action Waiver. For Disputes not subject to the "Agreement to Arbitrate" set forth in Section 10.3(a) (Agreement to Arbitrate), or if any court or arbitrator determines that the "Class Action Waiver" set forth in Section 10.3(c) (Class Action Waiver) is void or unenforceable for any reason or that an arbitration can proceed on a class basis, exclusive jurisdiction for any claim or action arising out of or relating to CITYDATA's products and services, the Website or this Privacy Policy shall be in the federal or state courts in San Francisco County, California, and Consumers expressly consent to the exercise of personal jurisdiction of such courts.

(g) Changes to Section 10. When changes are made to this Section 10, the "Effective Date" of this policy will reflect the date of the change. Additionally, CITYDATA will provide 60-days' notice of any changes to this Section 10 to Visitors (if contact information was provided to CITYDATA) and End Users (by requesting the appropriate Customers to notify the End Users) and any such change will apply only to any claims arising after the 60th day following such notice.

Section 11 : Changes and Updates to this Privacy Policy

This Section 11 (Changes and Updates to this Privacy Policy) applies to the entire Privacy Policy except for Section 10 (Dispute Resolution; Binding Arbitration and Class Action Waiver). For changes to Section 10, please refer to Section 10.3(g) (Changes to Section 10).

CITYDATA may amend this Privacy Policy from time to time. When the Privacy Policy is amended, the "Effective Date" of this policy will reflect the date of the amendment. Additionally, if the amendment materially changes the usage of Device Data or information collected from Visitors or Customers, CITYDATA will notify the affected Customers and Visitors (if contact information was provided to CITYDATA) and/or request the appropriate Customers to notify the affected End Users.

Section 12 : Contact Information

For more information, or to ask questions about this Privacy Policy or CITYDATA's practices, please contact us at privacy@citydata.ai