Privacy Policy

This Privacy Policy explains how Festborne LLC ("KindTip," "we," "us," or "our") collects, uses, discloses, and protects information about users of the KindTip platform (kindtip.app). This policy applies to: - Recipients — people who create KindTip pages to receive support - Supporters — people who send support payments - Visitors — people who browse kindtip.app without an account By using KindTip, you agree to the practices described in this policy. If you do not agree, please do not use the service. KindTip is operated by Festborne LLC, an Illinois limited liability company. For questions about this policy, contact hello@kindtip.app.

2.1 Account Information (Recipients) When you create a KindTip account, we collect: - Name and display name - Email address - Password (stored in hashed form via Clerk — we never see your plaintext password) - Profession/category - Profile photo (optional) - Bio (optional) - Phone number (optional, for SMS notifications) - Profile color and customization preferences 2.2 Financial and Identity Information (Recipients — for payouts) When you connect a bank account via Stripe Express, Stripe (not KindTip) collects your: - Legal name - Date of birth - Last 4 digits of Social Security Number (for US identity verification) - Bank account routing and account numbers KindTip never receives or stores this sensitive financial information — it is submitted directly to Stripe's encrypted systems. 2.3 Support Transaction Data For each transaction, we receive and store: - Amount paid - Platform fee and net amount - Supporter's name (if provided) - Supporter's email (if provided) - Message to recipient (if provided) - Star rating (if provided) - Stripe payment intent ID (for reconciliation) - IP address and device/browser information (for fraud detection) - Timestamp 2.4 Usage and Analytics Data When you use KindTip, we automatically collect: - Pages visited and actions taken - Browser type, operating system, and device type - IP address and approximate geographic location (country and city-level) - Referring URL - Session duration and frequency This data is collected via Vercel Analytics (privacy-focused, no cookies required) and our own server logs. 2.5 Communications If you contact us via email or the contact form, we retain records of those communications to resolve your inquiry and improve our support. 2.6 Cookies and Local Storage KindTip uses: - Essential cookies for authentication (managed by Clerk) - localStorage for UI preferences (dark/light mode, session timeout settings, notification read state) — this data never leaves your device - No advertising cookies or cross-site tracking cookies

We use the information we collect to: (a) Provide the service — create and maintain your account, process transactions, send payouts, and display your profile page. (b) Communications — send transaction notifications (email and SMS), receipt emails, weekly earnings summaries (Pro/Teams), security alerts, and product updates. You can opt out of non-essential emails at any time. (c) Fraud prevention and security — analyze IP addresses, device fingerprints, and behavior patterns to detect and prevent fraudulent transactions, account takeovers, and platform abuse. (d) Analytics and improvement — understand how the platform is used, identify bugs, and improve features. (e) Legal compliance — comply with applicable laws, respond to lawful government requests, enforce our Terms of Service, and protect the rights of KindTip and our users. (f) Customer support — respond to your inquiries and resolve disputes. We do not use your data for behavioral advertising, and we do not sell your personal information to any third party for commercial purposes.

4.1 With Stripe We share your Stripe Connect account ID, transaction amounts, and fee information with Stripe to process payments and initiate payouts. Stripe is an independent controller of data it receives; see stripe.com/privacy. 4.2 With Clerk We use Clerk for user authentication. Clerk stores your email, password hash, and session data. See clerk.com/privacy. 4.3 With Supabase Our database is hosted on Supabase (PostgreSQL on AWS). Your account data, profile, and transaction history are stored there. See supabase.com/privacy. 4.4 With Resend We use Resend to send transactional emails (notifications, receipts, weekly summaries). Resend receives recipient email addresses and email content. See resend.com/privacy. 4.5 With Vercel Our platform is hosted on Vercel. Vercel processes server requests, which may include IP addresses and request metadata. See vercel.com/privacy. 4.6 Legal Disclosures We may disclose your information if required to do so by law, subpoena, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others. 4.7 Business Transfers If KindTip is acquired, merged, or undergoes a change of control, your information may be transferred to the acquiring entity as part of that transaction, subject to the same privacy protections described here. We will notify you of any such transfer. 4.8 Aggregated Data We may share aggregated, anonymized data that does not identify individual users with partners, investors, or the public for research or business purposes. We do not share your personal information with any other third parties without your consent.

Your KindTip support page is publicly accessible. The following information is visible to anyone who visits your page: - Your display name (shown in privacy format: "First L." by default to external viewers) - Your profession/category - Your profile photo (if uploaded) - Your bio - Your tip preset amounts and Kind Menu labels (if set) - Your support goal title, description, and progress (if active) - Your average rating (if you have received rated tips) Your full legal name, email address, phone number, and earnings figures are never shown publicly.

We retain your data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce agreements. - Active accounts: Data retained indefinitely while your account remains active. - Deactivated accounts: Data retained for 90 days after deactivation, then scheduled for deletion. - Closed accounts: You may request account deletion at any time. We will delete your personal data within 30 days, except where we are required to retain it for legal, regulatory, or fraud-prevention purposes (typically up to 7 years for financial records). - Transaction records: Financial transaction records may be retained for up to 7 years in accordance with US tax and financial record-keeping requirements. To request deletion of your data, email hello@kindtip.app.

Depending on your location, you may have the following rights: Access and Portability. You have the right to access the personal information we hold about you and to receive it in a portable format. Email hello@kindtip.app to request a data export. Correction. You can correct most of your profile information directly in your Settings. For changes you cannot make yourself (such as username changes), contact hello@kindtip.app. Deletion. You can request deletion of your account and personal data at any time. See Section 6 for retention limitations. Opt-Out of Communications. You can opt out of non-essential marketing emails by using the unsubscribe link in any email. Transactional emails (receipts, tip notifications) cannot be disabled while your account is active. California Residents (CCPA). California residents have the right to: know what personal information is collected; know whether it is sold or disclosed; opt out of the sale of personal information (we do not sell personal information); access their personal information; and equal service and price. To exercise these rights, email hello@kindtip.app with the subject line "California Privacy Request." EU/UK Residents (GDPR). If you are in the European Union or United Kingdom, you have additional rights under GDPR/UK GDPR including the right to object to processing, the right to restrict processing, and the right to lodge a complaint with your supervisory authority. Our lawful basis for processing is legitimate interest (fraud prevention, service operation) and contract performance (delivering the service you signed up for). Contact hello@kindtip.app for any GDPR requests.

We take data security seriously and implement technical and organizational measures to protect your information, including: - Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3. - Encryption at rest: Database contents are encrypted at rest using AES-256, managed by Supabase and AWS. - Authentication security: Passwords are never stored in plaintext. Authentication is handled by Clerk, which is SOC 2 Type II certified. - Payment security: All payment data is processed directly by Stripe (PCI-DSS Level 1 certified). KindTip never stores card numbers, CVVs, or bank credentials. - Access controls: Production database access is restricted to authorized personnel via role-based access controls and multi-factor authentication. - Session security: Sessions expire after inactivity (configurable in Settings). Suspicious login attempts trigger email alerts. Despite these measures, no internet service can guarantee absolute security. If you suspect a security breach affecting your account, contact hello@kindtip.app immediately.

KindTip is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact hello@kindtip.app. Users between 13 and 17 may use KindTip as Supporters only (to send support payments) and only with verified parental consent.

KindTip is operated from the United States. If you are located outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country. For EU/UK users, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission as the legal mechanism for international data transfers when applicable. Our third-party processors (Stripe, Clerk, Supabase, Vercel) also maintain appropriate transfer mechanisms under GDPR.

KindTip may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party sites you visit. KindTip is not responsible for the privacy practices of external sites.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email to your registered address and/or by displaying a notice on the platform. The "Last updated" date at the top of this policy reflects the most recent revision. Continued use of KindTip after the effective date of any change constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us: Privacy inquiries: hello@kindtip.app General support: hello@kindtip.app Security issues: hello@kindtip.app Festborne LLC Operator of KindTip State of incorporation: Illinois, United States We aim to respond to all privacy inquiries within 5 business days.