Adlake LLC Master Privacy Policy

1. Corporate Identity, Scope, and Operational Overview

Adlake LLC ("Company," "Adlake," "we," "us," or "our") is a limited liability company organized under the laws of the State of Montana, United States, with its principal executive office located at 1001 S Main St, Ste 600, Kalispell, MT 59901-1498.

The Company owns and operates Adlake, an institutional performance marketing affiliate network, digital advertising exchange, and advertising technology tracking infrastructure accessible at https://adlake.net (the "Platform" or "Service"), as well as proprietary tracking and redirection domains including adlake.click and associated network endpoints. Adlake connects commercial Advertisers seeking campaign distribution with Publishers who distribute marketing content across approved digital channels in supported mainstream commercial verticals. Adlake strictly prohibits adult content, illicit services, and unauthorized material across all campaigns and creative inventory.

Adlake LLC also operates OffersWorks (https://offers.works), a consumer reward aggregation platform. This Master Privacy Policy governs exclusively the collection, use, commercialization, sale, disclosure, and security of Personal Data collected via the Adlake enterprise network at adlake.net, our APIs, platform dashboards, and our global tracking domains (adlake.click). Consumer interaction on OffersWorks is governed by the dedicated OffersWorks Privacy Policy at https://offers.works/privacy.

The Platform serves three primary categories of participants:

• Advertisers: Individuals, sole proprietors, agencies, or commercial enterprises—ranging from local merchants to nationwide corporate institutions and commercial banks—that create, fund, configure, and monitor digital marketing campaigns, upload campaign creative assets (images, audio, video, and promotional copy), and establish conversion payout terms.
• Publishers: Individuals, independent content creators, social media influencers (e.g., individual creators operating high-engagement profiles across platforms such as Instagram or TikTok), media buyers, mobile app developers, and large-scale reward or monetization businesses (such as Freecash and parallel industry aggregators) that enroll in Advertiser campaigns, generate tracking links via the Adlake Dashboard or API, and deliver traffic across approved digital channels.
• End Users / Visitors: Non-registered consumers and internet users who view, click, or engage with tracking links, creative assets, or promotional funnels distributed by Publishers across third-party properties and social channels.

2. Definitions

"Account"

The credentialed access profile established on the Platform via our unified registration portal, whether as an Advertiser, a Publisher, or a dual-status participant.

"Advertiser"

Any individual or corporate entity registering on the Platform to create, finance, configure, and distribute advertising campaigns.

"Biometric Data"

Physiological data generated by automatic measurements of an individual's biological characteristics, specifically facial geometry scans derived from liveness-detection selfies collected during identity verification.

"Campaign"

An advertising offer, promotion, or marketing directive deployed by an Advertiser on the Platform, including creative assets, geo-targeting constraints, device rules, payout thresholds, and publisher enrollment criteria.

"Creative Assets"

Visual images, video files, audio recordings, text copy, graphic banners, and related promotional media uploaded by Advertisers to Adlake servers for distribution in Campaigns.

"End User" / "Visitor"

Any natural person who views, clicks, or interacts with an Adlake Tracking Link or campaign banner on an external website, mobile app, or social media profile, but who has not registered an Account on the Platform.

"Personal Data"

Any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular natural person, household, or device.

"Publisher"

Any individual or corporate entity registering on the Platform to enroll in Advertiser campaigns, generate Tracking Links, and route digital traffic to campaign landing destinations.

"Sell" / "Sale"

Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating Personal Data to a third party for monetary or other valuable commercial consideration, as defined under applicable United States state privacy statutes.

"Share"

The disclosure of Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.

"Tracking Link"

A unique, proprietary URL generated through the Publisher Dashboard or API (hosted on adlake.click or related Company domains) that directs traffic through Company routing infrastructure for real-time traffic evaluation, anti-fraud scrubbing, attribution, and conversion verification prior to delivering the visitor to the Advertiser destination.

3. Categories of Personal Data Collected

3.1 Unified Account Registration Data (Advertisers and Publishers)

Both Advertisers and Publishers register through a unified enrollment endpoint. During registration, the Company collects:

• Individual Identifiers: Legal first name, legal last name, physical residential or business street address, city, state/province, postal/ZIP code, country, primary telephone number, email address, instant messaging handles (e.g., Skype, Telegram), and salted/cryptographically hashed account passwords.
• Business Entity Details (where applicable): Registered company or legal entity name, corporate registration number, registered business street address, business telephone number, business email, entity classification (corporation, LLC, partnership, sole proprietorship), and Employer Identification Number (EIN) or foreign corporate tax identifier.
• Social Media Handles and Operational Channels: Social media profile URLs (e.g., Instagram, YouTube, X, TikTok), website domains, mobile application identifiers, promotional vertical specializations, and estimated monthly traffic volumes.

3.2 Advertiser Campaign, Creative, and Financial Deposit Data

• Creative Asset Files and Embedded Metadata: Images, video clips, animations, audio recordings, promotional banners, and text copy uploaded to Adlake servers. These files may contain embedded metadata (such as EXIF data, camera hardware signatures, creation timestamps, and geolocation tags) which Adlake processes for platform security and content moderation.
• Campaign Parameters: Conversion payout triggers, geographical allowances, device/carrier targeting parameters, daily/total budget caps, and publisher enrollment restrictions (open enrollment vs. manual advertiser approval).
• Cryptocurrency Deposit Records & Deposit Rule: Inbound cryptocurrency public wallet addresses (USDT and USDC on BEP20 or ERC20), blockchain transaction hashes (TXIDs), deposit amounts, deposit timestamps, and platform ledger balance logs. Advertiser deposits are committed to fund active campaign deliveries; while unspent deposits may be eligible for return strictly pursuant to the Adlake Refund Policy in Section 4 of the Master Terms of Service, deposits do not constitute an earned balance and cannot be withdrawn on demand in the manner of Publisher commission balances.
• Tax Reporting Identifiers: Where required by federal or state law, completed IRS Form W-9 or applicable W-8 series documentation, including Social Security Numbers (SSN) or Employer Identification Numbers (EIN), collected in connection with refund disbursements or reportable commercial activities.

3.3 Publisher Performance, Enrollment, and Commission Disbursement Data

• Performance Metrics: Campaign enrollments, unique tracking link creations, impressions, clicks, qualified conversions, postback receipts, sub-affiliate identifiers (Sub-IDs), and aggregate commission accruals.
• Cryptocurrency Disbursement Records: Designated recipient cryptocurrency public wallet addresses (USDT and USDC via BEP20 or ERC20), outbound blockchain transaction hashes (TXIDs), monthly disbursement amounts, and historical Net-30 transaction logs.
• Tax and 1099 Compliance Records: IRS Form W-9 (for U.S. persons) or Form W-8BEN/W-8BEN-E (for non-U.S. persons), collecting legal name, address, entity status, and Taxpayer Identification Number (SSN or EIN). Pursuant to federal law (including 26 U.S.C. § 6041), Adlake collects this data to issue IRS Form 1099-NEC or 1099-MISC to Publishers whose annual aggregate disbursements reach or exceed statutory reporting thresholds.

3.4 End User / Visitor Telemetry (Captured via adlake.click Tracking Infrastructure)

When an End User clicks a Tracking Link or interacts with Adlake-hosted promotional media, our tracking servers automatically capture and evaluate real-time telemetry before redirecting the visitor:

• Network and Routing Data: Remote client IP address, Regional Internet Registry (RIR) registration metadata, Autonomous System Number (ASN), ASN organization name, routing path, WHOIS registry metadata, and coarse network-derived geographical location (country, state/region, city, postal code, network-derived latitude/longitude coordinates, location accuracy radius, and timezone derived from IP address—never hardware GPS precise geolocation).
• Device and Environment Signatures: HTTP User-Agent strings, Client Hint headers (sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-platform, sec-fetch-*), browser language, browser vendor and version, device model, operating system version, screen resolution, color depth, and TLS/SSL cryptographic session parameters.
• Attribution Signals: Referring URL, landing destination URL, click timestamp, Campaign identifier, pseudonymized Publisher account ID, sub-publisher parameters, and conversion postback verification tokens.
• Threat Intelligence and Anti-Fraud Telemetry: Real-time fraud diagnostics obtained from our infrastructure and integrated IP intelligence partners (including ipapi.is), comprising: VPN detection flags, open proxy indicators, Tor exit node markers, datacenter hosting flags, abuser reputation scores, virtual machine/emulator signatures, crawler/bot classifications, and behavioral anomaly metrics.

3.5 Identity Verification (KYC) and Biometric Identifiers

When necessary to investigate suspicious activity, clear disputed balances, or comply with statutory anti-money laundering (AML) and anti-fraud mandates, Adlake requires verification via our third-party processor, Didit:

• Government Identification: Government-issued photo identification cards, driver's licenses, passports, or national ID cards, along with proof-of-address documents (e.g., utility bills or bank statements).
• Biometric Facial Geometry: Selfie-based facial scans collected strictly subject to your prior affirmative written release, processed by Didit for real-time liveness detection and identity matching. Facial geometry data is encrypted in transit, is never hosted or stored directly on Adlake web servers, is never sold or shared for commercial profiling, and is permanently destroyed within thirty (30) days of verification completion in compliance with the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14/15) and parallel state standards.

3.6 Outside and Aggregated Data Sources

Adlake may purchase, license, or obtain marketing lists, consumer profiles, business intelligence, and enrichment telemetry from third parties, commercial aggregators, and public databases. We combine this outside information with existing database records to enhance ad targeting, validate contact coordinates, perform data hygiene, and improve anti-fraud scoring.

4. Lawful Grounds and Operational Purposes of Processing

Adlake processes Personal Data and telemetry under the following lawful legal bases and operational business purposes:

• Execution of Contractual Commitments: To process registration requests, provision Publisher and Advertiser Dashboards, manage campaigns, track conversions, calculate commission balances, execute Net-30 cryptocurrency disbursements (USDT/USDC via BEP20 or ERC20), and enforce platform Terms of Service.
• Pre-Click Fraud Scrubbing and Infrastructure Defense: Operating proprietary pre-routing fraud filters on adlake.click to detect and discard bot automation, click injection, VPN/proxy masking, datacenter traffic, and conversion hijacking before traffic reaches Advertiser landing pages.
• Content Moderation and Creative Asset Review: Reviewing images, videos, audio files, and promotional copy uploaded by Advertisers to ensure strict adherence to our mainstream vertical standards and complete exclusion of adult or illegal content.
• Payout Dispute Adjudication: Investigating contested conversions and processing Advertiser-initiated payout holds pursuant to Section 7 of this Policy and Section 6 of our Master Terms of Service.
• Legal, Regulatory, and Tax Compliance: Issuing IRS Form 1099-NEC/MISC, complying with Montana state corporate mandates, satisfying federal AML/CTF obligations, and responding to lawful subpoenas, warrants, and regulatory demands.
• System Security and Telemetry Analytics: Evaluating server logs, optimizing routing latency, auditing system integrity, and enhancing conversion attribution algorithms.

5. Data Commercialization, Sale, and Third-Party Sharing

5.1 Commercial Sale and Licensing of Data

Except where prohibited by law or restricted by an effective consumer opt-out, Adlake may sell, license, lease, or disseminate registration profiles, enrichment telemetry, and derived audience segments to third-party commercial partners, including:

• Performance Advertisers and Brand Agencies: Disclosing audience profiles, contact coordinates, and commercial interests to enrolled Advertisers on the Adlake Network (adlake.net) to deliver targeted commercial opportunities;
• Direct Marketing and Data Aggregators: Supplying data to commercial aggregators, data brokers, lookup/reference services, and data enhancement/hygiene providers;
• AdTech Exchanges and Programmatic Networks: Supplying pseudonymized device telemetry, network identifiers, and IP reputation attributes for cross-context ad targeting and bid optimization (including affiliated ecosystem partners such as Notik / Wollo Coins Ltd, CPAlead LLC, and CPX Research / Make Opinion GmbH where applicable).

5.2 Disclosures to Operational Processors (Service Providers)

Adlake shares data with third-party service providers bound by strict confidentiality and security covenants, solely to support core platform operations:

• Verification Partners (Didit): Transmitting identity documents and selfie liveness data for AML/KYC identity authentication;
• Threat Intelligence Providers (ipapi.is and equivalents): Transmitting IP addresses and routing headers to receive real-time fraud risk scores, proxy flags, and network diagnostic metrics;
• Hosting and Server Infrastructure: Housing databases and operating routing logic within enterprise cloud environments;
• SMS and Communications Gateways: Transmitting telephone numbers and message payloads for two-factor authentication and security dispatches.

5.3 Public Blockchain Ledgers

Cryptocurrency deposits and Publisher Net-30 earnings disbursements (USDT and USDC) are recorded directly onto decentralized, public, peer-to-peer blockchain ledgers (specifically Binance Smart Chain BEP20 and Ethereum ERC20). Recipient wallet addresses and transaction hashes (TXIDs) published on-chain are cryptographically permanent, immutable, and viewable by anyone. Privacy rights of erasure or modification cannot technically or legally apply to records broadcast to public blockchains.

5.4 Corporate Transactions

In the event of a merger, corporate consolidation, acquisition, asset transfer, reorganization, or bankruptcy of Adlake LLC, all user databases, platform logs, creative assets, and tracking data will be transferred to the acquiring entity as an operational business asset.

6. Network Architecture, Publisher Pass-Through Obligations, and Third-Party Tracking

Adlake operates as an intermediary advertising technology network. We do not own, operate, or directly control the independent websites, mobile applications, or social media properties managed by Publishers.

Advertiser Destination Pages: When an End User passes through an Adlake tracking link, they are redirected to an external landing page operated by an Advertiser or its third-party partners. Third-party Advertisers may deploy their own cookies, web beacons, and data collection scripts. Adlake LLC exercises no control over, and assumes no legal liability for, the data collection, privacy, or tracking practices of third-party Advertiser destinations.

7. Advertiser Payout Holds, Traffic Disputes, and Fraud Adjudication

Adlake processes Personal Data and traffic telemetry to investigate and adjudicate commercial disputes between Advertisers and Publishers:

7.1 The Net-30 Disbursement Cycle and Hold Requests

Publishers accrue earnings on a monthly cycle disbursed Net-30 via cryptocurrency (USDT or USDC on BEP20 or ERC20). Prior to the execution of a monthly disbursement, an Advertiser may formally request that Adlake place a temporary administrative hold on a Publisher's accrued payout.

7.2 Strict Evidentiary Standards and Publisher Protection Presumption

Because the Adlake tracking engine (operating via adlake.click) performs deep real-time traffic scrubbing—evaluating IP reputation via ipapi.is, filtering known proxies, datacenters, bots, and emulators prior to landing page redirection—Adlake maintains a strong commercial presumption in favor of Publisher earnings legitimacy where our automated systems verified the traffic at the point of click and conversion.

Adlake will reject arbitrary, unverified, or general hold requests. To secure a payout hold, an Advertiser must furnish clear, verifiable, and lawfully obtained evidence demonstrating fraudulent or manipulated activity that our automated edge systems could not detect. Such evidence is limited to:

• Coordinated offline collusion (e.g., organized rings or incentivized student syndicates executing invalid leads across clean residential mobile connections);
• Identifiable post-conversion chargebacks, fabricated merchant orders, or stolen identity credentials; or
• Sub-publisher conversion stuffing proven through Advertiser backend access logs.

7.3 Dispute Data Processing and 36-Month Retention

In evaluating hold requests, Adlake reviews Publisher identity profiles, social handles, historical traffic logs, conversion postback receipts, IP reputation reports, and all written communications submitted by both parties. Records relating to commercial disputes and fraud investigations are retained for thirty-six (36) months following formal dispute resolution to defend against legal, regulatory, or commercial claims.

8. SMS / Text Messaging Policy and TCPA Compliance

If you provide your mobile telephone number during account registration or profile administration:

8.1 Express Prior Consent

By submitting your mobile number and opting in, you provide prior express written consent to receive operational, transactional, and security-related SMS messages from Adlake LLC at the designated number, in compliance with the Telephone Consumer Protection Act (47 U.S.C. § 227) and FCC regulations. Operational SMS messages include:

• Two-factor authentication (2FA) codes and login security alerts;
• Platform notices regarding campaign deposit confirmations and Net-30 payout processing; and
• Urgent administrative notifications regarding account security status or dispute resolution.

8.2 Immediate Automated Revocation (STOP)

You may revoke consent to receive SMS communications at any time. To opt out, reply with any standard revocation keyword—STOP, CANCEL, END, QUIT, or UNSUBSCRIBE—to any text message received from Adlake. In strict adherence to FCC (47 CFR § 64.1200) and carrier standards, our automated gateway processes keyword opt-out requests immediately upon receipt. Our system will transmit a single confirmation text message confirming your revocation, after which no further SMS communications will be delivered to that number. You may also revoke consent via reasonable alternative means by emailing support@adlake.net (processed as soon as practicable and within no more than ten (10) business days).

Operational Notice: Opting out of SMS messages may disable two-factor authentication via text, requiring you to configure an alternate authentication credential (such as an authenticator app) to maintain account access. For help, reply HELP or email support@adlake.net.

8.3 Carrier Terms and Record Retention

Standard message and data rates may apply per your mobile carrier contract. Message frequency depends on your account activity and security events. SMS opt-in and revocation records are retained for a minimum of five (5) years from the date of consent or revocation to comply with TCPA recordkeeping rules and defend against regulatory claims. Mobile telephone numbers and opt-in consent records are never sold, rented, or shared with third parties for their own promotional marketing.

9. Cookies, Tracking Technologies, and Universal Opt-Outs (GPC)

9.1 Technologies Employed

Adlake deploys session and persistent cookies, web beacons, pixel tags, server-to-server (S2S) postbacks, and device fingerprinting telemetry across our dashboards and tracking domains:

• Strictly Necessary Cookies: Essential for secure user authentication, session persistence, load balancing, and CSRF protection within platform dashboards.
• Attribution & Conversion Tracking: Deployed via Tracking Links to attribute clicks to referring Publishers, record conversions, calculate commissions, and reconcile billing.
• Anti-Fraud & Telemetry Diagnostics: Capturing browser signatures, connection timing, and client hints to block automated scrapers, bot attacks, and proxy manipulation.

9.2 Universal Opt-Out Mechanisms (UOOM) and Global Privacy Control (GPC)

Adlake recognizes and honors the Global Privacy Control (GPC) signal broadcast by supported web browsers. When our web servers detect an active GPC or recognized universal opt-out signal, our systems treat that signal as a valid, binding consumer request to opt out of the sale or sharing of Personal Data and targeted advertising for that specific browser, session, and associated device profile. If an authenticated user transmits a GPC signal while logged into their Account, our platform extends that opt-out preference across all persistent profile records linked to that Account.

10. Data Security, Retention Schedules, and Blockchain Immutability

10.1 Security Safeguards

Adlake LLC implements robust administrative, technical, and physical safeguards to protect Personal Data, including: AES-256 encryption for sensitive database stores at rest; TLS 1.3 encryption for all data in transit; hardware security modules (HSMs) for cryptocurrency private key operations; role-based access restrictions; and continuous network perimeter monitoring.

10.2 Retention Schedules

• Account Registration and Profile Data: Retained for the duration of active Account status plus twenty-four (24) months following formal account closure.
• Corporate Financial Records and Tax Documentation (W-9, W-8, 1099 Forms): Retained for seven (7) years following the calendar year of issuance or filing, pursuant to IRS mandates (26 U.S.C. § 6001) and Montana state corporate accounting requirements.
• Tracking Telemetry, Server Logs, and Network Diagnostica: Retained in active tracking systems for twenty-four (24) months from capture for fraud auditing and traffic quality verification, after which records are aggregated or permanently purged.
• Identity Verification Documents (KYC): Retained for five (5) years pursuant to federal anti-money laundering (AML) recordkeeping rules.
• Biometric Facial Geometry Scans: Permanently destroyed within thirty (30) days of verification completion in compliance with 740 ILCS 14/15(a).
• Dispute and Hold Resolution Files: Retained for thirty-six (36) months following dispute closure.
• SMS Consent and Revocation Records: Retained for five (5) years from date of execution or revocation.

10.3 Public Blockchain Immutability Exception

Public blockchain transactions (USDT and USDC on BEP20 and ERC20 ledgers) are mathematically and cryptographically permanent. Public wallet addresses and transaction hashes broadcast to public ledgers cannot be amended, modified, or erased by Adlake LLC. Statutory rights of erasure or correction apply exclusively to off-chain data maintained within our direct database systems.

11. Data Breach Notification

In the event of a security incident involving unauthorized access to, acquisition of, or disclosure of unencrypted Personal Data reasonably likely to cause material harm to affected individuals, Adlake LLC will:

• Promptly investigate, isolate, and contain the security incident;
• Notify affected account holders without unreasonable delay, in compliance with applicable state notification mandates, including Montana (Mont. Code Ann. § 30-14-1704) and California (Cal. Civ. Code § 1798.82);
• Submit formal notifications to the relevant state Attorneys General or data protection regulators where the incident impacts resident counts exceeding statutory reporting thresholds; and
• Transmit written breach advisories detailing: (i) the nature and timing of the incident; (ii) the specific categories of Personal Data impacted; (iii) corrective actions taken by the Company; (iv) protective steps individuals can take; and (v) direct compliance contact coordinates. Notifications will be delivered via the email address associated with your Account, supplemented by a public notice posted on https://adlake.net where direct contact is unfeasible.

12. International Data Transfers and GDPR / UK GDPR Governance

Adlake LLC is established and headquartered in the United States. If you interact with our Platform, dashboards, or tracking domains from the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, your data will be transferred to and processed within the United States.

• Lawful Transfer Mechanisms: Cross-border transfers of Personal Data from the EEA, UK, or Switzerland to the United States are governed by Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision (EU) 2021/914, Module One and Module Two) and the UK International Data Transfer Addendum.
• Data Subject Rights: Residents of the EEA, UK, or Switzerland possess statutory rights under Regulation (EU) 2016/679 (GDPR) and the UK Data Protection Act 2018, including the rights of access, rectification, erasure, restriction, data portability, and objection to processing, exercisable by contacting legal@adlake.net.
• Right to Complain to a Supervisory Authority: Pursuant to GDPR Article 77, individuals in the EEA have the right to lodge a formal complaint with a national Data Protection Authority (Supervisory Authority) in the Member State of their habitual residence, place of work, or place of the alleged infringement. UK residents may lodge complaints with the Information Commissioner's Office (ICO) at https://ico.org.uk.

13. Strict Age Governance and Minor Protection

The Adlake Platform is an enterprise business-to-business and performance marketing network designed exclusively for adult commercial participants. No individual under the age of eighteen (18) years (or the legal age of majority in your jurisdiction, whichever is higher) may register an Account or access the Platform.

In strict compliance with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506) and the FTC COPPA Rule (16 CFR Part 312), Adlake does not knowingly collect, maintain, sell, or share personal data from children under the age of thirteen (13). Furthermore, Adlake does not knowingly sell or share personal information of consumers under sixteen (16) years of age without affirmative authorization. Any Account discovered to belong to an individual under eighteen (18) will be terminated immediately and all associated profile data purged. If you believe a minor has submitted personal information to Adlake, contact legal@adlake.net immediately.

14. Policy Modifications and Prospective Application

Adlake LLC reserves the right to modify this Master Privacy Policy at any time. For non-material modifications, we will update the "Last Updated" date at the top of this document. For material modifications—specifically alterations that expand our rights to collect, use, sell, or share Personal Data—we will provide at least thirty (30) days' advance notice by conspicuous platform announcements, dashboard notifications, or direct email to your registered address.

In compliance with Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), revisions to this Privacy Policy operate prospectively only and will not retroactively alter purpose limitations or data protections applicable to Personal Data collected prior to the effective date without your affirmative opt-in consent. Continued use of the Platform following the 30-day notice period constitutes acceptance of the prospective terms.

Schedule A — United States Comprehensive State Privacy Rights Notice

This Schedule supplements the Adlake LLC Master Privacy Policy and applies strictly to individual residents of U.S. states that have enacted comprehensive consumer privacy legislation, including:

California (CCPA/CPRA), Montana (MtCDPA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Delaware (DPDPA), Iowa (ICDPA), Indiana (INCDPA), Kentucky (KCDPA), Maryland (MODPA), Minnesota (MnCDPA), Nebraska (NDPA), New Hampshire (NHPA), New Jersey (NJDPA), Rhode Island (RIDTPPA), Tennessee (TIPA), Vermont (VDPPA), and Nevada (NRS Chapter 603A).

A.1 Statutory Data Subject Rights

• Right to Confirm and Access: Confirm whether we process your Personal Data and receive a portable copy of specific records.
• Right to Rectification / Correction: Correct inaccurate personal records maintained in our databases.
• Right to Deletion: Request the deletion of Personal Data collected from or about you, subject to statutory exemptions (fraud defense, tax/legal compliance, system debugging, and public blockchain immutability).
• Right to Opt-Out of Data Sales: Direct Adlake LLC to cease selling your Personal Data to third parties for monetary or valuable consideration.
• Right to Opt-Out of Cross-Context Behavioral Advertising / Targeted Ads: Direct Adlake LLC to cease sharing or processing your data for cross-context targeted advertising.
• Right to Limit the Use of Sensitive Personal Information: Under California law, restrict the use of sensitive personal information strictly to necessary operational functions. Under Montana, Colorado, Connecticut, Delaware, Indiana, Kentucky, Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia statutes, sensitive data (including biometric facial geometry) is collected only pursuant to affirmative, prior opt-in consent. Under the Maryland Online Data Privacy Act (MODPA, Md. Code Ann., Com. Law § 14-4607), sensitive personal data is processed strictly where necessary to provide or maintain the requested service (such as identity verification and anti-fraud security) and is never sold.
• Right to Third-Party Disclosures: Pursuant to Oregon law (Or. Rev. Stat. § 646A.574(1)(a)(B)) and Minnesota law (Minn. Stat. § 325O.05, subd. 1(h)), residents of Oregon and Minnesota may request an itemized list of the specific third parties (other than natural persons) to which Adlake has disclosed personal data. Delaware residents (Del. Code Ann. tit. 6, § 12D-104(a)(5)) may request a list of the categories of third parties disclosed.
• Right to Non-Discrimination: We will not deny services, adjust commission payouts, or alter performance terms because you exercised your privacy rights.

A.2 Statutory Reference and Citation Matrix

A.3 California CCPA/CPRA Statutory Categories Disclosed and Sold (Preceding 12 Months)

A.4 Verification Procedures, Timelines, and Administrative Appeals

How to Submit a Request: You or your legally authorized agent may submit a verified privacy request by emailing legal@adlake.net with the subject line "State Privacy Rights Request - [Your State of Residence]".

• Verification Standard: Account holders are verified via multi-factor authentication (MFA) and cross-referencing account registration parameters (registered email, phone, transaction IDs). Non-account End Users are verified by cross-referencing at least two to three technical identifiers (historical IP logs, User-Agent strings, and timestamped network interaction records) against our server logs. Authorized agents must present written, signed authorization from the consumer or a valid Power of Attorney.
• Response Timelines: Opt-out of sale/sharing requests are honored within fifteen (15) business days (11 CCR § 7026(f)). Access, correction, and deletion requests are acknowledged within ten (10) business days and substantively completed within forty-five (45) calendar days (extendable by an additional 45 days upon written notice where technically necessary).
• Administrative Appeals Procedure: Residents of Montana, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia maintain the legal right to appeal any denial of a privacy request. To file an appeal, email legal@adlake.net within forty-five (45) days of receiving our decision, using the subject line "Privacy Determination Appeal". Our Compliance Department will deliver a written determination within forty-five (45) days (or sixty (60) days where statutorily allowed). If your appeal is denied, our written response will provide direct contact instructions for filing a complaint with the Attorney General of your state.

A.5 Direct State Disclosures

• California "Shine the Light" (Cal. Civ. Code § 1798.83): California residents may request an accounting of disclosures of personal information made to third parties for their direct marketing purposes by contacting legal@adlake.net.
• California Consumer Affairs Notice (Cal. Civ. Code § 1789.3): The Complaint Assistance Unit of the Division of Consumer Affairs of the California Department of Consumer Affairs may be contacted by mail at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.
• Nevada Opt-Out Notice (NRS Chapter 603A): Nevada residents wishing to opt out of the commercial sale of covered information may submit a verified request to legal@adlake.net with the subject line "Nevada Do Not Sell Request".
• Rhode Island Transparency Disclosure (R.I. Gen. Laws § 6-48.1-3): Pursuant to Rhode Island law, Adlake LLC discloses that it may sell or share personally identifiable information and network telemetry to commercial third parties, including enrolled Advertisers and Publishers on the Adlake Network (adlake.net), affiliated monetization and offerwall entities (including Notik / Wollo Coins Ltd, CPAlead LLC, and CPX Research / Make Opinion GmbH), and threat intelligence/verification processors (ipapi.is and Didit). Residents may obtain an updated list of specific third-party recipients or opt out via legal@adlake.net.
• Oregon Corporate Disclosure (Or. Rev. Stat. § 646A.578): Adlake is a proprietary platform operated by Adlake LLC, a Montana limited liability company.

Schedule B — Notice of Right to Opt-Out of Data Sale and Targeted Advertising

Under the laws of California, Montana, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, consumers have the legal right to opt out of:

1. The Commercial Sale of their Personal Data; and
2. The processing and sharing of their Personal Data for Targeted Advertising / Cross-Context Behavioral Advertising.

Exercising your right to opt out of data sales will not impact your account standing, commission payout rates, or campaign eligibility.