Privacy Policy USA

Last Updated: September 2026

Your information and privacy are important to us. Waffle operates the website wafflekids.co and develops a range of screen-free communication devices for children. You can contact us at hello@wafflekids.co.

This Privacy Policy recognizes the importance of protecting your personal information. It explains how Just Waffle Inc. d/b/a Waffle Kids and Waffle (“Waffle,” “we,” “our,” “us”) and our affiliated companies collect, use, protect, and disclose personal information (“Personal Information”) when you use the Waffle website (“Site”) and/or our cloud-based services (“Services”), including our Waffle Parent Hub mobile application (“Mobile App”). This Privacy Policy also explains your choices for managing your information preferences and exercising privacy rights available under applicable privacy laws.

As discussed in detail in this Privacy Policy, we use cookies, session replay technologies (e.g., tracking your online session), and other tracking technologies. 

We may also share data with service providers.

SCOPE

This Privacy Policy applies to the Personal Information handled or otherwise processed by us in our business, including information we collect through our products and Services, Site, our Mobile App, or the networks supporting your Services. We may collect Personal Information from you and anyone who uses your Waffle products or Services under your account. You are responsible for ensuring that all your users agree. This Privacy Policy does not apply in certain cases when you are using our products and Services and other companies collect your Personal Information including, but not limited to, when you visit third-party websites, you purchase our products and services from a retailer, you connect to a social networking service or another company’s Wi-Fi network, or if you provide information to another company that is included as part of your monthly rate plan (“Plan”) or other products and services you purchase from us, even if accessible through our Services. In those cases, any information you provide to those companies may be subject to their notice, or to both their notice and our notice. We encourage you to visit and review those third parties’ privacy policies.

Summary of Key Points

This summary provides key points from our Privacy Policy, but you can find out more details by reading the full policy.

• What personal information do we process? We collect personal information provided by parents or guardians when using our services (such as name, email, shipping address, and purchase details). We also collect limited data automatically, such as device type and location, through tools like Google Analytics. No personally identifiable personal information is collected from users browsing our website unless a purchase is made.
  

• Do we process any sensitive personal information? Yes. We process children’s data, financial data, exact geolocation, message contents and voice messages, and certain other sensitive personal information.
  

• Do we collect information from third parties? We may collect information from services such as Google Analytics and Contentsquare, including page views, device type, and browsing patterns.
  

• How do we process your information? We use your information to deliver our services, support your account, process transactions, communicate with you, ensure compliance, improve our offerings, and for limited marketing purposes.
  

• With whom do we share information? We may share personal information with our service providers and partners.
  

• What are your rights? Depending on your home jurisdiction, you may have rights under applicable data privacy laws, including accessing, correcting, or deleting your data, and limiting the use of personal data in marketing.
  

• How do you exercise your rights? You can submit a data access or deletion request by contacting us directly through email: hello@wafflekids.co.
  
  

Table of Contents

1. What Information Do We Collect?
   

2. How Do We Use Personal Information?
   

3. When and With Whom Do We Share Your Personal Information?
   

4. How Do We Safeguard Your Personal Information?
   

5. Do We Use Cookies and Other Tracking Technologies?
   

6. Is Your Information Transferred Internationally?
   

7. How Long Do We Keep Your Information?
   

8. How Do We Protect Privacy of Children’s Data
   

9. What Are Your Privacy Rights?
   

10. What Do-Not-Track Controls Do You Have?
    

11. Supplemental Notice for State Privacy Laws – United States
    

12. Updates to This Policy
    

13. How Can You Contact Us?
    

14. SMS Terms and Conditions
    
    

1. What Information Do We Collect?

We collect both personal and non-personal information to deliver our services effectively. See the types of personal data we collect and the purposes for which we use it in detail below:

1.1 Information We Collect from Caregivers

We collect personal information from the caregiver (typically a parent or legal guardian) when they register for or use our services, including:

• Name, email address, phone numbers, shipping address, and payment details at the time of purchase
  

• Information entered into the caregiver portal (via web or Mobile App), such as the child’s name, nickname, and birthdate, call/text permissions, and device schedule settings
  

• Product interest — which Waffle products you're interested in (Go, Home, or both).
  

• Family information — number of children and their age ranges, provided voluntarily to help us improve our products.
  

• Events related to purchase and account use, such as order details and subscription activity
  

• For Waffle Home: the physical service address (this address must be kept current by the caregiver)
  

1.2 Information We Collect from Children Using a Waffle Go Device

When a child uses a Waffle Go device, we automatically collect certain usage information to enable core functionality, safety features, and caregiver oversight. This may include:

• Incoming and outgoing call history
  

• Text messages and images sent or received
  

• Apps downloaded and time spent in each app
  

• Type, location, destination of communications
  

• Content of text messages
  

• Voice message recordings
  

• User-generated content
  

• GPS coordinates (longitude/latitude) and general geographic location
  

1.2.1 Additional Data Collected via Waffle Home

When a child uses the Waffle Home device, the following data is collected in addition to or instead of the data listed above. Waffle Home is a VoIP-based home phone; it does not support text messaging, app downloads, GPS location tracking, or AI features. Data collection is limited to:

• Call logs (incoming and outgoing), including phone numbers, timestamps, and call duration
  

• Caregiver-managed contact safelist (approved names and numbers)
  

• Voicemail metadata (message timestamps; voicemail audio is transmitted and stored or retained by Waffle)
  

• Device connectivity and service status data (for troubleshooting and service quality)
  

1.3 Automatically Collected Website & Portal Information

We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Services, our communications, and other online services, such as:

• Device Data Collection. When you download and use our Services and visit our Sites, we may automatically collect your internet protocol (“IP”) address, user settings, browser information including plug-ins, device type, operating system, time zone setting, unique identifiers, language settings, mobile device carrier, and radio/network information (e.g., Wi-Fi, LTE, 5G).
  

• Online Activity Data. When you access our Site or Services, we may automatically collect the type of web browser you use, your information service provider, the pages or screens you view, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you opened our emails and clicked links within them.
  

• Usage data. Anonymized analytics data including page views, device type, and browsing patterns collected via Google Analytics and Contentsquare.
  

• Advertising and conversion data. We use the Meta Pixel and Meta Conversions API (Facebook/Instagram) to measure the effectiveness of our advertising. This includes events such as page views, product views, checkout initiation, and completed pre-orders. For completed pre-orders, we share hashed (one-way encrypted) versions of your email address, name, phone number, and address with Meta to improve ad attribution. This data cannot be reversed by Meta to identify you directly.
  

• Cookies. Small text files stored on your device to improve your browsing experience. See the Cookies section below.
  

We may collect the following data automatically:

• IP address
  

• User settings
  

• Web browser and plugin information
  

• Operating system information
  

• Device type
  

• Device identifiers
  

• Platform type
  

• City, state, and country
  

• Pages visited and actions taken
  

• Pages/screens viewed
  

• App usage
  

• Access time and duration
  

• Log and connection data
  

• Application performance data (crash logs, battery life, loading time, latency, framerate)
  

• Metadata
  

• Cookies
  

1.4 Transactions and Payment Data

We may collect certain transactions and payment data to facilitate payments for our services. These data include:

• Payment transactions
  

• Payment history
  

• Order numbers
  

• Service details
  

1.5 Information from Third Parties

We may receive certain personal data from third parties (e.g., our service providers, marketing partners, and third-party integrations).

1.5.1. Analytics. We may use website analytics and other third-party tools to provide you with the best possible experience with our platforms, Site, Services, and offerings. Some of our analytics partners include, but are not limited to:

• Google Analytics. Google Analytics provides statistics and analytical tools to support search engine optimization and marketing.
  

• Facebook. Facebook's tracking tools help us measure advertising effectiveness and understand user interactions. 
  

• Contentsquare. Contentsquare provides analytics and usage-data tools that collect anonymized data about page views, session duration, and user interactions to help us understand how visitors engage with our website.
  

1.6 Survey Responses

We may collect survey responses to learn how we can further improve our services and meet your needs.

1.7 Sensitive Information

We collect the following categories of sensitive Personal Information (as defined under specific US state privacy laws) from consumers:

• Contents of communications
  

• Account numbers
  

• Financial information
  

• Exact geolocation
  

• Children’s data
  

However, Waffle only collects or processes sensitive Personal Information with your consent. Waffle also does not use sensitive Personal Information to infer characteristics about you or your child.

2. How Do We Use Personal Information?

We use your Personal Information for various business purposes, including providing our Services, administrative purposes, and marketing products and services that may interest you, whether from Waffle or nonaffiliated third parties, as described below. 

When we process your Personal Information, we do so when (i) needed to perform our responsibilities in connection with our obligations to you, (ii) we have a legitimate interest in processing your Personal Information, (iii) we have a valid legal basis for doing so, and (iv) we have your consent to do so. We retain your Personal Information for as long as necessary to provide you with the Services. Sometimes, we retain your Personal Information for an extended period to comply with our legal obligations or as permitted by applicable law. Afterward, we retain some information in a de-identified and/or aggregated form, but not in a way that would personally identify you. We may use automation, including artificial intelligence, to assist us with these uses.

2.1 To Provide our Services

We use your information to fulfill our contract with you and provide you with our Services, such as:

• Managing your products, services, and accounts
  

• Managing your pre-orders and notifying you when Waffle products (Waffle Go and Waffle Home) are ready to ship
  

• Running the Squad Pledge program, including matching you to your chosen squad and unlocking group discounts when the squad reaches its threshold
  

• Providing access to certain features of our Services
  

• Answering requests for customer or technical support
  

• Communicating with you about your account, activities on our Services, and policy changes
  

• Billing and processing your payment methods for the Services
  

• Providing advertising, analytics, and marketing services
  

• Providing, developing, customizing, and personalizing the Services, including training artificial intelligence models (e.g., customer service, improving our Services, detecting spam, fraud prevention, etc.)
  

• Providing you with customized materials about offers, products, and services that may be of interest, including new content or services from us or nonaffiliated third parties
  

• Using the information for internal business purposes, such as data analysis, benchmarking, audits, research, analysis, studies, or surveys, and identifying usage trends
  

• Providing E911 emergency service routing
  

• Ensuring child safety
  

2.2 Administrative Purposes

We use your information for various administrative purposes, such as:

• Pursuing our legitimate interests, direct marketing, research and development (including marketing research), network and information security, and fraud prevention;
  

• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
  

• Measuring interest and engagement in our Services;
  

• Researching and developing products, services, marketing, or security procedures to improve their performance, resilience, reliability, or efficienchy;
  

• Improving, upgrading, or enhancing our Services and network infrastructure;
  

• Monitoring internal sales and other metrics;
  

• Managing and developing our business and operations;
  

• Ensuring internal quality control and safety;
  

• Authenticating and verifying your identities, including requests to exercise your rights under this Privacy Policy;
  

• Auditing relating to interactions, transactions, and other compliance activities;
  

• Enforcing our Terms of Service and other policies; and
  

• Complying with our legal obligations, protecting your vital interests, or as may be required for the public good.
  

2.3 Other Purposes

2.3.1 Consent. We may use Personal Information for other purposes disclosed to you when you provide Personal Information or with your consent.

2.3.2 Using de-identified and aggregated information. We might also share information collected from you from the Site with a third party if that information has been de-identified or aggregated in a way that does not directly identify you.

2.3.3 Location Data. We use location information to route wireless communications and to provide 911 service, which allows emergency services to locate your general location. We may disclose, without your consent, the approximate location of your wireless device to a governmental entity or law enforcement authority when we are served with lawful process or when we reasonably believe there is an emergency involving a risk of death or serious physical harm. Depending on your device type, you may also be able to access a wide array of services based on your device's location. These data services, known as Location-Based Services (“LBS”), are made available by us and other entities, usually via applications. These services use various location technologies and acquire location data from multiple sources. You should carefully review the privacy policies and other terms of third parties with whom you have authorized the sharing of your location information, and you should consider the risks involved in disclosing your location information to other people. Where we provide a location-based service, we will provide notice about the location features. You will also be provided with options for managing when and how such information should be shared.

3. When and With Whom Do We Share Your Personal Information?

We do not sell your specific Personal Information to third parties for monetary consideration.

We may disclose your Personal Information to third parties for various business purposes, including to provide our Service, to help respond to customer service inquiries, to protect us or others, or in the event of a significant business transaction such as a merger, sale, or asset transfer, as described below. We do not share your information with third parties who are not business partners (as discussed below) for their direct marketing purposes unless you consent. Waffle may use certain services to prevent fraud.

We may also use and share with third parties, including advertisers, non-Personal Information you provide when using the Services, such as general demographic and location information that does not personally identify you. Advertisers may use this information to make predictions about your interests or preferences and display advertisements on our Services and other sites across the Internet tailored to your interests. The use and disclosure of such non-personal information are not subject to any restrictions under this Privacy Policy.

We may share personal information with third parties in the following circumstances:

1. Business Transfers
   If we go through a corporate sale, merger, reorganization, receivership, dissolution, purchase or sale of assets, financing, bankruptcy, insolvency, reorganization, assignment for the benefit of creditors, or similar event, your Personal Information and Usage Data may be part of the assets sold, transferred, or shared in connection with due diligence for any such transaction as permitted by law and/or contract. Any acquirer or successor of Waffle may continue to use the information we collect from you through our Site as described in this policy.
   
   

2. Partners and Service Providers
   We may share information with third-party partners and service providers who help us deliver services, promotions, or technical infrastructure (such as hosting and maintenance services, data storage and management, and security, as well as fraud prevention). These parties are contractually bound to use the data only as necessary and follow strict privacy practices.
   
   VoIP Service Providers: We may share limited data with third-party telecommunications carriers, VoIP infrastructure providers, and cloud service providers to deliver calling functionality, route emergency calls (E911), and maintain service quality. This may include the caregiver’s service address (for E911 routing), call routing metadata, and device identifiers.
   
   We only provide our service providers with the information necessary for them to perform these services on our behalf. Each Service Provider and its subcontractors must agree to use reasonable security procedures, comply with the law, and adopt other practices appropriate to the nature of the information involved to protect your Personal Information and Contact Data from unauthorized access, use, or disclosure. Service Providers are prohibited from using Personal Information or Contact Data other than as specified by us.

3. Marketing and Advertising Platforms
   We may share certain caregiver information with advertising platforms for analytics, retargeting, and campaign optimization:
   

• Meta (Facebook):  Meta Platforms, Inc. (Facebook/Instagram) receives event data via the Meta Pixel and Meta Conversions API for the purpose of measuring and optimizing our advertising campaigns. Personal identifiers (email, name, phone, address) are hashed before being sent
  

• Google: Name, email address, phone number, shipping address (on order completion) and behavioral events.
  

4. Payment processing
   
   We use a third-party payment processor (Stripe), with whom we share transactions and payment data.

5. No Behavioral Tracking
   

We do not build user profiles for behavioral tracking or sell personal information for monetary gain.

6. Redirects and Analytics
   We may redirect users to a thank-you page upon purchase, which may include a transaction ID but no personally identifiable information.
   

7. Legal Requirements
   We may disclose personal information if required by law, regulation, legal process, or enforceable governmental request, or to protect legal rights, prevent fraud, or ensure safety.
   

8. Disclosures to Protect Others
   

We may disclose your Personal Information to a third party if (i) we believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process, or government request (including to meet national security or law enforcement requirements such as subpoenas or court orders), (ii) to obtain legal advice, (iii) to enforce our agreements and policies, (iv) to protect the security or integrity of the Site, or our Services and products, (v) to protect ourselves, our other customers, or the public from harm or illegal activities, (vi) to respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing a death or serious bodily injury; or (vii) permitted by law.

We may disclose, without your consent, the approximate location of your wireless device to a governmental entity or law enforcement authority when we are served with lawful process or when we reasonably believe there is an emergency involving a risk of death or serious physical harm.

If Waffle is required by law to disclose any of the Personal Information that directly identifies you, then we will use reasonable efforts to provide you with notice of that disclosure requirement unless we are prohibited from doing so by statute, subpoena, court, or administrative order. Further, we object to requests we do not believe were properly issued.

4. How Do We Safeguard Your Personal Information?

We are very concerned about safeguarding the confidentiality of your information. We employ measures designed to protect your information from unauthorized access, including HTTPS encryption, tokenization, role-based access controls, and regular security audits, and Secure Sockets Layer (“SSL”) for all financial transactions through this Site. Confidential and customer data is encrypted at rest and in transit per our Data Management Policy. Cryptographic controls follow best practices, including AES-256, strong TLS configurations, and secure key management per our Cryptography Policy. Additional measures include MFA, RBAC access controls, network segmentation, vulnerability management, secure development practices, continuous monitoring, logging, and annual review of security controls, consistent with SOC-2-aligned policies. 

However, no data transmission over the Internet or other networks can be guaranteed 100% secure. As a result, while we strive to protect information transmitted on or through the Site or Services, we cannot guarantee the security of any information you transmit on or through the Site or Services, and you do so at your own risk. We also cannot guarantee that unauthorized access, hacking, data loss, or a data breach will never occur.

Once we receive your Personal Information, we take steps that we believe are reasonable to limit access to your Personal Information to only those employees and service providers whom we determine need access to the Personal Information to provide the requested products, Services, offers, or opportunities that may be of interest to you or that you have ordered. However, even after we receive your Personal Information, we cannot and do not guarantee that it will not be accessed, disclosed, altered, or destroyed as a result of a breach of our security efforts or any other event beyond our reasonable control. Accordingly, we cannot and do not guarantee that your Personal Information or any other information is entirely secure or free from risk.

Our Site and Services may contain links to other websites or allow others to send you such links. A link to a third party’s website does not mean we endorse or are affiliated with it. We do not exercise control over third-party websites. You access such third-party websites or content at your own risk. You should always read the privacy policy of a third-party website before providing any information to the website. 

We continuously monitor, review, and enhance our security protocols to address evolving threats and maintain the highest standards of data protection.

5. Do We Use Cookies and Tracking Technologies?

Yes, we use cookies and similar tracking technologies, such as pixel tags and web beacons, for website performance, analytics, online behavior analysis, and ad personalization. These technologies help us understand how users interact with our site and improve your experience.

Types of Cookies and Technologies We Use

• Essential cookies — required for the website to function properly.
  

• Analytics cookies — help us understand how visitors interact with our website (Google Analytics and Contentsquare). These collect anonymized data about page visits, session duration, and user interactions.
  

• Advertising cookies — set by the Meta Pixel (Facebook/Instagram) to measure ad performance and attribute conversions. You can opt out via the cookie consent banner or by adjusting your Meta ad preferences.
  

You can manage your cookie preferences through the cookie consent banner on our website, or by adjusting your browser settings.

6. Is Your Information Transferred Internationally?

We are based in the United States, and we and our service providers may process Personal Information in the United States and other countries where we or our service providers operate. This may include access to Personal Information by customer-support personnel located outside the United States. These countries may have privacy laws that differ from those in your jurisdiction. We require service providers processing Personal Information on our behalf to use the information only as instructed by us, maintain appropriate safeguards, and comply with applicable data-protection requirements.

7. How Long Do We Keep Your Information?

As explained in this Privacy Policy, we will store your Personal Information for as long as it is reasonably necessary for the purposes for which it was collected. In some circumstances, we may store your Personal Information for extended periods, for instance, where we are required to do so by legal, regulatory, tax, or accounting requirements. In specific circumstances, we may store your Personal Information for extended periods to record your dealings with us in case of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your Personal Information or dealings.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including to provide services, meet legal or regulatory requirements, resolve disputes, and enforce our agreements.

Retention periods vary based on the type of data:

• Most app usage and child-related activity data (e.g., app usage, child call/text/location history, child’s routine completion, child’s happiness ratings) is retained for 24months.
  

• Survey data is retained for 24months.
  

• Web traffic and marketing analytics data (e.g., Google Analytics) is retained for 24months.
  

• Purchase and financial data (e.g., Stripe) is retained perpetually or indefinitely, as required for financial reporting.
  

• Caregiver and child account information, including messages, is retained for the Lifetime of the Customer (defined as the duration of time when the caregiver remains Waffle’s customer) plus 24 after termination of service.
  

• Crash reports are retained for 24 months.
  

• Waffle Home VoIP data: Waffle Home call logs, call duration, and VoIP service records are retained for the Lifetime of the Customer plus 24 months after termination of service, consistent with caregiver account data.
  

• E911 service address: Waffle Home E911 service address records are retained for the Lifetime of the Customer plus 24 months after termination of service, consistent with caregiver account data.
  

• Notification keys and Google Play app installs are retained for the Lifetime of the Customer plus 24 months.
  

• Affiliate and clickstream data is retained for 24months to perpetuity, depending on the tool used.
  

We regularly review our data retention practices and securely delete or anonymize data that is no longer needed.

8. How Do We Protect Privacy of Children’s Data?

Waffle is designed to support children and their families in developing healthy digital habits. We are committed to protecting children’s privacy and complying with applicable U.S. laws, specifically the Children’s Online Privacy Protection Act (COPPA). 

Parental Consent

We do not knowingly collect personal information from children under 13 years old in the United States without verifiable parental consent. Before a child can use a Waffle device, a parent or caregiver must set up and manage the account via the caregiver portal (available through web and app versions).

The parents are contracting with us for this service and may cancel at any time. Upon cancellation, personal information is retained for a limited period in accordance with our data retention policy (typically the Lifetime of the Customer plus _ days, or as otherwise specified).

Data Collected from Children

Through parent-managed accounts, we may collect the following information associated with the child:

• First name or nickname
  

• Contact safelist (approved names/numbers)
  

• Call, message, and voicemail metadata
  

• Text messages and images
  

• Voice message recordings
  

• User-generated content
  

• App usage data
  

• GPS location data
  

• Call logs, call duration, and voicemail
  

• Routine completion and sentiment data
  

This data is used to deliver parental controls, enable core device functionality, provide usage summaries, and offer product feedback to caregivers. It is never used to profile or market to children.

Caregivers may request deletion of their child’s Waffle Home data by contacting hello@wafflekids.co.

9. What Are Your Privacy Rights?

9.1 Your Privacy Rights – General 

To the extent required by applicable law, you may have the right to:

• Access, know, or port information about you, including (i) confirming whether we are processing your Personal Information; (ii) the specific pieces and categories of your Personal Information collected; (iii) the categories of sources from where your data is collected; (iv) the purpose for collecting your Personal Information; (v) the categories of third parties with whom we have shared your Personal Information; (vi) obtaining access to or a copy of your Personal Information in a structured, commonly used, and machine-readable format; and (vii) receiving an electronic copy of Personal Information that you have provided to us, or asking us to send that information to another company in a structured, commonly used, and machine-readable format (the “right of data portability”).
  

• Request correction of your Personal Information where it is inaccurate or incomplete. In some cases, we may provide self-service tools that enable you to update your Personal Information or refer you to the controller who can correct it.
  

• Request deletion of your Personal Information, subject to certain exceptions prescribed by law.
  

• Request restriction of or object to processing your Personal Information, including sensitive Personal Information.
  

• Withdraw your consent to our processing of your Personal Information.
  

• Restrict the use of sensitive Personal Information.
  

• Access information on Automated Decision-Making related to your Personal Information.
  

To exercise the rights listed above, please get in touch with us as described in the “Contact Us” section below. Before taking any action regarding your information, we may ask you for additional information to confirm your identity and for security purposes.

Please note that even if you request that we delete the information we’ve collected from you, we may still retain your information in an aggregated or anonymized form that does not identify you. We will also not delete your information if we are legally required to retain it, if it is necessary to comply with our legal obligations, resolve disputes, enforce our agreements, or protect against fraudulent, deceptive, or illegal activity.

9.2. Your Privacy Choices

9.2.2 Marketing Communications. If you decide that you no longer wish to receive emails or text messages from Waffle that you had authorized, you may opt out of receiving emails and text messages by:

• Managing your account preferences on this Site
  

• Clicking through an “Unsubscribe” link contained in all marketing emails
  

• Texting STOP in response to any marketing text message from Waffle
  

• Any other reasonable opt-out method available to you
  

• Contacting us as described in the “Contact Us” section below
  

Please note that Waffle may need to contact you regarding product or service orders you place. You cannot opt out of receiving product or service-related communications.

10. What Do-Not-Track Controls Do You Have?

Waffle participates in a service called the Global Privacy Control (“GPC”) that lets you set a “Do Not Sell or Share” preference at the browser level. You’ll need a GPC-enabled browser or a browser extension that you’ll activate in the browser. When you visit a website, your browser automatically sends the Site a “Do Not Sell or Share” signal, and participating websites like ours will honor your preferences. Note: Not all browsers and extensions offer a GPC setting. To download a GPC-enabled browser, go to the Global Privacy Control website. To check if our website received your GPC signal, click the “Do Not Sell or Share My Personal Information” link in our footer. If we receive your GPC signal, we’ll automatically opt you out of selling your Personal Information and tell you that a GPC signal was used. When detecting your active GPC signal, we won’t allow you to opt back into selling or sharing your Personal Information. 

11. Supplemental Notice for State Privacy Laws – United States

This supplemental notice (“Supplemental Notice”) for California, Colorado, Connecticut, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia residents (“Supplemental Notice States”) only applies to our processing of Personal Information that is subject to the California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (“CPRA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CDPA”), the Delaware Personal Data Privacy Act (“DPDPA”), the Iowa Consumer Data Protection Act (“ICDPA”), the Indiana Data Protection Act (“IDPA”), the Kentucky Data Privacy Act, the Maryland Online Data Privacy Act (“MODPA”), the Minnesota Consumer Data Privacy Act (“MCDPA”), the Montana Consumer Data Privacy Act (“MCDPA”), the Nebraska Data Privacy Act (“NDPA”), the New Jersey Data Protection Act (“NJDPA”), New Hampshire Privacy Act (“NHPA”), the Oregon Consumer Privacy Act (“OCPA”), the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”) the Tennessee Information Protection Act (“TIPA”), the Texas Data Privacy and Security Act (“TDPSA”), the Utah Consumer Privacy Act (“UTCPA”), and the Virginia Consumer Data Protection Act (“VCDPA”) (collectively the “State Privacy Law(s)”) and applies solely to individuals (“Consumer” or “you”). 

11.1 Information We Collect

In providing our Services, we may collect Personal Information. Personal Information does not include:

• Deidentified or aggregated consumer information
  

• Publicly available information from government records.
  

• Personal Information excluded from the Supplemental Notice States scope, like health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) or clinical trial data; Personal Information covered by specific sector-specific privacy laws, including the Fair Credit Reporting Act (“FCRA”), the Gramm-Leach-Bliley Act “GLBA”) or California Financial Information Privacy Act “FIPA”), and the Driver’s Privacy Protection Act of 1994.
  

This Supplemental Notice does not address our handling of Personal Information about consumers, which we undertake on behalf of our customers to provide those customers with our products and services. In those contexts, we act as a service provider.

We may have collected the following categories of Personal Information from our consumers in our role as a business within the last twelve (12) months:

*Note: While we do not sell Personal Information for monetary consideration, our use of certain advertising and analytics services may be considered a “sale” or “sharing” under state privacy laws.

The categories of sources from which we collect Personal Information and our business and commercial purposes for using Personal Information are outlined in “Personal Information We Collect” and “How We Use Your Personal Information” above, respectively.

11.2 Your Rights and Choices

The State Privacy Laws provide state residents with specific rights regarding their Personal Information. If you are a resident of one of the states with State Privacy Laws, you can opt out of automated profiling that produces legal or similarly significant effects. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child. To designate an authorized agent, please contact us as outlined in “Contact Us” below and provide written authorization signed by you and your designated agent. To protect your privacy, we will take the following steps to verify your identity before fulfilling your request. When you make a request, we will ask you to provide sufficient information to confirm that you are the person from whom we collected Personal Information or an authorized representative. This may include asking you to answer questions regarding your account and use of our Services.

11.3 Exercising Your Rights

If you want to exercise your rights, you can contact us as outlined in the “Contact Us” section below; we will respond to verifiable requests received as required by law. We may also ask you for additional information to verify or process your request. We may also check your identity with third-party identity verification services before taking any action on your Personal Information. We will respond substantively to your verifiable requests within the periods required by law, which is most likely within 45 days unless additional time (up to 45 extra days) is needed, in which case we will let you know.

Certain states permit businesses to charge consumers a fee for excessive requests; we may do so as well.

11.4 Verifiable Requests for Copy, Deletion, and Right to Know

Subject to certain exceptions, California consumers can make the following requests twice every twelve (12) months. If we determine that the consumer’s request is excessive, we may charge a fee or notify the consumer of the reason for the denial.

11.5 Sales of Personal Information and Targeted Advertising

While we do not sell Personal Information for monetary consideration, we work with nonaffiliated third parties for marketing purposes that help deliver targeted advertising to you. Our use of these services may be considered a “sale” or “sharing” of your Personal Information under certain State Privacy Laws. You may opt out of such selling by reaching out to us using a contact method listed in the “Contact Us” section below.

11.6 Sensitive Personal Information

California residents have the right to limit the use of “sensitive Personal Information” (as defined in the CCPA). However, Waffle already only collects or processes sensitive Personal Information with your consent and for those purposes specified in the CCPA. Waffle also does not use sensitive Personal Information to infer characteristics about you.

11.7 Incentives and Discrimination

We will not discriminate against you for exercising your State Privacy Law rights. We may offer specific financial incentives permitted by State Privacy Laws with different prices, rates, or quality levels. Any permitted financial incentive we provide in the Supplemental Notice States will reasonably relate to your Personal Information’s value and contain written terms describing the program’s material aspects. Participation in an economic incentive program requires prior opt-in consent, which you may revoke at any time.

11.8 How to Resolve Disputes Relating to Our Privacy Practices

If you have a dispute regarding our privacy practices, please contact us as described in the “Contact Us” section below. If we decline to act in response to any of your privacy requests, you have the right to appeal that decision within a reasonable amount of time, but no later than 90 days from the date of our decision. To submit an appeal request, you can exercise this right by contacting us as described in the “Contact Us” section below. If you believe your rights have been violated and cannot resolve the issue directly with us, you may file a complaint with your state attorney general’s office.

11.9 California’s “Shine the Light” Law

Civil Code Section §1798.83 permits users of our Sites and Services who are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please contact us as outlined under “Contact Us” below.

11.10 SUPPLEMENTAL NOTICE FOR NEVADA RESIDENTS

If you are a resident of Nevada, you have the right to opt out of the sale of certain Personal Information to third parties. You can exercise this right by contacting us as outlined in “Contact Us” below, with the subject line “Nevada Do Not Sell Request,” and by providing your name and the email address associated with your account. Please note that we do not currently sell your Personal Information as sales are defined in Nevada Revised Statutes Chapter 603A. If you have any questions, please get in touch with us as outlined in “Contact Us” below.

12. Updates to This Policy

From time to time, we may revise this Privacy Policy. Your use of the Site or any Waffle product or Service following the posting of any revised Privacy Policy shall be deemed acceptance of the revised policy. We may notify you of changes, and you are responsible for ensuring we have up-to-date contact information for you, and for periodically reviewing this privacy policy to check for any changes. Continued use of the Site or any Waffle product or Service constitutes your agreement to any Privacy Policy as in effect. If you disagree with the terms of the Privacy Policy at any time, you may exercise your rights under applicable law or discontinue using our services.

13. How Can You Contact Us?

To exercise your privacy rights or for privacy-related questions, please contact us at hello@wafflekids.co. 

14. SMS Terms and Conditions

Waffle may send marketing, customer service, and account notifications via email and SMS.

1. You can cancel the SMS service at any time. Simply text “STOP” to the number provided. Upon sending “STOP,” we will confirm your unsubscribe status via SMS. Following this confirmation, you will no longer receive SMS messages from us. To rejoin, sign up as you did initially, and we will resume sending SMS messages to you.
   

2. If you experience issues with the messaging program, reply with the keyword HELP for more assistance, or reach out directly to support@wafflekids.co[email address].
   

3. Carriers are not liable for delayed or undelivered messages.
   

4. As always, message and data rates may apply for messages sent to you from us and to us from you. Message frequency varies. For questions about your text plan or data plan, contact your wireless provider.
   

5. For privacy-related inquiries, please refer to our Privacy Policy above.