---

This Privacy Policy ("Policy") describes how Overturn LLC, doing business as VidSell ("VidSell," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with your use of the VidSell platform and services ("Services"), available at https://www.vidsell.io.

This Policy applies to two distinct groups: (1) Customers — individuals or businesses who register for and use the VidSell platform to build pages, host videos, manage communities, and sell products; and (2) End Users — the individuals who interact with the pages, communities, and checkout flows that Customers create using VidSell.

If you are a Customer's End User (e.g., you purchased something through a VidSell-powered page or joined a VidSell-hosted community), the Customer is the data controller for your personal data. You should also review the Customer's privacy policy. We process your data on their behalf as a data processor.

If you have questions about this Policy, contact us at: support@zeruapps.com

---

1. INFORMATION WE COLLECT

1.1 Information You Provide Directly

When you register for or use the Services, we collect:

• Account Information: Name, email address, and password.
• Billing Information: Payment details (processed and stored by Stripe; we do not store full card numbers). Billing address if required for tax purposes.
• Business Contact Information: When configuring an Engage community, we collect your business or trading name and a valid physical mailing address. This information is required for inclusion in the footer of community notification emails as mandated by applicable law (including CAN-SPAM). If you operate as an individual, your personal name and mailing address are collected for this purpose.
• Profile Information: Any additional information you choose to add to your account.
• Communications: Messages or inquiries you send to our support team.

1.2 Information Collected Automatically

When you access the Services, we automatically collect:

• Log Data: IP address, browser type, operating system, referring URL, pages viewed, and timestamps.
• Device Information: Device type, unique device identifiers, and browser settings.
• Usage Data: Feature interactions, clicks, session durations, and navigation paths within the application.
• Analytics Data: Video view counts, community engagement metrics, and flow performance data. This data is aggregated and non-personally-identifiable where possible.

1.3 Cookies and Similar Technologies

We use cookies and similar tracking technologies to operate and improve the Services. See our Cookie Policy for full details at https://www.vidsell.io/legal-cookies.

• Strictly Necessary Cookies: Session authentication cookies required for the VidSell application to function. These cannot be disabled without disrupting core functionality.
• Functional Cookies: Used to store push notification subscription tokens for End Users who opt in to community notifications via the Engage feature.

We also use analytics cookies on our marketing website to understand visitor behavior and improve user experience. These cookies are only set with your consent via our cookie consent tool. Additionally, if you arrived at our website through an affiliate link, affiliate tracking cookies may be set to attribute your visit. For full details of every cookie, including names, durations, and consent requirements, see our Cookie Policy.

2. INFORMATION COLLECTED ABOUT END USERS

When your End Users interact with pages, communities, checkout flows, or forms you build using VidSell, we collect data on your behalf as a data processor. This data may include:

• Contact Information: Name and email address submitted via lead capture or community signup forms.
• Purchase Information: Products purchased, order details, and transaction IDs (payment card data is handled entirely by Stripe and never passes through our systems).
• Community Account Data: Username, email, profile data, and optional job title or professional title created when End Users register for your branded Engage community.
• Behavioral Data: Page visits, video engagement, course progress, and community activity.
• Tags: Automated tags applied to contacts based on their actions within your flows and community.

As a Customer, you are the data controller for your End Users' data. You are responsible for providing appropriate privacy notices to your End Users and ensuring you have a lawful basis to collect their data. We process this data only as instructed by you.

3. HOW WE USE INFORMATION

3.1 For Customers

We use Customer information to:

• Create, manage, and authenticate your account.
• Process and manage subscription billing and payments.
• Provide and maintain the Services, including troubleshooting and technical support.
• Send service-related and transactional communications, including account notices, billing confirmations, policy updates, and security alerts. These communications are non-negotiable and cannot be opted out of while your account is active.
• Send marketing and promotional communications from Overturn LLC about VidSell features, updates, new products, and other Zeru Apps platforms and services. Zeru Apps operates multiple products and, as a Customer of any Zeru Apps product, you may receive communications about our broader product portfolio. The Zeru Apps brand and its relationship to its individual products is prominently disclosed on each product website. We rely on legitimate interests as the legal basis for this processing (see Section 4). You may opt out of marketing communications at any time using the unsubscribe link in any email without affecting your account.
• Analyze usage patterns to improve and develop the Services.
• Protect the security and integrity of the Services.
• Comply with legal obligations.

3.2 For End Users (on behalf of Customers)

We process End User data as a data processor, solely as instructed by the Customer, to:

• Store submitted lead contact information in the Customer's Micro-CRM (People).
• Facilitate e-commerce transactions via Stripe Connect.
• Manage community accounts, memberships, and access permissions.
• Deliver email and push notifications on the Customer's behalf.
• Track course progress and tag contacts based on completed actions.
• Pre-fill forms on subsequent pages using functional cookies.

4. LEGAL BASES FOR PROCESSING (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom (UK), we rely on the following legal bases to process your personal data:

• Performance of a Contract (Article 6(1)(b)): Processing necessary to provide, maintain, and administer the Services you have subscribed to, including billing, account management, and technical support.
• Legitimate Interests (Article 6(1)(f)): Marketing and promotional communications about VidSell and other Zeru Apps products sent to existing Customers. We rely on legitimate interests rather than consent for this processing because: (1) Customers enter a relationship with Overturn LLC — the parent company — whose brand and product portfolio is openly disclosed on each product website, giving rise to a reasonable expectation that Zeru Apps may communicate about its other products; (2) the marketing is directed only at existing Customers with an established commercial relationship; and (3) a clear and easy opt-out is provided in every communication. This basis is also used for analytics, security monitoring, fraud prevention, and platform improvement.
• Legitimate Interests (Article 6(1)(f)) — continued: Where we send marketing communications to EU/UK Customers, we have assessed that our legitimate interests are not overridden by Customer rights given the existing business relationship, the reasonable expectations created by the visible Zeru Apps brand identity across all products, and the low privacy impact of B2B product communications. Customers retain the right to object to this processing at any time (see Section 12).
• Legal Obligation (Article 6(1)(c)): Where processing is required by applicable law, such as tax, financial reporting, or law enforcement requirements.

As a data processor for Customer End Users, we process End User data on the basis of the Customer's instruction and their relevant legal basis as data controller.

5. HOW WE SHARE INFORMATION

5.1 Sub-Processors and Service Providers

We share data with trusted third-party service providers who assist in operating the Services. These parties are contractually bound to protect data and to use it only as instructed. Key categories include:

• Application Infrastructure: Third-party application infrastructure providers that host and operate the VidSell platform and associated services.
• Payment Processing: Stripe, Inc. (subscription billing and, via Stripe Connect, Customer end-user transactions).
• Push Notifications: OneSignal, Inc. (delivery of push notifications to End Users who opt in to community notifications via the Engage feature).
• Customer Marketing: Encharge.io (email marketing and CRM for Zeru Apps' own marketing communications to Customers; no End User data is shared with this service).
• Analytics: Internal cookieless analytics for non-PII platform metrics.
• Cloud Infrastructure: Server and storage providers located in the United States.

5.2 Stripe Connect and Platform Transaction Fees

When Customers enable the checkout feature, they connect their own Stripe account. End User payment data is transmitted directly to and processed by the Customer's connected Stripe account. We do not access or store payment card numbers.

VidSell charges a platform transaction fee implemented as a Stripe Connect application fee. As part of this mechanism, we receive transaction-level data from Stripe necessary to calculate and collect the applicable fee — including transaction amounts, timestamps, and workspace identifiers. This data is used solely for fee calculation, billing reconciliation, and fraud prevention purposes and is not shared with third parties.

5.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of the transaction. We will notify you via email or a prominent notice on our website prior to such a transfer.

5.4 Legal Requirements

We may disclose information if required by law, subpoena, or court order, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of us, our users, or the public.

5.5 Affiliate Program Data Sharing

If you purchase a VidSell subscription or lifetime license through an affiliate referral link, limited information about your purchase — including your name, email address, and transaction amount — may be shared with the referring affiliate partner for the purpose of calculating and verifying affiliate commissions. This sharing is based on our legitimate interest in operating the affiliate program and the affiliate's legitimate interest in receiving compensation for referrals. Affiliate partners are contractually required to use this information solely for commission verification purposes and to comply with applicable data protection laws. You may contact us at legal@zeruapps.com to object to this processing.

5.6 No Sale of Personal Data

We do not sell your personal data to third parties for monetary consideration.

6. COOKIES AND TRACKING TECHNOLOGIES

Our full Cookie Policy is available at https://www.vidsell.io/legal-cookies. A summary of the key cookies used:

• Strictly Necessary Cookies: Session authentication cookies required for the VidSell application to function. Cannot be opted out of without impairing core functionality.
• Functional Cookies: Push notification subscription tokens set by OneSignal for End Users who opt in to community notifications. Set only for users who explicitly grant push notification permission.

VidSell does not use advertising or behavioral targeting cookies. We use analytics cookies and affiliate tracking cookies on our marketing website with your consent. You can manage cookie preferences through your browser settings or our cookie consent tool. See our full Cookie Policy for details.

7. THIRD-PARTY SUB-PROCESSORS

A list of our key sub-processors is maintained below. We will update this list when sub-processors change. Where required by applicable law (including GDPR Article 28), we will provide at least 30 days' prior written notice before engaging a new sub-processor or making material changes to an existing one, giving you the opportunity to object. Notice will be provided via email or in-app notification.

• Application infrastructure provider — Platform hosting and application operation (USA). The identity of this provider is considered confidential business information and is not disclosed; however, this provider is bound by confidentiality and data protection obligations consistent with this Policy, including appropriate safeguards for international data transfers.
• Stripe, Inc. — Payment processing and subscription billing (USA)
• OneSignal, Inc. — Push notification delivery for Engage community features (USA)
• Encharge.io (PXCH Holding I, LLC) — Email marketing and CRM for Zeru Apps' own Customer communications (USA). No End User data is shared with this service. DPA available at gdpr.encharge.io/dpa. Transfers rely on Standard Contractual Clauses (Module 2).
• Transactional email service provider — Transactional email delivery for account-related, community, and system notifications (EU). Processes email addresses, names, and communication metadata on our behalf. Bound by a GDPR Article 28 data processing agreement annexed to their terms of service.
• Video content delivery provider — Video storage and content delivery network for the video hosting add-on (global CDN). The identity of this provider is considered confidential business information; however, this provider processes network connection data, IP addresses, user agent strings, and URL referrer information in the course of delivering content. This provider is bound by a GDPR Article 28 Data Processing Agreement with a 48-hour breach notification commitment and maintains appropriate technical and organizational security measures.
• Website analytics provider — Visitor analytics and heatmap data on the VidSell marketing website (www.vidsell.io) only. Processes IP addresses, browser/device information, and page interaction data. Analytics cookies are set only with your consent via our cookie consent tool. Does not process End User data within the VidSell application.
• Affiliate tracking provider — Affiliate referral tracking on the VidSell marketing website. Sets cookies to attribute referrals and processes limited purchase data (name, email, transaction amount) to calculate affiliate commissions. Cookie duration is 60 days. See our Cookie Policy for details on the specific cookies set.
• Content storage provider — Storage of Customer-uploaded media assets including images, documents, and temporary video files pending transcoding (USA). The identity of this provider is considered confidential business information; however, this provider is bound by a Data Processing Agreement consistent with GDPR Article 28 requirements and maintains appropriate technical and organizational security measures.
• Content delivery and DDoS protection provider — Content delivery network and DDoS protection for Customer-uploaded media assets served via hosted URLs (global CDN). Also handles temporary routing for video files pending transcoding. Processes access logs, IP addresses, and request metadata in the course of delivering content and providing security services.
• Convertful — On-site forms, popups, banners, and promotional content on the VidSell marketing website (www.vidsell.io) only. May set cookies to manage form display frequency and track form interactions. Cookies are set only with your consent via our cookie consent tool. Does not process End User data within the VidSell application.

Full details and Data Processing Agreements are available upon request at legal@zeruapps.com.

8. DATA SECURITY

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit (TLS/SSL), access controls, and security monitoring.

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. You are also responsible for maintaining the security of your account credentials.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and applicable regulatory authorities without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by applicable law (including GDPR Article 33). Our Data Processing Addendum (Section 28 of our Terms of Service) contains additional detail on breach notification obligations for Customer Personal Data.

9. DATA RETENTION

We retain Customer account data for as long as your account is active and for a period of up to 90 days following account termination, after which it is deleted or anonymized.

End User data stored in your Micro-CRM (People) is retained until you delete it or until your account is terminated. Certain data may be retained for a longer period if required by applicable law — for example, transaction records and billing data may be retained for up to seven (7) years to comply with tax, accounting, and financial reporting obligations.

Backup data may persist for a limited period following deletion requests, consistent with our backup rotation schedule, but will not be used for any active processing.

10. INTERNATIONAL DATA TRANSFERS

Our servers are located in the United States. If you are accessing the Services from outside the United States, your data will be transferred to, processed in, and stored in the United States.

For users in the EEA, UK, or Switzerland, we rely on appropriate safeguards for international data transfers as required by applicable law. Specifically:

• Where we transfer personal data to sub-processors located in the United States or other third countries, we ensure that each sub-processor has implemented appropriate transfer mechanisms, including the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum (UK IDTA). These mechanisms are incorporated into each sub-processor's Data Processing Agreement, which governs our relationship with that sub-processor.
• Our key sub-processors — including OneSignal, Inc., Stripe, Inc., and Encharge.io — each maintain their own DPAs incorporating the applicable SCCs and transfer mechanisms. Links to or copies of these DPAs are available upon request at support@zeruapps.com.

A full list of our sub-processors is set out in Section 7 of this Policy. We will provide at least 30 days' prior written notice before engaging any new sub-processor that may involve an international transfer of personal data, consistent with our obligations under applicable data protection law.

For questions about our international transfer mechanisms or to request copies of applicable DPAs, please contact us at support@zeruapps.com.

11. CHILDREN'S PRIVACY

The Services are intended for use by individuals who are at least 18 years of age. We do not knowingly collect or solicit personal information from anyone under the age of 18. If we learn that we have collected personal information from a child under 18, we will delete it promptly.

If you believe we may have collected information from a minor, please contact us at support@zeruapps.com.

Note: Customers who use VidSell to host communities or sell products are responsible for ensuring that their own End Users comply with age restrictions applicable to their specific content or services.

12. YOUR PRIVACY RIGHTS (ALL USERS)

Regardless of your location, you may exercise the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention obligations.
• Opt-Out of Marketing: Unsubscribe from marketing emails at any time using the unsubscribe link in any email, or by contacting us at support@zeruapps.com.
• Data Portability: Where applicable, request a portable copy of your data.

To submit a data subject access request (DSAR), please email support@zeruapps.com or visit our DSAR page at https://www.vidsell.io/legal-dsar. We will respond within 30 days (or within the timeframe required by applicable law).

If you are an End User of a Customer's VidSell-powered page or community, please contact the Customer directly, as they are the data controller for your data. We will cooperate with Customers to fulfill End User requests.

13. CALIFORNIA PRIVACY RIGHTS (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of categories and specific pieces of personal information we have collected, disclosed, or sold.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: We do not process sensitive personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Categories of Personal Information Collected in the Past 12 Months:

Category	Examples	Collected
A. Identifiers	Name, email address, IP address, account username	YES
B. Commercial Information	Subscription tier, payment history, product purchases	YES
C. Internet / Network Activity	Video views, page visits, feature engagement (non-PII analytics)	YES
D. Geolocation Data	Approximate location based on IP address	YES
E. Professional or Employment Info	Job title or professional title optionally provided by End Users in Engage community profiles	YES
F. Biometric Information	None	NO
G. Protected Classification Characteristics	None	NO
H. Sensitive Personal Information	None	NO
I. Inferences	Usage patterns derived from interaction data	YES

To submit a CCPA request, contact us at support@zeruapps.com. We will verify your identity before processing your request. We will respond within 45 days. You may designate an authorized agent to submit requests on your behalf; the agent must provide proof of authorization.

14. EEA / UK PRIVACY RIGHTS (GDPR / UK GDPR)

If you are located in the European Economic Area or United Kingdom, you have the following rights:

• Right of Access (Article 15 GDPR)
• Right to Rectification (Article 16 GDPR)
• Right to Erasure / Right to be Forgotten (Article 17 GDPR)
• Right to Restriction of Processing (Article 18 GDPR)
• Right to Data Portability (Article 20 GDPR)
• Right to Object to Processing (Article 21 GDPR)
• Rights related to Automated Decision-Making (Article 22 GDPR)

To exercise these rights, contact us at support@zeruapps.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at: ec.europa.eu.

Our designated Data Protection contact for GDPR purposes is reachable at legal@zeruapps.com.

Right to Object to Marketing: You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling related to such marketing. If you object, we will cease processing your data for marketing purposes without delay. To exercise this right, use the unsubscribe link in any marketing email or contact us at legal@zeruapps.com.

EU/UK Representative: We do not currently maintain an establishment in the EEA or UK. If you are located in the EEA or UK and have concerns about our processing of your personal data, you may contact us directly at legal@zeruapps.com. We are evaluating the appointment of an EU representative under Article 27 GDPR and a UK representative under Article 27 UK GDPR as our user base grows, and will update this Policy when such appointments are made.

15. CANADIAN PRIVACY RIGHTS (PIPEDA / QUÉBEC LAW 25)

If you are located in Canada, we process your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Québec Law 25.

You have the right to access, correct, and request deletion of your personal information. To exercise these rights, contact us at support@zeruapps.com.

16. DO NOT TRACK

We do not currently respond to 'Do Not Track' (DNT) signals from browsers because no uniform industry standard for recognizing and implementing DNT has been adopted. We will update this Policy if a standard is established.

17. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or applicable laws. We will notify you of material changes by updating the 'Last Updated' date at the top of this Policy and, where appropriate, by email or in-app notification. Your continued use of the Services after the effective date of any change constitutes your acceptance of the updated Policy.

18. CONTACT US AND DATA SUBJECT REQUESTS

For privacy-related inquiries, data subject access requests, or complaints:

Data Subject Access Requests: Email legal@zeruapps.com with the subject line 'DSAR Request' and include your full name, email address associated with your account, and a description of your request. We will verify your identity and respond within the timeframe required by applicable law.