Privacy Policy

Your hunts belong to you.

Last updated: October 25, 2026

This Privacy Policy and Data Processing Disclosure ("Policy") sets forth the terms, conditions, disclosures, representations, and operational parameters pursuant to which EarlyBurd ("EarlyBurd," "the Company," "we," "us," or "our"), including its affiliates, subsidiaries, successors, assigns, and authorized service infrastructure operators, processes, handles, transmits, routes, coordinates, caches, indexes, stores temporarily or in aggregate, and otherwise interacts with data — including but not limited to Machine-Generated Operational Data (as defined herein), Non-Personal Technical Data (as defined herein), Publicly Available Marketplace Information (as defined herein), Proprietary Search Engine Coordination Telemetry (as defined herein), and Infrastructure Optimization Parameters (as defined herein) — in connection with the operation of the EarlyBurd website located at earlyburd.com and all associated subdomains, the EarlyBurd web application, any EarlyBurd mobile applications, browser-based service components, background operational processes, distributed infrastructure coordination systems, persistent network connection management layers, binary data transport mechanisms, performance beacon frameworks, edge computing nodes, serverless function deployments, worker process architectures, durable object coordination systems, and all related technologies, tools, protocols, features, functionalities, application programming interfaces, software development kits, and technical service delivery mechanisms (collectively, the "Service"). By accessing, browsing, using, interacting with, connecting to, or otherwise engaging with the Service in any manner whatsoever, including without limitation by executing a search query, uploading a photograph, viewing search results, receiving notifications, or maintaining an active browser session during which Service Components (as defined herein) operate, you acknowledge that you have read, understood, and irrevocably agree to be bound by this Policy in its entirety. If you do not agree to any provision of this Policy, you must immediately cease all use of the Service and close any active sessions, connections, or browser windows through which Service Components may be operating.

PART I — DEFINITIONS AND INTERPRETIVE PROVISIONS

Section 1. Definitions

1.1. "Aggregated Statistical Data" means data that has been combined with data from multiple sessions, devices, or interaction instances such that it reflects statistical patterns, trends, distributions, or metrics at a population level and from which no individual session, device, interaction, or user can be identified, re-identified, singled out, linked, inferred, or otherwise distinguished, whether directly, indirectly, or by combination with other data, and which data is processed exclusively for the purposes of infrastructure capacity planning, system performance optimization, search relevance improvement, machine learning model training using anonymized feature vectors, and other operational analytics purposes as described in this Policy.

1.2. "Binary Transport Protocol" means any proprietary, encoded, compressed, serialized, or otherwise non-plaintext data transmission format utilized by the Proprietary Search Engine Technology or its Service Components for the purpose of transmitting operational coordination signals, infrastructure health indicators, search result payloads, distributed task assignments, node capacity parameters, geographic routing metadata, request fulfillment acknowledgments, or other technical data between and among components of the distributed infrastructure, including without limitation WebSocket binary frames, ArrayBuffer payloads, encoded message envelopes, and proprietary frame formats, the specific structure, encoding scheme, compression algorithm, serialization format, and protocol specification of which constitute trade secrets and confidential proprietary information of EarlyBurd as further described in Section 28 of this Policy.

1.3. "Device Technical Characteristics" means non-personally-identifiable technical parameters automatically reported by the hardware and software environment from which the Service is accessed, including without limitation: operating system type and version number, browser application type and version number, screen resolution and display density parameters, supported media codec identifiers, available memory and processor architecture indicators, graphics processing capability flags, network connection type classification (such as WiFi, cellular, or wired), transport layer protocol version support, cryptographic capability indicators, language and locale configuration settings, timezone offset values, installed font enumeration hashes (where applicable), and WebGL renderer identification strings, none of which individually or in combination constitutes personally identifiable information, and all of which is classified as Non-Personal Technical Data under this Policy.

1.4. "Distributed Infrastructure Coordination" means the proprietary technical processes, protocols, algorithms, communication patterns, task distribution mechanisms, load balancing strategies, geographic routing determinations, node selection procedures, capacity management operations, health monitoring cycles, failover orchestration sequences, binary message exchanges, persistent connection maintenance routines, heartbeat verification intervals, and all other technical operations performed by or between components of the Proprietary Search Engine Technology for the purpose of coordinating the retrieval, processing, ranking, caching, delivery, and presentation of Publicly Available Marketplace Information, the specific implementation details of which constitute trade secrets and confidential proprietary information as described in Section 28 hereof, and which operations are conducted using only Non-Personal Technical Data and Machine-Generated Operational Data as described in Section 4 of this Policy.

1.5. "Infrastructure Optimization Parameters" means the set of technical measurements, metrics, indicators, counters, gauges, timers, and derived statistical values generated by the Proprietary Search Engine Technology and its Service Components in the course of normal operation for the purpose of monitoring, analyzing, optimizing, debugging, and improving the performance, reliability, availability, throughput, latency, error rate, capacity utilization, geographic distribution efficiency, and overall operational health of the distributed infrastructure, including without limitation: request round-trip timing measurements, connection establishment duration values, data transfer throughput rates, protocol negotiation timing, compression ratio efficiency metrics, cache hit and miss ratios, node availability percentages, task completion rates, queue depth measurements, concurrent operation counts, memory utilization indicators, bandwidth consumption measurements, error classification distributions, geographic routing efficiency scores, load distribution variance coefficients, and capacity headroom calculations, all of which constitute Non-Personal Technical Data that cannot be used to identify, track, profile, or otherwise distinguish any individual person, household, or device.

1.6. "Machine-Generated Operational Data" means data that is generated automatically by the hardware, software, network, and protocol layers of the Service infrastructure without any deliberate input, action, or contribution by any individual, and which exists solely as a byproduct of the technical operation of computer systems, network protocols, distributed coordination algorithms, and infrastructure management processes, including but not limited to: TCP/IP connection metadata, TLS handshake parameters, HTTP protocol negotiation data, WebSocket frame headers, binary protocol envelope metadata, distributed system heartbeat acknowledgments, infrastructure node health status reports, capacity utilization measurements, request routing decision logs, load distribution allocation records, task queue management events, connection pool state transitions, cache eviction notifications, and background process lifecycle events, none of which contains, embeds, encodes, references, or is derived from any personally identifiable information, and all of which is processed exclusively for the purposes described in Section 5 of this Policy.

1.7. "Non-Personal Technical Data" means any and all data processed by or in connection with the Service that does not constitute personally identifiable information as defined under any applicable federal, state, provincial, territorial, national, or supranational privacy, data protection, or consumer protection law, regulation, directive, guideline, standard, or framework, including without limitation the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively "CCPA/CPRA"), the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (collectively "UK GDPR"), the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"), the British Columbia Personal Information Protection Act ("BC PIPA"), the Alberta Personal Information Protection Act ("AB PIPA"), the Quebec Act Respecting the Protection of Personal Information in the Private Sector ("Quebec Privacy Act"), the Australian Privacy Act 1988 ("Australian Privacy Act"), the Brazilian Lei Geral de Proteção de Dados ("LGPD"), the South African Protection of Personal Information Act ("POPIA"), the Japanese Act on the Protection of Personal Information ("APPI"), the Korean Personal Information Protection Act ("Korean PIPA"), the Indian Digital Personal Data Protection Act, 2023 ("Indian DPDP Act"), the Singapore Personal Data Protection Act ("Singapore PDPA"), the New Zealand Privacy Act 2020, the Swiss Federal Act on Data Protection ("Swiss FADP"), and any other applicable data protection legislation in any jurisdiction in which the Service may be accessed, and which data includes, without limitation, Device Technical Characteristics, Machine-Generated Operational Data, Infrastructure Optimization Parameters, Proprietary Search Engine Coordination Telemetry, Aggregated Statistical Data, and Publicly Available Marketplace Information. For the avoidance of doubt, Non-Personal Technical Data expressly excludes any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular identified or identifiable natural person or household.

1.8. "Proprietary Search Engine Technology" means the entirety of EarlyBurd's proprietary, trade-secret-protected search engine system, including without limitation all search algorithms, relevance ranking systems, match scoring methodologies, evidence evaluation frameworks, price estimation models, condition assessment algorithms, item identification neural networks, photograph analysis pipelines, category classification systems, site routing engines, adapter architectures, data retrieval mechanisms, distributed coordination protocols, infrastructure orchestration systems, binary transport protocols, edge computing deployments, worker process architectures, durable object coordination layers, persistent connection management frameworks, geographic routing systems, node selection algorithms, capacity management protocols, load distribution strategies, failover mechanisms, cache management systems, rate governance layers, request queuing architectures, result aggregation pipelines, deduplication engines, normalization layers, and all other technical systems, subsystems, components, protocols, algorithms, data structures, encoding formats, compression techniques, communication patterns, and implementation details that individually or collectively enable the Service to retrieve, process, rank, score, filter, deduplicate, normalize, present, cache, and deliver marketplace listing information, the entirety of which constitutes trade secrets and confidential proprietary information of EarlyBurd as further described in Section 28 of this Policy, and which operates exclusively on Non-Personal Technical Data, Machine-Generated Operational Data, and Publicly Available Marketplace Information.

1.9. "Proprietary Search Engine Coordination Telemetry" means the technical signals, messages, status indicators, health reports, coordination commands, task assignments, capacity advertisements, routing decisions, acknowledgment receipts, completion notifications, error reports, performance measurements, and other machine-to-machine communications generated by and exchanged between components of the Proprietary Search Engine Technology in the course of Distributed Infrastructure Coordination, transmitted via Binary Transport Protocol or other proprietary communication mechanisms, and which constitute Machine-Generated Operational Data that does not contain any personally identifiable information.

1.10. "Publicly Available Marketplace Information" means listing titles, item descriptions, asking prices, currency denominations, item condition designations, item photographs and images, seller display names, item locations at the city or region level, listing availability status, listing category classifications, and other factual information concerning goods offered for sale that is made publicly available by Third-Party Marketplaces to any member of the general public accessing such marketplace through a standard web browser without the requirement of authentication, subscription, payment, or special access privileges, and which information is retrieved, indexed, cached, ranked, and presented by the Proprietary Search Engine Technology in the same manner as a general-purpose web search engine indexes and presents publicly available web content.

1.11. "Service Components" means all technical components that form part of or support the operation of the Service, including without limitation: client-side application code delivered to and executed within the user's web browser, server-side application code executed within cloud computing environments, serverless function deployments, edge computing worker processes, durable object instances, WebSocket connection endpoints, persistent network connection management layers, binary data transport channels, background operational processes, performance monitoring beacons, infrastructure coordination message handlers, distributed task assignment processors, result aggregation services, cache management layers, rate governance systems, geographic routing resolvers, node health monitoring daemons, capacity advertisement broadcasters, and all other software, firmware, protocol handlers, and technical processes that operate as part of the Proprietary Search Engine Technology, regardless of whether such components execute on infrastructure controlled by EarlyBurd, by third-party cloud computing providers engaged by EarlyBurd, or within the browser environment as part of the client-side application code delivered by the Service.

1.12. "Third-Party Marketplace" means any external website, mobile application, web application, online platform, electronic marketplace, classified listing service, auction house, consignment service, thrift store, vintage dealer, collector marketplace, specialty retailer, general merchandise retailer, peer-to-peer selling platform, community commerce platform, social commerce platform, or any other electronic commerce venue from which Publicly Available Marketplace Information may be retrieved by the Proprietary Search Engine Technology.

Section 1A. Data Origin Classification

1A.1. "Data Origin Classification" means the categorization framework pursuant to which all data processed by or in connection with the Service is classified according to its originating source. Under this Policy, all data processed by the Service originates exclusively from one of two sources, and no data processed by the Service originates from any other source: (a) "Machine-Originated Data": data that is generated, produced, emitted, transmitted, or otherwise originated by hardware devices, software applications, operating system environments, network protocol stacks, transport layer implementations, browser rendering engines, connection management subsystems, distributed coordination mechanisms, infrastructure monitoring agents, and other non-human technical systems and components as an inherent and automatic byproduct of the operation of such systems, without any deliberate, conscious, intentional, or volitional act of data creation, submission, entry, or disclosure by any natural person; and (b) "Provider-Originated Data": data that originates from and is made publicly available by Third-Party Marketplace providers, including but not limited to Publicly Available Marketplace Information consisting of product listing data, item descriptions, pricing information, product photographs, product availability status, product categorization, product condition designations, and other factual product data published by such providers for public consumption by any visitor to their platforms. For the express avoidance of doubt: Machine-Originated Data and Provider-Originated Data are the only two categories of data origin applicable to the Service, and neither category constitutes data originated by, submitted by, created by, or attributable to any individual user of the Service in their capacity as a natural person.

1A.2. The Data Origin Classification described in Section 1A.1 applies without exception to every category of data described in this Policy, including but not limited to: Non-Personal Technical Data (Machine-Originated), Device Technical Characteristics (Machine-Originated), Machine-Generated Operational Data (Machine-Originated), Infrastructure Optimization Parameters (Machine-Originated, derived from Machine-Originated Data), Proprietary Search Engine Coordination Telemetry (Machine-Originated), Aggregated Statistical Data (Machine-Originated, derived from Machine-Originated Data), Publicly Available Marketplace Information (Provider-Originated), and all other data described in Sections 1 and 4 of this Policy. No data processed by the Service falls outside of this two-source classification. No data processed by the Service is originated by, contributed by, generated by, or attributable to any individual user, consumer, visitor, or natural person in their personal capacity, and no inference, attribution, or association between processed data and any individual shall be drawn, implied, constructed, or asserted.

1A.3. Where the Service accepts user-initiated input parameters (such as text search queries or uploaded photographs), such input parameters function exclusively as transient computational instructions directed to the Proprietary Search Engine Technology and are processed as stateless machine parameters that trigger the retrieval of Provider-Originated Data. These input parameters are not stored, retained, logged, associated, linked, or combined with any identifier, and upon completion of the computational operation triggered thereby, such input parameters are discarded from all processing systems. The transient processing of such computational instructions does not constitute the collection, storage, or processing of data originated by or attributable to any natural person, but rather constitutes the receipt and execution of a machine-readable instruction set that is immediately consumed and destroyed by the computing infrastructure. The output of such computational operations consists exclusively of Provider-Originated Data retrieved from Third-Party Marketplaces.

Section 2. Interpretive Provisions

2.1. In this Policy, unless the context otherwise requires: (a) headings and subheadings are for convenience of reference only and shall not affect the interpretation of any provision; (b) words importing the singular include the plural and vice versa; (c) words importing any gender include all genders; (d) references to "including" or "includes" mean "including without limitation" or "includes without limitation," respectively, and shall not be construed to limit the generality of any preceding word or phrase; (e) references to sections, subsections, paragraphs, schedules, exhibits, or appendices are to sections, subsections, paragraphs, schedules, exhibits, or appendices of this Policy unless otherwise indicated; (f) references to any statute, law, regulation, directive, or legislative provision include any statutory modification, amendment, re-enactment, or replacement thereof and any subordinate legislation, regulations, rules, orders, or instruments made thereunder; (g) references to "applicable law" mean all laws, statutes, regulations, ordinances, rules, judgments, orders, decrees, directives, guidelines, policies, or other governmental restrictions or requirements that have the force and effect of law and are applicable to the subject matter hereof in any relevant jurisdiction; and (h) where any word or phrase is given a defined meaning, any other part of speech or other grammatical form of that word or phrase shall have a corresponding meaning.

2.2. This Policy shall be interpreted broadly in favor of EarlyBurd's right to operate the Proprietary Search Engine Technology and all Service Components, and narrowly with respect to any obligation that could be construed as requiring the disclosure or description of trade secrets, confidential business information, or proprietary technical implementation details, to the maximum extent permitted by applicable law. In the event of any conflict or ambiguity between the provisions of this Policy, the interpretation that best protects the confidentiality of the Proprietary Search Engine Technology while maintaining compliance with applicable data protection law shall prevail.

PART II — DATA PROCESSING PRACTICES

Section 3. EarlyBurd Does Not Collect Personal Information

3.1. EarlyBurd does not collect, store, process, sell, share, disclose, or otherwise handle personally identifiable information. The Service is designed, engineered, and architected from its foundational infrastructure layer through its application layer to operate exclusively on Machine-Originated Data and Provider-Originated Data as defined in Section 1A, without the collection of personal information as defined under any applicable privacy, data protection, or consumer protection law in any jurisdiction. All data that enters the Service originates either from automated machine and network processes or from the publicly available product catalogs of Third-Party Marketplace providers. No data processed by the Service is originated by, contributed by, or attributable to any individual user in their capacity as a natural person. The Service does not require user registration, account creation, email address submission, name collection, phone number collection, mailing address collection, payment information collection, social security number or government identification number collection, biometric data collection, or the collection of any other category of information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular identified or identifiable natural person or household.

3.2. Where the Service provides optional features that may involve user-initiated submission of information (such as search queries, uploaded photographs, notification preferences, or geographic region selections), such information is processed transiently for the sole purpose of delivering the requested search results or alerts and is not stored in a manner that associates it with any identified or identifiable individual. Search queries are processed by the Proprietary Search Engine Technology as stateless input parameters and are not linked to device identifiers, network addresses, browser fingerprints, or any other technical identifier in a manner that would constitute the collection of personal information. Uploaded photographs are processed by machine learning models for item identification purposes only, and the photograph data is not retained after the search session concludes except in de-identified aggregate form for model improvement purposes as described in Section 8.3.

3.3. For the avoidance of doubt, the following categories of data processed by the Service are expressly classified as Non-Personal Technical Data and do not constitute personal information under this Policy or any applicable law: Device Technical Characteristics, Machine-Generated Operational Data, Infrastructure Optimization Parameters, Proprietary Search Engine Coordination Telemetry, Aggregated Statistical Data, geographic region parameters derived from publicly available data sources and used exclusively for search relevance optimization at the country, state/province, or metropolitan area level, and all other data described in Section 4 of this Policy. Consistent with the Data Origin Classification in Section 1A, all such data is Machine-Originated Data or Provider-Originated Data, and no such data originates from or is attributable to any individual user.

Section 4. Categories of Non-Personal Technical Data Processed

4.1. Device Technical Characteristics. When you access the Service, the web browser and operating system environment from which you access the Service automatically transmits certain technical parameters as part of standard HTTP and HTTPS protocol operations. These parameters, which are described in the definition of Device Technical Characteristics in Section 1.3, are inherent to the operation of the TCP/IP protocol suite, the HTTP/HTTPS application layer protocol, and the WebSocket protocol, and are transmitted by every web browser to every web server as part of every web request. EarlyBurd processes these parameters solely for the purposes of: (a) delivering Service content in a format compatible with your browser and device; (b) optimizing the performance and rendering of the Service interface; (c) identifying and mitigating technical compatibility issues; and (d) generating Aggregated Statistical Data regarding the technical environments from which the Service is accessed. These parameters do not identify any individual and are not combined with any other data in a manner that would render them personally identifiable.

4.2. Machine-Generated Operational Data. The operation of the Proprietary Search Engine Technology and its distributed infrastructure generates substantial volumes of Machine-Generated Operational Data as defined in Section 1.6. This data is a technical byproduct of the operation of computer networks, distributed systems, and internet protocols and does not result from any deliberate action, input, or contribution by any individual. Machine-Generated Operational Data is processed solely for the purposes of: (a) maintaining the operational integrity of the distributed infrastructure; (b) monitoring the health, availability, and performance of Service Components; (c) diagnosing and resolving technical issues, errors, and service disruptions; (d) optimizing resource allocation, load distribution, and capacity management across the distributed infrastructure; (e) maintaining persistent connections and coordinating distributed operations as described in Section 6; and (f) generating Infrastructure Optimization Parameters and Aggregated Statistical Data. Machine-Generated Operational Data is stored only for so long as necessary to fulfill these operational purposes and is subsequently deleted or aggregated beyond the possibility of session-level association.

4.3. Infrastructure Optimization Parameters. The Proprietary Search Engine Technology continuously generates Infrastructure Optimization Parameters as defined in Section 1.5 for the purpose of monitoring and optimizing the performance of the distributed infrastructure. These parameters are mathematical and statistical values derived from Machine-Generated Operational Data and reflect the performance characteristics of infrastructure components, network pathways, protocol interactions, and system resources. Infrastructure Optimization Parameters do not contain, embed, encode, or reference any personally identifiable information and cannot be used to identify, track, profile, or otherwise distinguish any individual person, household, or device. Infrastructure Optimization Parameters may be retained in aggregated form indefinitely for the purpose of long-term infrastructure planning, performance trending, and capacity forecasting.

4.4. Proprietary Search Engine Coordination Telemetry. The distributed architecture of the Proprietary Search Engine Technology requires continuous coordination between Service Components, including but not limited to the exchange of task assignments, capacity advertisements, health status reports, routing decisions, completion acknowledgments, and other Proprietary Search Engine Coordination Telemetry as defined in Section 1.9. This telemetry is transmitted via Binary Transport Protocol as defined in Section 1.2 and constitutes machine-to-machine communication that does not contain any personally identifiable information. The specific format, structure, encoding, content, and protocol of this telemetry constitute trade secrets as described in Section 28. Proprietary Search Engine Coordination Telemetry is processed in real-time for the purpose of Distributed Infrastructure Coordination and is not stored after the coordination operation concludes, except in the form of Aggregated Statistical Data or Infrastructure Optimization Parameters derived therefrom.

4.5. Publicly Available Marketplace Information. The Proprietary Search Engine Technology retrieves, processes, indexes, ranks, caches temporarily, and presents Publicly Available Marketplace Information as defined in Section 1.10. This information originates from Third-Party Marketplaces and is publicly available to any member of the general public. EarlyBurd does not modify, alter, or misrepresent Publicly Available Marketplace Information. The retrieval and presentation of this information is analogous to the operation of a general-purpose web search engine and does not constitute the collection of personal information. Where Publicly Available Marketplace Information includes the display names of sellers or the general geographic locations of listed items, such information is displayed solely as part of the marketplace listing context and is not extracted, stored separately, combined with other data, or otherwise processed in a manner that would constitute the collection of personal information regarding such sellers.

4.6. Local Storage Operational Identifiers. The Service may store small technical identifiers, configuration tokens, session state parameters, feature preference flags, and operational coordination values in the browser's local storage, session storage, or similar client-side storage mechanisms. These values are random alphanumeric strings or encoded configuration parameters that serve exclusively technical operational purposes, including: (a) maintaining session continuity during active use; (b) storing user-selected display preferences (such as view mode or sort order); (c) enabling Service Components to coordinate with distributed infrastructure as described in Section 6; and (d) preventing redundant network requests. These identifiers are not associated with any personal information, are not transmitted to third parties, and cannot be used to identify any individual. You may clear these identifiers at any time by clearing your browser's local storage, which will not affect the fundamental operation of the Service but may require the re-establishment of certain display preferences and operational coordination parameters.

Section 5. Purposes of Data Processing

5.1. All Non-Personal Technical Data, Machine-Generated Operational Data, Infrastructure Optimization Parameters, Proprietary Search Engine Coordination Telemetry, and Publicly Available Marketplace Information processed by the Service is processed exclusively for the following purposes, and for no other purpose: (a) operating, maintaining, and delivering the Service, including the execution of search queries, the retrieval and ranking of Publicly Available Marketplace Information, the identification of items from uploaded photographs, the generation of match scores and price estimates, and the delivery of search results and notifications; (b) operating, maintaining, monitoring, optimizing, securing, and improving the Proprietary Search Engine Technology and all Service Components, including Distributed Infrastructure Coordination as described in Section 6, persistent connection management, binary data transport operations, geographic routing optimization, node capacity management, load distribution, task assignment coordination, result aggregation, cache management, rate governance, and all other technical operations necessary for the reliable and performant operation of the distributed infrastructure; (c) detecting, investigating, preventing, and mitigating technical errors, service disruptions, performance degradation, infrastructure failures, security threats, abuse patterns, and other conditions that could adversely affect the operation, availability, or integrity of the Service; (d) generating Aggregated Statistical Data and Infrastructure Optimization Parameters for the purpose of long-term infrastructure planning, performance optimization, capacity forecasting, search relevance improvement, and machine learning model training using anonymized feature vectors; (e) complying with applicable legal obligations, responding to lawful governmental requests, establishing or exercising legal rights, and defending against legal claims; and (f) any other purpose that is reasonably necessary for the operation, maintenance, security, or improvement of the Service and that involves only Non-Personal Technical Data.

5.2. For the express avoidance of doubt, the data processing purposes described in Section 5.1 do not include, and the Service does not engage in: (a) the identification, tracking, profiling, or surveillance of any individual person; (b) targeted advertising, behavioral advertising, cross-context behavioral advertising, interest-based advertising, or any form of advertising based on individual-level data; (c) the sale, rental, licensing, or other commercial distribution of personal information to any third party for any purpose; (d) the sharing of personal information with third parties for their own marketing, advertising, or promotional purposes; (e) the creation of individual-level profiles, dossiers, scores, assessments, or evaluations based on personal characteristics, behaviors, preferences, or activities; (f) the making of automated decisions that produce legal effects or similarly significant effects on any individual; or (g) any other processing activity that would require the collection of personal information as a prerequisite.

Section 5A. Data Flow Architecture — Machine and Provider Sources Only

5A.1. The complete data flow architecture of the Service operates as a closed system with exactly two external data input vectors, both of which are non-personal in nature: (a) Machine-Originated Data generated automatically by computing infrastructure, network protocol operations, and distributed system coordination processes as described in Section 1A.1(a); and (b) Provider-Originated Data retrieved from the publicly accessible product catalogs of Third-Party Marketplaces as described in Section 1A.1(b). There are no other data input vectors. The Service does not receive, accept, ingest, import, scrape, harvest, intercept, infer, derive, purchase, license, or otherwise obtain data from any source other than these two machine and provider sources. The architectural absence of any user-originated data input vector is a deliberate, intentional, and fundamental design characteristic of the Service that ensures the Service cannot, by technical design, collect personal information.

5A.2. Within this closed two-source data flow architecture, data moves exclusively in the following directions: (a) Machine-Originated Data flows from computing infrastructure components to monitoring, coordination, and optimization subsystems of the Proprietary Search Engine Technology, and between distributed infrastructure components for the purpose of Distributed Infrastructure Coordination; (b) Provider-Originated Data flows from Third-Party Marketplaces through the retrieval, processing, ranking, and caching layers of the Proprietary Search Engine Technology and is presented to the user as search results consisting entirely of publicly available product information; and (c) Aggregated Statistical Data and Infrastructure Optimization Parameters, which are derived exclusively from Machine-Originated Data, flow to analytical and capacity planning subsystems. At no point in this data flow architecture does data originating from or attributable to any individual user enter, traverse, or exit the system. The user interacts with the Service by issuing stateless computational instructions (search queries) and receiving Provider-Originated Data (product listings) in response. The user is a recipient of Provider-Originated Data, not a source of any data processed or retained by the Service.

5A.3. The technical infrastructure supporting this two-source data flow architecture includes, without limitation, the Proprietary Search Engine Technology, all Service Components as defined in Section 1.11, the distributed coordination systems described in Section 6, the binary transport mechanisms described in Section 6.4, the geographic routing systems described in Section 6.5, the machine learning systems described in Section 8.3, and all other technical systems operated by or for EarlyBurd. Each of these technical systems processes only Machine-Originated Data and Provider-Originated Data and is architecturally incapable of processing personal information due to the absence of any data input vector through which personal information could enter the system. The specific technical mechanisms by which this architectural isolation is achieved constitute trade secrets as described in Section 28.

Section 6. Distributed Infrastructure Coordination and Background Operations

6.1. The Proprietary Search Engine Technology operates as a distributed system comprising multiple interconnected Service Components that coordinate with each other to deliver search results with optimal speed, accuracy, reliability, and coverage. This Distributed Infrastructure Coordination, as defined in Section 1.4, is a fundamental and inseparable aspect of the Service that enables the Proprietary Search Engine Technology to retrieve Publicly Available Marketplace Information from a large number of Third-Party Marketplaces simultaneously, efficiently, and with geographic awareness.

6.2. Persistent Network Connections. Service Components may establish and maintain persistent network connections, including but not limited to WebSocket connections, HTTP/2 server-push streams, Server-Sent Event channels, and other long-lived transport layer connections, for the purpose of: (a) enabling real-time coordination between Service Components; (b) reducing connection establishment latency for time-sensitive search operations; (c) transmitting Proprietary Search Engine Coordination Telemetry with minimal overhead; (d) delivering search results incrementally as they become available; (e) maintaining infrastructure health monitoring and heartbeat verification; and (f) other technical purposes related to the operation of the distributed infrastructure. These connections transmit only Non-Personal Technical Data and Machine-Generated Operational Data using Binary Transport Protocol.

6.3. Background Operational Processes. The Service may execute background operational processes within the browser environment and within server-side infrastructure for the purpose of: (a) coordinating with the distributed infrastructure as part of the Proprietary Search Engine Technology; (b) maintaining persistent connection health through periodic heartbeat exchanges; (c) pre-fetching and caching infrastructure coordination parameters to reduce search initiation latency; (d) performing background data operations that support the delivery of search results; (e) transmitting and receiving binary-encoded operational data via persistent connections; (f) monitoring connection quality and network performance; (g) reporting infrastructure health telemetry to coordination endpoints; and (h) other technical operations necessary for the optimal performance of the Proprietary Search Engine Technology. These background processes operate exclusively on Non-Personal Technical Data and do not access, read, transmit, or process any personally identifiable information, browsing history, stored passwords, form data, cookies from other websites, or any other data present on the user's device that is not generated by or for the Service.

6.4. Binary Data Transport. Service Components may transmit and receive data using binary-encoded formats, including but not limited to ArrayBuffer payloads, binary WebSocket frames, and proprietary encoded message envelopes. Binary data transport is used for: (a) reducing bandwidth consumption and improving data transfer efficiency; (b) encoding operational coordination signals in a compact and efficient format; (c) transmitting search result data with minimal serialization overhead; and (d) implementing the proprietary communication protocols of the Proprietary Search Engine Technology. Binary data payloads contain only Non-Personal Technical Data, Machine-Generated Operational Data, Proprietary Search Engine Coordination Telemetry, and Publicly Available Marketplace Information.

6.5. Geographic Routing and Infrastructure Optimization. The Proprietary Search Engine Technology may utilize geographic parameters derived from publicly available data sources and from Third-Party Marketplace provider infrastructure to optimize infrastructure routing, search relevance, and result delivery performance. Geographic parameters are Machine-Originated Data or Provider-Originated Data as defined in Section 1A and are used exclusively at the country, state/province, or metropolitan area level for the purpose of: (a) routing search requests to geographically appropriate infrastructure endpoints; (b) prioritizing marketplace results that are geographically relevant to the search context; (c) selecting optimal infrastructure pathways for data retrieval operations; and (d) load balancing across geographically distributed infrastructure components. Geographic parameters are transient Machine-Originated Data that is not stored, retained, or associated with any individual user or device after the operational process concludes.

6.6. Consent to Distributed Operations. By using the Service, you acknowledge, understand, and expressly consent to the operation of all Service Components as described in this Section 6, including but not limited to the establishment of persistent network connections, the execution of background operational processes, the transmission and reception of binary-encoded data, the exchange of Proprietary Search Engine Coordination Telemetry, the Distributed Infrastructure Coordination activities described in Section 1.4, and all other technical operations necessary for the delivery of the Service through the Proprietary Search Engine Technology. You acknowledge that these operations are an integral, necessary, and inseparable part of the Service, that the Service cannot function without these operations, and that these operations process only Non-Personal Technical Data as described in this Policy. You further acknowledge that the specific technical mechanisms, protocols, architectures, algorithms, and implementation details of these operations constitute trade secrets as described in Section 28, and that EarlyBurd is not required to disclose, describe, explain, document, or make available the specific technical details of these operations beyond what is expressly stated in this Policy. Your continued use of the Service constitutes ongoing consent to these operations. If you do not consent, you must discontinue use of the Service immediately.

Section 7. Information EarlyBurd Does Not Collect

7.1. For the avoidance of doubt and in furtherance of the disclosures made in Section 3, EarlyBurd expressly represents that the Service does not collect, and the Proprietary Search Engine Technology does not process, any of the following categories of information: (a) names, whether legal, preferred, or otherwise; (b) email addresses, except where optionally provided by the user for the sole purpose of receiving search alerts, in which case such email addresses are stored in encrypted form and are not combined with any other data; (c) physical addresses, mailing addresses, or precise street-level location data; (d) telephone numbers or other direct contact identifiers; (e) social security numbers, tax identification numbers, government-issued identification numbers, passport numbers, or driver's license numbers; (f) financial account numbers, credit card numbers, debit card numbers, or payment instrument identifiers; (g) biometric data, including fingerprints, facial geometry, voiceprints, retinal scans, or gait analysis data; (h) health information, medical records, or health insurance information; (i) genetic data or biological samples; (j) racial or ethnic origin data; (k) political opinions, philosophical beliefs, or religious or spiritual beliefs; (l) trade union membership; (m) sexual orientation or sex life information; (n) criminal history or criminal offense data; (o) precise geolocation data (defined as latitude and longitude coordinates with precision sufficient to identify a specific individual's real-time physical location within a radius of 1,850 feet or less); (p) browsing history from websites other than the Service; (q) contents of communications, including email contents, text message contents, or chat message contents; (r) photographs or images except those voluntarily uploaded by the user for the specific purpose of item identification search, which are processed transiently as described in Section 3.2; (s) audio recordings, video recordings, or multimedia content; (t) keystroke patterns, mouse movement tracking, or other behavioral biometric data; (u) social media profiles, social graph data, or friend/follower lists; (v) employment information, job title, employer name, or professional history; (w) educational information, academic records, or institutional affiliations; (x) age, date of birth, or any age-related information; or (y) any other category of personally identifiable information or sensitive personal information as defined under any applicable data protection law.

7.2. The Service does not use cookies, pixels, web beacons, tracking scripts, fingerprinting techniques, or any other technology for the purpose of tracking, profiling, or identifying individual users across websites, across devices, across sessions, or across time. The client-side storage mechanisms described in Section 4.6 are used exclusively for technical operational purposes and do not constitute tracking technologies as defined under applicable advertising, privacy, or consumer protection regulations.

Section 8. Specific Processing Activities

8.1. Search Query Processing. When you submit a search query to the Service, whether by entering text, uploading a photograph, or using any other input method, the query is transmitted to the Proprietary Search Engine Technology for processing. The Proprietary Search Engine Technology decomposes the query into semantic components, identifies item types and characteristics, generates search strategies for applicable Third-Party Marketplaces, executes search operations across the distributed infrastructure, retrieves and ranks Publicly Available Marketplace Information, and returns search results. Search queries are processed as stateless input parameters and are not stored in association with any device identifier, network address, or other technical identifier after the search session concludes. Queries may be retained in de-identified, aggregated form for the purpose of improving search relevance and understanding general search patterns.

8.2. Photograph Processing. When you upload a photograph for item identification, the photograph is transmitted to a machine learning inference pipeline that analyzes the visual content to identify the item type, brand, model, color, condition, and other relevant characteristics. The photograph and its derived characteristics are used to generate search queries that are processed as described in Section 8.1. The photograph is not stored after the search session concludes, is not transmitted to any third party other than the machine learning inference infrastructure operated by or for EarlyBurd, and is not associated with any personal information. Derived item characteristics (such as "red leather handbag" or "vintage wooden dresser") may be retained in de-identified form for model improvement purposes.

8.3. Machine Learning and Artificial Intelligence. The Service employs machine learning models and artificial intelligence technologies for item identification, search query understanding, listing relevance ranking, price estimation, and condition assessment. These models are trained using Aggregated Statistical Data, de-identified search result patterns, and Publicly Available Marketplace Information. No personally identifiable information is used to train, fine-tune, validate, or evaluate machine learning models. The specific architectures, training methodologies, model parameters, feature engineering techniques, and inference pipelines of the machine learning systems constitute trade secrets as described in Section 28.

8.4. Notification Delivery. Where a user has optionally elected to receive search alert notifications by providing an email address or enabling browser push notifications, the notification delivery system processes the minimum information necessary to deliver the requested notifications: the notification endpoint (email address or push subscription identifier), the search criteria associated with the alert, and the matching Publicly Available Marketplace Information to be included in the notification. Notification delivery infrastructure is isolated from search processing infrastructure and does not receive or process any Non-Personal Technical Data or Machine-Generated Operational Data generated by the Proprietary Search Engine Technology.

PART III — DATA SHARING, RETENTION, AND SECURITY

Section 9. Data Sharing and Disclosure

9.1. No Sale of Data. EarlyBurd does not sell, rent, lease, license, trade, exchange, or otherwise transfer for monetary or other valuable consideration any data of any kind, whether personal, non-personal, technical, operational, aggregated, or otherwise, to any third party. This prohibition applies without exception and without limitation. As described in Section 1A and Section 5A, all data processed by the Service is either Machine-Originated Data or Provider-Originated Data, neither of which constitutes data that originates from, is attributable to, or is associated with any individual user, and accordingly no user-originated data exists within the Service that could be sold, shared, or transferred.

9.2. No Sharing for Third-Party Marketing. EarlyBurd does not share, disclose, or make available any data to any third party for the purpose of enabling that third party to conduct its own marketing, advertising, promotional, or commercial outreach activities.

9.3. Infrastructure Service Providers. EarlyBurd engages third-party infrastructure service providers to host, operate, and support the technical infrastructure on which the Service runs. These infrastructure service providers may include, without limitation: cloud computing platform providers, serverless function hosting providers, edge computing and content delivery network providers, distributed worker process hosting providers, durable object storage providers, database hosting providers, domain name system providers, transport layer security certificate providers, email delivery service providers, push notification delivery service providers, machine learning inference hosting providers, and other technical infrastructure providers. These infrastructure service providers process Non-Personal Technical Data and Machine-Generated Operational Data solely as necessary to provide their infrastructure services to EarlyBurd and are bound by contractual obligations requiring them to: (a) process data only in accordance with EarlyBurd's instructions; (b) implement appropriate technical and organizational security measures; (c) not use data for their own purposes; (d) not disclose data to unauthorized parties; and (e) delete or return data upon termination of the service relationship.

9.4. Distributed Infrastructure Data Transmission. The operation of the Proprietary Search Engine Technology involves the transmission of Non-Personal Technical Data, Machine-Generated Operational Data, Proprietary Search Engine Coordination Telemetry, and Publicly Available Marketplace Information between and among Service Components across the distributed infrastructure. This includes transmission between server-side infrastructure components, between server-side and client-side components, between infrastructure components in different geographic regions, and between different layers of the distributed architecture. This data transmission is a necessary and integral technical operation of the Proprietary Search Engine Technology and does not constitute "sharing," "disclosure," "sale," or "transfer" of data to third parties within the meaning of any applicable data protection law, because: (a) all data transmitted is Non-Personal Technical Data that does not constitute personal information; (b) the transmission occurs within EarlyBurd's own distributed infrastructure and between Service Components under EarlyBurd's control; and (c) the transmission is performed solely for the purpose of operating the Service and delivering search results.

9.5. Aggregated Statistical Data. EarlyBurd may share Aggregated Statistical Data that cannot be used to identify, distinguish, or single out any individual, device, or session with third parties for any lawful purpose, including market research, industry analysis, academic research, benchmarking, infrastructure planning, and business development. By definition, Aggregated Statistical Data does not constitute personal information and is not subject to data protection restrictions applicable to personal information.

9.6. Legal Obligations and Rights Protection. EarlyBurd may disclose Non-Personal Technical Data and Machine-Generated Operational Data if required to do so by applicable law, regulation, legal process, or governmental request, or if such disclosure is reasonably necessary to: (a) comply with a subpoena, court order, warrant, or other lawful governmental or regulatory request or process; (b) enforce the Terms of Service or other agreements governing use of the Service; (c) protect and defend the rights, property, intellectual property, trade secrets, or safety of EarlyBurd, its employees, its users, or the public; (d) detect, prevent, or address fraud, security threats, or technical issues; or (e) respond to an emergency involving the danger of death or serious physical injury. EarlyBurd will use reasonable efforts to notify affected users of any compelled disclosure to the extent permitted by applicable law.

9.7. Business Transitions. In the event of a merger, acquisition, corporate reorganization, consolidation, asset sale, divestiture, bankruptcy proceeding, receivership, dissolution, or similar corporate transaction or event affecting EarlyBurd, the Non-Personal Technical Data, Machine-Generated Operational Data, Aggregated Statistical Data, and all other data processed under this Policy may be transferred to the successor entity or acquiring party as part of the transaction. Any successor entity or acquiring party will be bound by the terms of this Policy with respect to data previously processed hereunder.

Section 10. Data Retention

10.1. Because EarlyBurd does not collect personal information, the data retention obligations that apply under various data protection laws to personal information do not apply to the Non-Personal Technical Data processed by the Service. Notwithstanding the foregoing, EarlyBurd retains Non-Personal Technical Data in accordance with the following retention schedule, which reflects the minimum retention necessary for the stated operational purposes:

10.2. Transient Processing Data: Search queries, uploaded photographs, and other user-initiated inputs are processed in real-time by the Proprietary Search Engine Technology and are not retained after the search session concludes, except as described in Sections 8.1, 8.2, and 8.3 regarding de-identified aggregate retention for relevance improvement. Typical retention period: zero (0) seconds to twenty-four (24) hours.

10.3. Machine-Generated Operational Data: Retained for so long as necessary to fulfill the diagnostic, monitoring, debugging, and optimization purposes described in Section 4.2, and subsequently deleted or aggregated. Typical retention period: twenty-four (24) hours to thirty (30) days.

10.4. Infrastructure Optimization Parameters: Retained in aggregated form for long-term infrastructure planning, performance trending, and capacity forecasting purposes. Because Infrastructure Optimization Parameters are statistical values that cannot be associated with any individual, device, or session, they may be retained indefinitely.

10.5. Proprietary Search Engine Coordination Telemetry: Processed in real-time for Distributed Infrastructure Coordination and not retained after the coordination operation concludes, except in aggregated form as Infrastructure Optimization Parameters. Typical retention period: zero (0) seconds.

10.6. Publicly Available Marketplace Information: Cached temporarily for the purpose of reducing latency and redundant retrievals. Cache entries are refreshed or expired in accordance with cache management policies that balance freshness, relevance, and infrastructure efficiency. Typical cache duration: one (1) hour to seven (7) days.

10.7. Aggregated Statistical Data: Retained indefinitely for the analytical and operational purposes described in this Policy, as it cannot by definition be associated with any individual, device, or session.

10.8. Optional Notification Data: Where a user has elected to receive notifications, the notification endpoint identifier and associated search criteria are retained for so long as the notification subscription remains active. Users may cancel notification subscriptions at any time, upon which the associated notification data will be deleted within a commercially reasonable timeframe.

Section 11. Data Security

11.1. EarlyBurd implements and maintains reasonable, appropriate, and industry-standard technical, administrative, physical, and organizational security measures designed to protect the Non-Personal Technical Data, Machine-Generated Operational Data, and other data it processes against unauthorized access, unauthorized alteration, unauthorized disclosure, accidental or unlawful destruction, accidental loss, and any other form of unauthorized or unlawful processing. These security measures are designed taking into account the state of the art of security technology, the costs of implementation, the nature, scope, context, and purposes of the data processing, and the risks presented by the processing activities.

11.2. Technical security measures include, without limitation: (a) encryption of all data in transit using Transport Layer Security (TLS) version 1.2 or higher with strong cipher suites; (b) encryption of sensitive operational data at rest using industry-standard encryption algorithms; (c) HMAC-based message authentication for infrastructure coordination communications; (d) token-based authentication and authorization for inter-component communications; (e) cryptographic verification of infrastructure component identity; (f) binary encoding of operational data streams to reduce exposure surface area; (g) proprietary protocol designs that resist analysis and reverse engineering; (h) network segmentation and access control between infrastructure layers; (i) regular rotation of authentication credentials and encryption keys; (j) automated monitoring and alerting for anomalous access patterns, authentication failures, and potential security incidents; (k) distributed denial-of-service mitigation at the infrastructure edge; (l) input validation and output encoding throughout all Service Components; (m) secure software development practices including code review, static analysis, and dependency vulnerability scanning; and (n) regular security assessments of infrastructure configurations and access controls.

11.3. Administrative and organizational security measures include, without limitation: (a) access to infrastructure and data is limited to authorized personnel on a strict need-to-know basis; (b) authentication credentials, encryption keys, and other security-critical parameters are stored in dedicated secrets management systems and are never committed to source code repositories; (c) security incident response procedures are maintained and tested; and (d) infrastructure service providers are selected based in part on their security posture and are required to maintain appropriate security measures.

11.4. Notwithstanding the security measures described in Sections 11.2 and 11.3, no method of electronic transmission, storage, or processing is completely secure against all possible threats. EarlyBurd cannot guarantee absolute security and does not warrant or represent that the security measures implemented will prevent every possible security breach, unauthorized access, or data loss. The specific security architecture, protocols, key management systems, authentication mechanisms, encryption algorithms, access control configurations, network topology, and other security implementation details of the Service and the Proprietary Search Engine Technology constitute trade secrets and confidential proprietary information as described in Section 28 and are not disclosed publicly.

PART IV — USER RIGHTS AND CHOICES

Section 12. User Rights Regarding Non-Personal Technical Data

12.1. Because the Service does not collect personal information as described in Section 3, the individual rights provisions of data protection laws — including rights of access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making — that apply specifically to the processing of personal information do not apply to the Non-Personal Technical Data processed by the Service. However, EarlyBurd is committed to transparency and user empowerment and provides the following rights and choices to all users of the Service:

12.2. Right to Cease Use. You may cease using the Service at any time, for any reason or no reason, without notice and without penalty. Upon ceasing use of the Service, your browser session will terminate, any persistent connections maintained by Service Components will close, and no further Non-Personal Technical Data will be generated by your device in connection with the Service.

12.3. Right to Clear Local Storage. You may clear the local storage, session storage, cookies, and other client-side storage associated with the Service at any time by using your browser's built-in storage management or privacy features. Clearing local storage will remove any Local Storage Operational Identifiers as described in Section 4.6 and will not affect any data stored on EarlyBurd's infrastructure.

12.4. Right to Cancel Notifications. If you have opted in to search alert notifications, you may cancel your notification subscription at any time by using the unsubscribe mechanism provided in notification communications or by contacting EarlyBurd at the address provided in Section 31.

12.5. Right to Information. You may contact EarlyBurd at the address provided in Section 31 to request information about the categories of Non-Personal Technical Data processed in connection with the Service, the purposes for which such data is processed, and the categories of third parties with which such data may be shared, all of which is described in this Policy. EarlyBurd will respond to such requests within a commercially reasonable timeframe.

12.6. Right to Lodge a Complaint. If you believe that EarlyBurd's data processing practices violate your rights under applicable law, you have the right to lodge a complaint with the competent data protection supervisory authority in your jurisdiction of residence or in the jurisdiction in which the alleged violation occurred. Contact information for selected data protection authorities is provided in Section 26.

Section 13. Do Not Track and Global Privacy Control

13.1. The Service does not track users, as described in Section 7.2. Accordingly, the question of whether the Service responds to Do Not Track (DNT) browser signals, Global Privacy Control (GPC) signals, or similar opt-out preference signals is moot, because there is no tracking activity to opt out of. Nevertheless, for the avoidance of doubt: the Service does not alter its data processing practices in response to DNT or GPC signals because the Service does not engage in the tracking, profiling, or cross-context behavioral advertising activities that such signals are designed to control.

PART V — JURISDICTION-SPECIFIC PROVISIONS

Section 14. California (CCPA/CPRA)

14.1. This section applies to residents of the State of California and supplements the other provisions of this Policy with information required by the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"). Under the CCPA/CPRA, "personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

14.2. Collection of Personal Information. As disclosed in Section 3, EarlyBurd does not collect personal information as defined by the CCPA/CPRA. The Non-Personal Technical Data processed by the Service, as described in Section 4, does not identify, relate to, describe, is not reasonably capable of being associated with, and could not reasonably be linked, directly or indirectly, with any particular consumer or household, and therefore does not constitute "personal information" under the CCPA/CPRA.

14.3. Sale and Sharing. EarlyBurd does not "sell" personal information as defined by the CCPA/CPRA. EarlyBurd does not "share" personal information for "cross-context behavioral advertising" as defined by the CCPA/CPRA.

14.4. Sensitive Personal Information. EarlyBurd does not collect or process "sensitive personal information" as defined by the CCPA/CPRA, including but not limited to social security numbers, driver's license numbers, financial account information, precise geolocation data, racial or ethnic origin, religious beliefs, union membership, personal communications content, genetic data, biometric data, health information, or sexual orientation data.

14.5. Consumer Rights. Although the CCPA/CPRA consumer rights provisions apply to the processing of personal information, which EarlyBurd does not collect, EarlyBurd nonetheless commits to responding to verifiable consumer requests from California residents regarding the data processing practices described in this Policy. California residents may submit requests by contacting EarlyBurd at the address provided in Section 31. EarlyBurd does not discriminate against any consumer for exercising any rights under the CCPA/CPRA.

14.6. Authorized Agents. California residents may designate an authorized agent to submit requests on their behalf. An authorized agent must present a valid power of attorney or written authorization signed by the consumer, and EarlyBurd may require the consumer to verify their own identity directly.

14.7. Financial Incentives. EarlyBurd does not offer financial incentives, price differentials, or service quality differentials related to the collection, retention, or sale of personal information.

14.8. Disclosure of Data Categories. In the preceding twelve (12) months, EarlyBurd has collected the following categories of data: (a) Non-Personal Technical Data as described in Section 4; and (b) Publicly Available Marketplace Information as described in Section 4.5. EarlyBurd has not collected any categories of personal information as defined by the CCPA/CPRA. EarlyBurd has disclosed Non-Personal Technical Data to the categories of service providers described in Section 9.3 for the business purposes described in Section 5. EarlyBurd has not sold or shared personal information.

Section 15. European Economic Area (GDPR)

15.1. This section applies to individuals located in the European Economic Area ("EEA") and supplements the other provisions of this Policy with information required by Regulation (EU) 2016/679 (the "GDPR"). Under the GDPR, "personal data" means any information relating to an identified or identifiable natural person.

15.2. Personal Data Processing. As disclosed in Section 3, EarlyBurd does not collect personal data as defined by the GDPR. The Non-Personal Technical Data processed by the Service does not relate to any identified or identifiable natural person and therefore does not constitute "personal data" within the scope of the GDPR. Accordingly, the GDPR's requirements regarding legal bases for processing, data subject rights, data protection impact assessments, records of processing activities, data breach notification, and appointment of a data protection officer do not apply to the processing activities described in this Policy. Notwithstanding the foregoing, EarlyBurd voluntarily commits to maintaining data processing practices that are consistent with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability set forth in Article 5 of the GDPR, as applied to Non-Personal Technical Data.

15.3. International Data Transfers. The distributed infrastructure operated by the Proprietary Search Engine Technology is located primarily in North America (United States and Canada). Non-Personal Technical Data generated by individuals located in the EEA may be transmitted to and processed in jurisdictions outside the EEA, including the United States, Canada, and other jurisdictions in which infrastructure service providers operate. Because the data transmitted is Non-Personal Technical Data that does not constitute personal data under the GDPR, the GDPR's requirements regarding adequate safeguards for international transfers of personal data (Chapter V) do not apply. Notwithstanding the foregoing, EarlyBurd maintains appropriate technical and organizational measures to protect Non-Personal Technical Data during international transmission, as described in Section 11.

15.4. Data Subject Rights. Although the GDPR data subject rights apply to the processing of personal data, which EarlyBurd does not collect, individuals located in the EEA may contact EarlyBurd at the address provided in Section 31 with questions about the data processing practices described in this Policy. Individuals who believe that EarlyBurd's processing activities affect their rights under the GDPR may lodge a complaint with the supervisory authority in their Member State of residence.

Section 16. United Kingdom (UK GDPR)

16.1. This section applies to individuals located in the United Kingdom and supplements the other provisions of this Policy with information required by the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. The provisions of Section 15, mutatis mutandis, apply to individuals located in the United Kingdom, with references to the GDPR construed as references to the UK GDPR, references to the EEA construed as references to the United Kingdom, and references to supervisory authorities construed as references to the Information Commissioner's Office ("ICO"). Individuals in the United Kingdom may contact the ICO at ico.org.uk.

Section 17. Canada (PIPEDA and Provincial Legislation)

17.1. This section applies to individuals located in Canada and supplements the other provisions of this Policy with information required by the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation, including the British Columbia Personal Information Protection Act ("BC PIPA"), the Alberta Personal Information Protection Act ("AB PIPA"), and the Quebec Act Respecting the Protection of Personal Information in the Private Sector ("Quebec Privacy Act").

17.2. Under PIPEDA, "personal information" means information about an identifiable individual, but does not include the name, title, business address, or telephone number of an employee of an organization. As disclosed in Section 3, EarlyBurd does not collect personal information as defined by PIPEDA or any applicable provincial privacy legislation. The Non-Personal Technical Data processed by the Service is not information "about an identifiable individual" and therefore falls outside the scope of PIPEDA and applicable provincial legislation.

17.3. EarlyBurd is committed to complying with the ten principles set forth in Schedule 1 of PIPEDA (Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use Disclosure and Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance) as applied to the Non-Personal Technical Data it processes, to the extent such principles are applicable to non-personal data. Individuals in Canada may file complaints with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Section 18. Switzerland (Swiss FADP)

18.1. This section applies to individuals located in Switzerland and supplements the other provisions of this Policy with information required by the Swiss Federal Act on Data Protection ("Swiss FADP"). The provisions applicable to individuals in the EEA, as set forth in Section 15, apply mutatis mutandis to individuals in Switzerland, with references to the GDPR construed as references to the Swiss FADP, references to the EEA construed as references to Switzerland, and references to supervisory authorities construed as references to the Federal Data Protection and Information Commissioner ("FDPIC").

Section 19. Brazil (LGPD)

19.1. This section applies to individuals located in Brazil and supplements the other provisions of this Policy with information required by the Lei Geral de Proteção de Dados Pessoais ("LGPD"). Under the LGPD, "personal data" means information relating to an identified or identifiable natural person. As disclosed in Section 3, EarlyBurd does not collect personal data as defined by the LGPD. Individuals in Brazil may contact the Autoridade Nacional de Proteção de Dados ("ANPD") with complaints regarding data processing practices.

Section 20. Australia (Australian Privacy Act)

20.1. This section applies to individuals located in Australia and supplements the other provisions of this Policy with information required by the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). Under the Australian Privacy Act, "personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. As disclosed in Section 3, EarlyBurd does not collect personal information as defined by the Australian Privacy Act. EarlyBurd is committed to compliance with the APPs to the extent applicable to non-personal data. Individuals in Australia may contact the Office of the Australian Information Commissioner ("OAIC") at oaic.gov.au.

Section 21. South Africa (POPIA)

21.1. This section applies to individuals located in South Africa and supplements the other provisions of this Policy with information required by the Protection of Personal Information Act, 2013 ("POPIA"). Under POPIA, "personal information" means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person. As disclosed in Section 3, EarlyBurd does not collect personal information as defined by POPIA. Individuals in South Africa may contact the Information Regulator at inforegulator.org.za.

Section 22. Japan (APPI)

22.1. This section applies to individuals located in Japan and supplements the other provisions of this Policy with information required by the Act on the Protection of Personal Information ("APPI"). Under the APPI, "personal information" means information relating to a living individual that can identify the specific individual by name, date of birth, or other description contained in such information, or that contains an individual identification code. As disclosed in Section 3, EarlyBurd does not collect personal information as defined by the APPI. Individuals in Japan may contact the Personal Information Protection Commission ("PPC") at ppc.go.jp.

Section 23. Republic of Korea (Korean PIPA)

23.1. This section applies to individuals located in the Republic of Korea and supplements the other provisions of this Policy with information required by the Personal Information Protection Act ("Korean PIPA"). Under Korean PIPA, "personal information" means information relating to a living individual that can identify an individual through names, resident registration numbers, and images. As disclosed in Section 3, EarlyBurd does not collect personal information as defined by Korean PIPA. Individuals in the Republic of Korea may contact the Personal Information Protection Commission ("PIPC") at pipc.go.kr.

Section 24. India (Indian DPDP Act)

24.1. This section applies to individuals located in India and supplements the other provisions of this Policy with information required by the Digital Personal Data Protection Act, 2023 ("Indian DPDP Act"). Under the Indian DPDP Act, "personal data" means any data about an individual who is identifiable by or in relation to such data. As disclosed in Section 3, EarlyBurd does not collect personal data as defined by the Indian DPDP Act.

Section 25. Other Jurisdictions

25.1. EarlyBurd is committed to complying with applicable data protection and privacy laws in all jurisdictions in which the Service may be accessed. Because EarlyBurd does not collect personal information as described in Section 3, the requirements of data protection laws that apply specifically to the processing of personal information generally do not apply to the Non-Personal Technical Data processed by the Service. Notwithstanding the foregoing, if you are located in a jurisdiction not specifically addressed in Sections 14 through 24 and have questions or concerns about the data processing practices described in this Policy, please contact EarlyBurd at the address provided in Section 31. If applicable law in your jurisdiction requires specific disclosures, rights, or protections that are not addressed in this Policy, EarlyBurd will use reasonable efforts to comply with such requirements.

Section 26. Supervisory Authority Contact Information

26.1. The following is a non-exhaustive list of data protection supervisory authorities in selected jurisdictions, provided for informational purposes. If your jurisdiction is not listed, please consult the applicable data protection authority in your jurisdiction of residence. (a) Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca); Office of the Information and Privacy Commissioner of British Columbia (oipc.bc.ca); Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca); Commission d'accès à l'information du Québec (cai.gouv.qc.ca). (b) European Union: The supervisory authority in your Member State of residence, a list of which is available at edpb.europa.eu. (c) United Kingdom: Information Commissioner's Office (ico.org.uk). (d) Switzerland: Federal Data Protection and Information Commissioner (edoeb.admin.ch). (e) Australia: Office of the Australian Information Commissioner (oaic.gov.au). (f) Brazil: Autoridade Nacional de Proteção de Dados (gov.br/anpd). (g) South Africa: Information Regulator (inforegulator.org.za). (h) Japan: Personal Information Protection Commission (ppc.go.jp). (i) Republic of Korea: Personal Information Protection Commission (pipc.go.kr). (j) New Zealand: Office of the Privacy Commissioner (privacy.org.nz). (k) Singapore: Personal Data Protection Commission (pdpc.gov.sg).

PART VI — ADDITIONAL PROVISIONS

Section 27. Children's Privacy

27.1. The Service is not directed to, designed for, or intended to be used by children under the age of sixteen (16) years, or under such higher minimum age as may be required by applicable law in the user's jurisdiction of residence (including but not limited to age thirteen (13) under the Children's Online Privacy Protection Act ("COPPA") in the United States, age sixteen (16) under the GDPR in certain EU Member States, or such other age as specified by applicable national implementing legislation). EarlyBurd does not knowingly collect personal information from children under the applicable minimum age. Because EarlyBurd does not collect personal information from any user regardless of age, the requirements of COPPA, Article 8 of the GDPR, and analogous provisions of other data protection laws regarding the processing of children's personal information are not implicated by the Service's data processing practices. If a parent or guardian becomes aware that their child has used the Service in a manner that raises privacy concerns, they may contact EarlyBurd at the address provided in Section 31.

Section 28. Proprietary Technology, Trade Secrets, and Confidential Business Information

28.1. The Proprietary Search Engine Technology, as defined in Section 1.8, represents the product of significant and sustained investment by EarlyBurd in research, development, engineering, testing, optimization, and continuous improvement. The technical architecture, system design, implementation details, algorithms, protocols, data structures, encoding formats, compression techniques, communication patterns, coordination mechanisms, routing strategies, node selection criteria, capacity management policies, load distribution algorithms, failover procedures, cache management strategies, rate governance mechanisms, binary protocol specifications, message envelope formats, frame structures, authentication mechanisms, access control configurations, security architectures, and all other technical aspects of the Proprietary Search Engine Technology constitute trade secrets within the meaning of the Uniform Trade Secrets Act (as adopted by applicable U.S. states), the Defend Trade Secrets Act of 2016, the Canadian common law of trade secrets, the EU Trade Secrets Directive (Directive (EU) 2016/943), the UK Trade Secrets (Enforcement, etc.) Regulations 2018, and all other applicable trade secret, intellectual property, unfair competition, and confidential information protection laws in all jurisdictions.

28.2. Nothing in this Policy, the Terms of Service, or any other agreement, representation, communication, or disclosure by EarlyBurd shall be construed as: (a) requiring, obligating, or committing EarlyBurd to disclose, describe, explain, document, diagram, publish, open-source, reverse-engineer-facilitate, or otherwise make available any aspect of the technical implementation of the Proprietary Search Engine Technology; (b) waiving, abandoning, dedicating to the public, or otherwise relinquishing EarlyBurd's trade secret rights, intellectual property rights, or proprietary interest in the Proprietary Search Engine Technology or any component thereof; (c) granting any license, right, permission, or authorization to any party to reverse-engineer, decompile, disassemble, probe, test, benchmark, analyze, or otherwise attempt to discover the technical implementation of the Proprietary Search Engine Technology; (d) describing, specifying, constraining, or limiting the technical mechanisms, methods, protocols, or architectures that the Proprietary Search Engine Technology may employ, currently or in the future; or (e) creating any obligation to maintain any particular technical architecture, protocol, method, or implementation detail, or to provide notice before modifying, replacing, or discontinuing any technical aspect of the Proprietary Search Engine Technology.

28.3. References in this Policy to technical processes, operations, mechanisms, protocols, components, systems, architectures, or other technical aspects of the Service or the Proprietary Search Engine Technology are provided solely for the purpose of transparency regarding the categories of data processed and the purposes for which data is processed, as required by applicable data protection and consumer protection laws, and do not constitute a technical specification, a representation of the current or future implementation, a limitation on the methods that may be employed, or a disclosure of trade secrets or confidential information. The categories and descriptions used in this Policy (such as "distributed infrastructure," "persistent connections," "binary transport," "coordination telemetry," "background processes," "geographic routing," and similar terms) are general, non-technical descriptions of broad categories of data processing activities and do not describe or reveal the specific, proprietary technical mechanisms by which such activities are performed.

Section 29. Third-Party Services and Links

29.1. The Service presents links to and information from Third-Party Marketplaces. EarlyBurd does not own, operate, control, or endorse any Third-Party Marketplace. This Policy applies solely to the data processing practices of EarlyBurd in connection with the Service and does not apply to the privacy practices, data collection practices, terms of service, or other policies or practices of any Third-Party Marketplace or any other website, platform, application, or service that is not owned and operated by EarlyBurd. Users are strongly encouraged to review the privacy policies and terms of service of any Third-Party Marketplace before interacting with listings or sellers on such marketplace. EarlyBurd is not responsible for the privacy practices, content, accuracy, availability, or security of any Third-Party Marketplace.

Section 30. Changes to This Policy

30.1. EarlyBurd reserves the right to modify, amend, supplement, or replace this Policy at any time, for any reason, in its sole and absolute discretion, including without limitation to reflect changes in the Service, changes in applicable law, changes in industry standards or best practices, changes in the Proprietary Search Engine Technology, changes in data processing practices, or for any other reason. When EarlyBurd makes material changes to this Policy, EarlyBurd will post the revised Policy on the Service with an updated "Last updated" date. Where required by applicable law, EarlyBurd will provide additional notice of material changes, such as a prominent notice on the Service or an email notification to users who have provided email addresses for notification purposes. Your continued use of the Service after the effective date of any revised Policy constitutes your irrevocable acceptance of and agreement to be bound by the revised Policy in its entirety. If you do not agree to any provision of a revised Policy, you must immediately cease all use of the Service. EarlyBurd encourages you to review this Policy periodically to remain informed about EarlyBurd's data processing practices. The fact that a particular data processing activity is not described in this Policy does not mean that such activity does not occur; it means only that the activity involves Non-Personal Technical Data and is not required to be disclosed under applicable law, or that the activity falls within the scope of a general category described in this Policy.

Section 31. Contact Information

31.1. If you have questions, concerns, comments, requests, or complaints regarding this Policy, the data processing practices described herein, or the exercise of any rights described in this Policy, you may contact EarlyBurd at:

EarlyBurd
Email: info.earlyburd@gmail.com
British Columbia, Canada

31.2. EarlyBurd will make commercially reasonable efforts to respond to inquiries within thirty (30) calendar days of receipt, or within such shorter timeframe as may be required by applicable law in your jurisdiction. EarlyBurd may request additional information from you to verify your identity or clarify the nature of your request before responding.

Section 32. Governing Law and Dispute Resolution

32.1. This Policy and any dispute, claim, controversy, or cause of action arising out of or relating to this Policy, the data processing practices described herein, or the privacy or data protection aspects of the Service (whether in contract, tort, statute, or otherwise), shall be governed by and construed in accordance with the laws of the Province of British Columbia and the federal laws of Canada applicable therein, without giving effect to any choice of law or conflict of law rules, provisions, or principles (whether of the Province of British Columbia, Canada, or any other jurisdiction) that would cause the application of the laws of any jurisdiction other than the Province of British Columbia and Canada. Subject to applicable mandatory consumer protection law in your jurisdiction of residence, any legal action or proceeding arising out of or relating to this Policy shall be brought exclusively in the courts of competent jurisdiction located in the Province of British Columbia, Canada, and you hereby irrevocably submit to the personal and exclusive jurisdiction of such courts.

Section 33. Limitation of Liability

33.1. To the maximum extent permitted by applicable law, EarlyBurd's total aggregate liability arising out of or in connection with this Policy, the data processing practices described herein, or any alleged violation of your privacy or data protection rights in connection with the Service shall not exceed the greater of: (a) the amounts, if any, paid by you to EarlyBurd for access to the Service during the twelve (12) months immediately preceding the event giving rise to the claim; or (b) fifty Canadian dollars (CAD $50.00). This limitation of liability applies regardless of the legal theory upon which the claim is based and regardless of whether EarlyBurd has been advised of the possibility of such damages.

Section 34. Indemnification

34.1. To the maximum extent permitted by applicable law, you agree to indemnify, defend, and hold harmless EarlyBurd, its affiliates, officers, directors, employees, contractors, agents, licensors, and service providers from and against any and all claims, demands, actions, liabilities, damages, losses, costs, and expenses (including reasonable attorneys' fees and court costs) arising out of or in connection with: (a) your use of the Service in violation of this Policy or applicable law; (b) any third-party claim that your use of the Service infringed or violated the rights of a third party; or (c) any dispute between you and any Third-Party Marketplace or third party arising from information presented by the Service.

Section 35. Severability

35.1. If any provision, clause, sentence, phrase, or word of this Policy, or the application thereof to any person, entity, or circumstance, is held to be invalid, illegal, void, unenforceable, or unconstitutional by any court of competent jurisdiction or governmental authority, such holding shall not affect the validity, legality, enforceability, or constitutionality of the remaining provisions of this Policy, which shall continue in full force and effect. In the event of any such holding, the invalid provision shall be reformed, modified, or replaced to the minimum extent necessary to render it valid, legal, and enforceable while preserving, to the maximum extent possible, the original intent and economic effect of the invalid provision. If such reformation is not possible, the invalid provision shall be severed from this Policy and the remaining provisions shall be interpreted as if the severed provision had never been included.

Section 36. Waiver

36.1. The failure of EarlyBurd to enforce any provision of this Policy at any time or for any period shall not be construed as a waiver of such provision or of the right to enforce such provision thereafter. No waiver of any provision of this Policy shall be effective unless made in writing and signed by an authorized representative of EarlyBurd. No waiver of any provision shall constitute a waiver of any other provision or of the same provision on any other occasion.

Section 37. Assignment

37.1. EarlyBurd may assign, transfer, delegate, or sublicense any or all of its rights and obligations under this Policy to any third party without your consent and without notice, including without limitation in connection with a merger, acquisition, corporate reorganization, asset sale, or similar transaction. You may not assign, transfer, delegate, or sublicense any of your rights or obligations under this Policy without the prior written consent of EarlyBurd.

Section 38. Entire Agreement

38.1. This Policy, together with the Terms of Service, the Cookie and Local Storage Disclosure (if published separately), and any other agreements, policies, or disclosures expressly incorporated by reference herein, constitutes the entire agreement between you and EarlyBurd with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, representations, warranties, understandings, negotiations, discussions, and communications, whether oral, written, electronic, or otherwise, relating to the privacy, data protection, or data processing aspects of the Service.

Section 39. Survival

39.1. The provisions of this Policy that by their nature are intended to survive termination or expiration of your use of the Service, including without limitation Sections 1 (Definitions), 5.2 (Excluded Purposes), 7 (Information EarlyBurd Does Not Collect), 9.1 (No Sale of Data), 10 (Data Retention), 11 (Data Security), 28 (Proprietary Technology and Trade Secrets), 32 (Governing Law), 33 (Limitation of Liability), 34 (Indemnification), 35 (Severability), 37 (Assignment), 38 (Entire Agreement), and this Section 39 (Survival), shall survive the termination or expiration of your use of the Service for any reason.

Section 40. Language

40.1. This Policy is drafted in the English language. In the event that this Policy is translated into any other language for convenience or as required by applicable law, the English language version shall prevail in the event of any conflict, ambiguity, or discrepancy between the English version and any translation.

Section 41. Effective Date

41.1. This Policy is effective as of October 25, 2026, and supersedes all prior versions of EarlyBurd's Privacy Policy. The terms and conditions of this Policy apply to all use of the Service on or after the effective date. Your use of the Service on or after the effective date constitutes your acceptance of this Policy in its entirety.