PRIVACY POLICY

Born to DIY Performance Parts, LLC ("ShiftCartel," "we," "us," or "our") operates the ShiftCartel platform at shiftcartel.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Platform. Our principal place of business is located at 201 S Las Vegas Blvd, Las Vegas, NV 89101. If you have questions about this Policy, contact us at [email protected].

Account Information: When you create a creator account, we collect your name, email address, and authentication credentials provided through our OAuth login provider. Profile Information: Information you voluntarily provide, including your display name, handle, bio, vehicle information, profile photo, and cover photo. Build & Parts Data: Vehicle build details, tagged parts, photos, and descriptions you upload to the Platform. Usage Data: Information about how you interact with the Platform, including pages visited, QR codes generated, links clicked, and features used. Transaction Data: Commission earnings, referral link performance, scan counts, and payout information. Device & Technical Data: IP address, browser type, operating system, referring URLs, and device identifiers collected automatically when you use the Platform. Communications: Messages you send to our support team.

We use your information to: • Operate and provide the Platform, including creator profiles, build pages, and QR code generation • Calculate and process commission payments • Send transactional emails (order confirmations, payout notifications, account alerts) • Analyze Platform usage to improve features and performance • Detect and prevent fraud, abuse, and violations of our Terms of Service • Comply with legal obligations • Send marketing communications (with your consent, which you may withdraw at any time)

We do not sell your personal information. We share your information only in the following circumstances: Service Providers: We share data with third-party vendors who help us operate the Platform (cloud hosting, payment processing, email delivery, analytics). These vendors are contractually obligated to protect your data and use it only for the services they provide to us. Public Profile: Your creator handle, display name, bio, and published builds are publicly visible on the Platform. Legal Requirements: We may disclose information when required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights or the safety of others. Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We use cookies and similar tracking technologies to maintain your session, remember your preferences, and analyze Platform usage. We also use Google Analytics to understand how visitors interact with the Platform. You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Platform, including your ability to stay logged in. We use Google Analytics with IP anonymization enabled. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

We retain your account information for as long as your account is active. If you delete your account, we will delete or anonymize your personal information within 90 days, except where retention is required by law or legitimate business purposes (such as maintaining records of commission payments for tax compliance). Build content you have published may remain visible on the Platform for up to 30 days after account deletion to allow for cache clearing.

We implement industry-standard security measures to protect your information, including HTTPS encryption, secure session management, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials. Please notify us immediately at [email protected] if you suspect unauthorized access to your account.

Depending on your location, you may have the following rights regarding your personal information: • Access: Request a copy of the personal information we hold about you • Correction: Request correction of inaccurate or incomplete information • Deletion: Request deletion of your personal information (subject to legal retention requirements) • Portability: Request your data in a machine-readable format • Opt-out: Opt out of marketing communications at any time To exercise these rights, email [email protected]. We will respond within 30 days. California Residents: Under the California Consumer Privacy Act (CCPA), you have additional rights including the right to know what personal information is collected, the right to delete, and the right to opt out of the sale of personal information. We do not sell personal information.

The Platform is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe we have collected such information, contact us at [email protected].

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on the Platform and updating the "Last Updated" date. Your continued use of the Platform after such changes constitutes your acceptance of the updated Policy.

For privacy-related questions or to exercise your rights: Born to DIY Performance Parts, LLC 201 S Las Vegas Blvd Las Vegas, NV 89101 [email protected]