DISHED PRIVACY POLICY

1. INFORMATION WE COLLECT

### Account and profile information Name, email address, phone number, password/authentication data, profile photo, and contact preferences. ### Business information If you create or manage a shop, we collect business name, description, category, licences or certifications you choose to provide, logo and photos, social links, pickup/service address, and identity or business-verification information required by Stripe Connect. See Section 15 for how we distinguish public listing information from private account information. ### Order and transaction information When an Order is placed, we collect the items ordered, quantities, prices, pickup or delivery details, special instructions, order status, refund and dispute information, transaction identifiers, and Customer–Business communications related to the Order. We do not receive or store full payment card numbers — payment credentials are collected and stored directly by Stripe. We may receive limited payment metadata from Stripe, such as the last four digits of a card, payment status, and transaction identifiers. ### Drops, waitlists, and preferences If you follow a shop, join a waitlist, request a Drop notification, or add an item to a cart, we record that activity so we can notify you and improve discovery. This is personal information tied to your account and your interests. ### Location information ### AI-assisted feature inputs If you use an AI-assisted tool (for example, to generate a shop logo, product image, or listing copy), we process what you submit — such as a business name, description, prompt, or uploaded image — and share it with our AI service provider(s) to generate output. If you use Dished AI, our business assistant, we also process your messages, your saved conversation history, and summarized information from your shop — such as order totals, item quantities, expected revenue, and production or recipe details — and share it with our AI service provider to answer you. See Section 18. ### Device and usage data IP address, browser and device characteristics, operating system, referring URLs, log and crash data, and information about how you interact with the Services. Collected automatically for security, troubleshooting, and analytics. ### Social login data If you register or log in using a social account (e.g., Google, Facebook, Apple), we receive the profile information that provider makes available to us, typically name, email address, and profile picture. ### Cookies and similar technologies See Section 6.

• Approximate location — derived from your IP address, used for general discovery (e.g., showing nearby Businesses).
• Precise location — collected only if you grant device-level permission, used for more accurate discovery, delivery coordination, or map features. You can withdraw this permission at any time in your device settings.

2. HOW WE USE INFORMATION

We use personal information to:

• create and secure accounts, and authenticate logins;
• operate the marketplace — display listings, process Orders, and facilitate payments through Stripe Connect;
• connect Customers with relevant Businesses based on location, preferences, and activity;
• send transactional communications necessary to your account or Order (see Section 19);
• send marketing communications, such as Drop alerts or promotions, where you have provided any consent required by law;
• generate AI-assisted content you request;
• provide customer support and respond to inquiries;
• detect and prevent fraud, abuse, and security incidents;
• analyze and improve the Services;
• comply with legal, tax, and regulatory obligations.

3. LEGAL BASES FOR PROCESSING (EEA, UK, AND SIMILAR JURISDICTIONS)

Where applicable data protection law requires a legal basis, we rely on: your consent (which you may withdraw at any time); performance of a contract (providing the Services you request, including Orders and subscriptions); our legitimate interests (operating, securing, and improving the marketplace, provided those interests do not override your rights); and legal obligations (tax, regulatory, and law-enforcement compliance). If you are located in Canada, we rely on express or implied consent, subject to the exceptions recognized under Canadian privacy law (for example, fraud investigation, legal process, or emergency situations involving vital interests).

4. WHEN AND WITH WHOM WE SHARE INFORMATION

### With Businesses, to fulfill your Order When you place an Order, we share the information the Business needs to process, fulfil, communicate about, and support it — typically your name, phone number, delivery or pickup details, order contents, and any instructions you provide. Businesses are independent parties and are contractually restricted to using this information only for the purposes described in our Terms of Service — they may not sell it, add you to unrelated marketing lists without your consent, or use it beyond fulfilling and supporting your Order. ### With service providers We share information with vendors who help operate the Services, including: Each provider processes information under its own privacy terms and only to the extent necessary to provide its service to us. ### Other situations We may also share information: in a business transfer (merger, acquisition, financing, or sale of assets); with other users, for information you choose to make public (e.g., reviews, public shop content); and where required to comply with law, enforce our Terms, or protect the safety, rights, or property of DISHED, our users, or the public. ### Sale and sharing of information We do not sell personal information for money. We do use analytics and advertising-related technologies (see Section 6) that some state privacy laws — including California's — classify as "sharing" because they involve cross-context tracking for advertising purposes. Where that classification applies, you can opt out as described in Section 13.

• Stripe — payment processing, identity/business verification, fraud prevention, disputes, and payouts (Stripe's Privacy Policy);
• Firebase / Google Cloud — hosting, authentication, and database infrastructure;
• Delivery providers (e.g., Uber Direct), where a Business or Customer selects third-party delivery — we share the information necessary to complete the delivery, such as name, phone number, pickup location, delivery address, and order details (Uber's Privacy Policy);
• AI service providers, to generate content you request through AI-assisted features and to answer your questions in Dished AI — currently Google (Gemini). See Section 18;
• Email and SMS providers, to deliver transactional and, where consented, marketing messages;
• Analytics providers (e.g., Google Analytics), to understand usage and improve the Services;
• Mapping providers (e.g., Google Maps Platform), to support location-based discovery and directions.

5. THIRD-PARTY WEBSITES

The Services may link to third-party websites or content not affiliated with DISHED. We are not responsible for the privacy or security practices of third parties. Review their policies before providing information to them.

6. COOKIES AND TRACKING TECHNOLOGIES

We and our service providers use cookies and similar technologies to operate the Services securely, remember your preferences, and understand usage. We also permit analytics and advertising technology — such as Google Analytics, including its advertising features — to help us measure and, where applicable, tailor content. You can control cookies through your browser settings; disabling them may affect some features. To opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout. To opt out of interest-based advertising generally, visit http://www.aboutads.info/choices/ or http://optout.networkadvertising.org/.

7. SOCIAL LOGINS

If you log in through a social account, we receive the profile information that provider shares with us and use it only as described in this Policy. Your relationship with that provider is governed by its own terms and privacy policy — we don't control how it handles your information on its end.

8. HOW LONG WE KEEP INFORMATION

We retain personal information only as long as necessary for the purpose it was collected, including: Deleting your account does not automatically delete records we are required to retain for tax, fraud-prevention, dispute, or legal purposes; we isolate that information from routine use until it can be deleted.

• Account information — for as long as you maintain an account with us;
• Order and transaction records — for the period required for tax, accounting, and financial recordkeeping, typically several years after the transaction;
• Payment-dispute and fraud-related information — as long as needed to resolve the matter and meet payment-network requirements;
• Legal and compliance records — as long as required by applicable law.

9. HOW WE PROTECT INFORMATION

We use reasonable technical and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. CHILDREN'S PRIVACY

The Services are intended for users 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it.

11. YOUR PRIVACY RIGHTS

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information; restrict or object to certain processing; withdraw consent; and, in some regions, request data portability or lodge a complaint with a supervisory authority (for example, the Office of the Privacy Commissioner of Canada, an EEA Member State authority, the UK ICO, or the Swiss FDPIC). To exercise these rights, email support@dished.info with your request. We will verify your identity before acting on it and respond within the time required by applicable law. Marketing opt-out. You can unsubscribe from marketing email at any time using the link in the message, and from marketing SMS by replying STOP. You will still receive transactional messages tied to your account or an active Order — see Section 19.

12. DO-NOT-TRACK SIGNALS

No common industry standard for Do-Not-Track exists yet, so we do not currently respond to browser DNT signals.

13. U.S. STATE PRIVACY RIGHTS

If you are a resident of a state with a comprehensive privacy law (including California, Colorado, Connecticut, Virginia, and others as they take effect), you have rights including: the right to know what personal information we process about you; access and obtain a copy of it; correct inaccuracies; request deletion; and opt out of targeted advertising, the sale of personal information, or profiling used for legally significant decisions. Categories of personal information we process (in the past 12 months): identifiers (name, email, phone, IP address); commercial information (order and transaction history); internet/network activity (usage and log data); geolocation data (approximate or precise, as described in Section 1); and, for Businesses, professional/business information. We do not knowingly process sensitive categories such as biometric, health, or precise-location-of-a-minor data. We disclose the categories above to the service providers listed in Section 4 for the purposes described in this Policy. As explained above, we do not sell personal information for money; some analytics/advertising technology may constitute "sharing" under certain state laws, and you can opt out using the contact method in Section 11 or applicable browser controls described in Section 6. To exercise these rights, email support@dished.info. You may designate an authorized agent where permitted by law. If we decline a request, you may appeal by replying to our response, and — if still unsatisfied — file a complaint with your state attorney general. California residents may also request, once per year and free of charge, information about categories of personal information disclosed to third parties for direct marketing purposes ("Shine the Light") by emailing the address above.

14. OTHER REGIONS

Australia and New Zealand. We process personal information consistent with Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. You may request access to or correction of your information using the contact details above, and may complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner if you believe we have unlawfully processed your information.

15. BUSINESS INFORMATION: PUBLIC VS. PRIVATE

Not everything a Business provides becomes public. We distinguish: We encourage home-based Businesses to review their listing before publishing and use a pickup or service-area description rather than a home address where the Services allow it.

• Public listing information — shop name, description, category, photos, menu/product listings, approximate service area, and social links, all displayed to Customers to support discovery.
• Private account information — legal name, home or pickup address (unless the Business chooses to display it), government or Stripe verification documents, banking details, and other identity-verification information, which we do not publish and share only as described in Section 4.

16. STRIPE CONNECT AND PAYMENTS

Businesses that accept payments do so through Stripe Connect. To activate payments, a Business provides Stripe with identity, business, banking, and tax information directly; DISHED shares with Stripe the information necessary to create and manage the connected account, process transactions, prevent fraud, issue refunds, manage disputes, facilitate payouts, and comply with financial regulations. That information is also subject to Stripe's Privacy Policy. We do not store full card numbers or bank account credentials.

17. DELIVERY PROVIDERS

Where a Business or Customer arranges third-party delivery (for example, through Uber Direct), we share the information the delivery provider needs to complete the delivery — typically name, phone number, pickup location, delivery address, and order/fulfillment details. Delivery providers process that information under their own privacy policies.

18. AI-ASSISTED FEATURES

If you use an AI-assisted tool on DISHED, information you submit — such as a business name, description, prompt, product details, or an uploaded image or logo — is sent to our AI service provider(s) to generate output for you. We use providers under service-provider or similar contractual terms limiting their use of your input to providing this functionality. We may change AI providers or the underlying technology over time without changing how your information is protected under this Policy. ### Dished AI (business assistant) Dished AI is a conversational assistant available to Businesses in the shop dashboard. It is powered by Google Gemini, provided by Google. Google processes this information as our service provider. What we send. In addition to what you type, Dished AI automatically attaches the shop information needed to answer your question. Depending on what you ask, this can include: What we do not send. Dished AI is built to send business figures, not customer records. We do not include customer names, email addresses, phone numbers, delivery addresses, payment or card information, or the free-text notes attached to an order in the information we attach automatically. Order data is aggregated into totals before it is sent. What you type is up to you. Anything you type into Dished AI is sent to Google as part of your prompt. Please do not enter information the assistant does not need — in particular customer names or contact details, payment or card information, government identifiers, or health and allergy information about a customer. Saved conversations and retention. We store your Dished AI conversations so you can reopen and continue them. Because the assistant keeps conversational context, Google also stores a copy of each exchange for a limited period under its own retention schedule for stored interactions. Deletion. You can delete an individual conversation, or delete all of your Dished AI history, from the assistant at any time. When you do, we delete our copy and ask Google to delete the copies it is holding. If a provider deletion does not succeed at that moment, we tell you in the app rather than reporting the conversation as fully deleted, we retry, and any remaining provider copy expires on Google's retention schedule. Accuracy. Dished AI can be wrong, incomplete, or out of date, and its answers depend on the accuracy of your own shop data. It is an assistant, not your order ledger or a production-control system, and it does not replace the underlying records in your dashboard. Please review quantities, ingredients, allergens, food-safety information, dates, and pricing before relying on them. See Section 19 of the Terms. Where processing happens. Dished AI processing takes place on Google infrastructure and may occur outside your province, state, or country, including in the United States. See Section 20 for how we handle international transfers.

• summarized order information — how many orders you have in a date range, order statuses, total item quantities by product name, expected revenue totals, and pickup/delivery counts;
• production and recipe information — calculated batch quantities, ingredients, and units for a date, and any recipe you paste in or ask us to format;
• your message, and recent conversation context or a short summary of the conversation, so the assistant can follow what you are discussing.

19. DROPS, NOTIFICATIONS, AND COMMUNICATION PREFERENCES

We maintain separate preferences for transactional communications (order confirmations, pickup reminders, refund updates, account-security notices) and marketing communications (Drop alerts, promotions, newsletters), across email, SMS, and push notification channels. Marketing messages require any consent applicable law requires and can be turned off independently of transactional messages, which continue for as long as you have an active Order or account-security need. You can manage these preferences in your account settings or through the opt-out instructions in Section 11.

20. INTERNATIONAL DATA TRANSFERS

Our service providers, including hosting and infrastructure providers, may process information outside the country where you live, including in the United States. Where required, we use appropriate safeguards for such transfers under applicable law.

21. CHANGES TO THIS POLICY

We may update this Policy as our Services, legal obligations, or practices change. We will update the "Last updated" date above and, where required by law, provide additional notice.

22. CONTACT US

Dished Inc., operating as DISHED Toronto, Ontario, Canada support@dished.info To review, correct, or delete the personal information we hold about you, email us at the address above.