Kova Privacy Policy

LSN Live Shopping Network LLC, a Delaware limited liability company doing business as Kova (“Kova,” “we,” “us,” or “our”), respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our websites at onkova.com, our mobile applications, our live-shopping experiences, and related services (collectively, the “Platform”), and the rights and choices available to you.

This Policy applies to personal information we process as a controller. It does not apply to information handled by independent third parties, such as Hosts, third-party Sellers, or payment processors acting under their own policies. Where we operate a marketplace and a third-party Seller is the merchant of record for your purchase, that Seller may process certain personal information (such as your shipping details) as an independent controller under its own policy. Capitalized terms not defined here have the meaning given in our Terms of Service.

The Platform is offered from and directed to users in the United States. We do not target the Platform to consumers in the European Economic Area (“EEA”), the United Kingdom, or Switzerland. Sections 6 and 12 apply only to the extent such laws apply to you.

The Platform is intended only for users who are at least eighteen (18) years old. We do not knowingly collect personal information from anyone under 18, and we do not direct the Platform to children. We apply a neutral age screen at account creation and may use additional age-assurance signals where appropriate. If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe a minor has provided us information, contact us at legal@onkova.com and we will act without undue delay.

We collect the following categories of personal information. The specific information we collect depends on how you interact with the Platform.

We collect personal information from: (a) you, when you register, shop, post content, or contact us; (b) automatically, through cookies and similar technologies as you use the Platform; and (c) third parties, including Hosts and Sellers, payment processors such as Stripe and Shopify, analytics and advertising partners, fraud-prevention providers, and social-login providers.

We use personal information to:

• Provide, operate, and maintain the Platform and your account;
• Process and fulfill orders, payments, shipping, returns, and customer service;
• Power live-shopping experiences, host-matching, and interactive features;
• Personalize your experience, including recommendations, search ranking, and content;
• Communicate with you, including transactional messages and, where permitted, marketing;
• Measure and analyze usage, conduct research, and improve and develop the Platform;
• Detect, prevent, and address fraud, security incidents, abuse, and other harmful activity;
• Comply with legal obligations and enforce our Terms; and
• Fulfill other purposes disclosed to you or to which you consent.

Artificial Intelligence and Machine Learning

The Platform uses artificial intelligence and machine learning to personalize your experience, surface Products, support Hosts, and improve our features. To develop, train, and improve these models, we use aggregated and de-identified data, which does not identify you and which we do not attempt to re-identify. We do not use your identifiable personal information to train models for purposes unrelated to operating and personalizing the Platform, and we do not use the content of your live streams, audio, or video to train facial-recognition or voice-recognition systems. AI outputs may be inaccurate or incomplete, and you remain responsible for evaluating Products and information before relying on them.

If and to the extent the GDPR or UK GDPR applies to you, we process your personal information on the following legal bases:

• Contract — to provide the Platform and complete transactions you request;
• Legitimate interests — to secure, analyze, and improve the Platform and prevent fraud, balanced against your rights;
• Consent — for certain marketing, cookies, and processing of sensitive data, which you may withdraw at any time; and
• Legal obligation — to comply with applicable law.

We and our partners use cookies, pixels, SDKs, and similar technologies to operate the Platform, remember your preferences, measure performance, and deliver and measure advertising. You can control cookies through your browser settings and through our cookie-preference tool, available through the “Cookie Settings” link on the Platform. We honor recognized opt-out preference signals, including the Global Privacy Control (GPC), where required by law.

We disclose personal information to:

• Service providers and processors who perform services on our behalf, such as hosting, streaming, analytics, customer support, communications, and fraud prevention;
• Payment processors, including Stripe and Shopify and their partners, to process payments and merchandise transactions;
• Hosts and Sellers, to the extent necessary to fulfill your orders and interactions (for example, sharing shipping details with the Seller of record);
• Advertising and analytics partners, which may involve sharing identifiers and usage data for cross-context behavioral advertising, subject to your opt-out rights;
• Legal and safety recipients, when required by law or legal process or to protect rights, safety, and property; and
• Business-transfer recipients, in connection with a merger, acquisition, financing, or sale of assets.

We do not sell personal information for money. However, certain disclosures for advertising and analytics may be considered a “sale” or “sharing” under some U.S. state laws. You can exercise your opt-out rights as described in Section 10.

We retain personal information for as long as needed to provide the Platform and fulfill the purposes described in this Policy, and thereafter as needed to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. We determine retention periods based on the type and sensitivity of the information, the purpose for which we use it, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements. When information is no longer needed, we delete or de-identify it. The periods below are illustrative and may vary by context:

Depending on your state of residence (including California under the CCPA/CPRA, and Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws), you may have the right to:

• Know and access the categories and specific pieces of personal information we have collected;
• Delete personal information we have collected, subject to exceptions;
• Correct inaccurate personal information;
• Opt out of the “sale” or “sharing” of personal information and of targeted and cross-context behavioral advertising;
• Limit the use of sensitive personal information to permitted purposes;
• Data portability — receive a copy of your information in a portable format; and
• Non-discrimination — we will not discriminate against you for exercising your rights.

To opt out of sale and sharing and of targeted advertising, use the “Do Not Sell or Share My Personal Information” link on the Platform or enable the Global Privacy Control. California residents may also have rights regarding our disclosure of information to third parties for their direct-marketing purposes. We will respond to verifiable requests within the timeframes required by applicable law.

We use and disclose sensitive personal information only for purposes permitted under applicable law, such as providing the Platform you request, security, and fraud prevention. We do not use sensitive personal information to infer characteristics about you for advertising. Where consent is required, we will obtain it.

To the extent the GDPR or UK GDPR applies to you, you have the right to access, rectify, erase, restrict, or object to processing of your personal information; the right to data portability; and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority or, in the UK, the Information Commissioner’s Office. We will respond to requests as required by the GDPR and UK GDPR. We have not appointed an Article 27 representative because we do not target the Platform to individuals in the EEA or UK; if that changes and a representative is required, we will update this Policy with the representative’s contact details.

We are based in the United States and process personal information there and in other countries. If we transfer personal information from the EEA, UK, or Switzerland to countries that do not provide an equivalent level of protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. You may request a copy of the relevant safeguards by contacting us at legal@onkova.com.

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Help protect your account by keeping your credentials confidential.

You may submit a privacy request by emailing legal@onkova.com or using any request mechanism we provide on the Platform. We will verify your identity before fulfilling your request and may ask for additional information for that purpose. You may use an authorized agent to submit a request on your behalf, subject to verification. If we deny your request, you may appeal by replying to our decision, and we will respond as required by applicable law.

The Platform may link to or integrate third-party websites and services, including Hosts, Sellers, payment processors, and social platforms. Their privacy practices are governed by their own policies, and we are not responsible for them. Review those policies before providing your information.

We may update this Privacy Policy from time to time. We will post the updated Policy with a new “Last Updated” date and, for material changes, provide additional notice where required. Your continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

If you have questions or requests regarding this Privacy Policy or your personal information, contact us at: