Privacy Policy

This Privacy Policy explains how Gesture US, Inc. (“Gesture,” “we,” “us,” or “our”) collects, uses, and shares personal information through the Gesture App, gesture.vip, app.gesture.vip, Gesture for Business, and related services (collectively, the “Services”). It also covers information we process about recipients and campaign audiences, including people who do not have Gesture accounts, and about representatives of merchants and delivery carriers or couriers who use the Services. When an organization, such as an educational institution (an “Institution”), a hospitality business (a “Host”), or a commercial brand partner (a “Brand Partner”), invites you to Gesture and gives us your contact information so that we can run its campaign, we call that organization an “Enterprise Client.” For information an Enterprise Client provides to us, Gesture acts as the Enterprise Client’s service provider and processes that information on the Enterprise Client’s behalf to run the Enterprise Client’s campaign and as described in Sections 3 and 5. For information you provide to us directly, and for your activity in the Services, Gesture is the business responsible for your information. This Privacy Policy is incorporated into our Consumer Terms and Conditions (the “Terms”). Capitalized terms not defined here have the meanings given in the Terms. This Privacy Policy applies to the Services offered in the United States. If there is a conflict between this Privacy Policy and the Terms regarding the handling of personal information, this Privacy Policy controls. “Personal information” means information that identifies, relates to, or could reasonably be linked with you or your household; it does not include de-identified or aggregated information that we maintain in accordance with Section 3.

From you directly: • Account data: name, email, phone, date of birth or age range, login credentials or third-party login tokens (Google, Apple, Facebook, LinkedIn), profile photo and username if you add them, and, for users aged 13–17, the parent or guardian contact information and consent record described in Section 11 • Order and delivery data: Recipient names, addresses, phone numbers, email addresses, and Gesture screen names, delivery instructions, item selections, occasion context, any indication that a Recipient is under 18, and the Moments visibility setting you select for an Item • Gift Content: written messages, greeting cards, photos, selfies, doodles, and videos you attach to an Item • Contacts and Circle: if you choose Recipients from your device contacts or your Circle in the App, the names and contact details you select; we do not upload your full contact list • Redemption data, if you are a Recipient: when you redeem a G-Link or accept an Item, the mobile phone number you verify, the delivery address you enter, and any delivery date or window you select • Payment data: processed by our payment processors (currently Stripe, Inc.); we do not store full card numbers, though we receive a payment token, card type, last four digits, and billing ZIP code • Wallet data: Gesture Cash balances, issuance, and redemption history, including whether a balance was purchased, promotional, or Enterprise Client-funded • Age-verification outcome: for alcohol and other age-restricted Items, age is verified at delivery by the Licensee or the Delivery Provider, not by Gesture. We receive only a record that age was verified or that the delivery was refused; we do not receive or retain the identification document, an image of it, its number, or the date of birth shown on it • Moments and other content you post: text, photos, video, ratings, and reviews you choose to share, Items you send or receive that appear in Moments according to your visibility settings, and information about how others interact with that content • Communications and support requests, including the content of messages you send to us through the Services Automatically: • Device and usage data: device identifiers, app version, IP address, operating system, browser type, language settings, interactions, redemption events, push notification tokens, and attribution data from links, G-Links, and QR or smart-tag entry points • Location data: approximate location derived from IP address; precise geolocation only if you enable location services in the App, and only while you are using the App • Cookies and similar technologies on our websites and software development kits (“SDKs”) in our apps, as described in Section 14 From other sources: • Enterprise Clients: contact lists and related fields (for example, email, name, phone number, postal address, last engagement or purchase data) that an Enterprise Client provides so that we can run its campaign • Licensed data providers: demographic, interest, household, lifestyle, purchase-propensity, and identity-linking data matched to an email address or postal address • Publicly available sources: public social media profiles and other public signals located using an email address or a handle you or an Enterprise Client provides • Third-party login providers: name, email address, profile photo, and account identifier that Google, Apple, Facebook, or LinkedIn share with us when you use them to sign in, as permitted by your settings with that provider • Other users: information a Sender provides about you as a Recipient, and information Merchants and Delivery Providers record about a delivery (for example, delivery confirmation, a photo of the delivered Item, and the age-verification outcome) • Wireless carriers: with your authorization in the Terms, information about your account and device that your carrier or its service provider shares with us to verify your identity and prevent fraud Inferences. We combine the information above to create inferences about your preferences, interests, and likely responses, as described in Section 3. Sensitive personal information. Of the categories above, the following are “sensitive” under certain state laws: account login credentials; precise geolocation (only if you enable it); and personal information of users under 18. We do not collect Social Security numbers, biometric identifiers, health, or genetic information, and we do not infer race, religion, sexual orientation, or health status. We use sensitive personal information only for the purposes permitted by law without an opt-out (providing the Services you request and security) and do not sell or share it or use it to infer characteristics about you.

Gesture’s recommendations are powered by a proprietary intelligence engine that builds interest and preference profiles to match people with items and experiences they will value. Enrichment always starts from a unique identifier provided to us, typically an email address, or a postal address for delivery Items. We do not build profiles from a name alone. When an Enterprise Client invites you, we enrich and score the information the Enterprise Client provides before, and whether or not, you register with Gesture, so that the Enterprise Client’s campaign can be personalized. To do this, we send your identifier to licensed data providers and to providers of publicly available web and social information, solely so that they can return matching information to us. We combine licensed data, public signals, and platform activity into a preference profile used for recommendations and campaign scoring. Profiles may include inferences about your interests, life stage, household, and likely response to particular Items or offers. They do not include, and we do not attempt to infer, sensitive characteristics such as health conditions, religion, sexual orientation, or immigration status. Scores are calculated separately for each Enterprise Client’s campaign and are not reused for any other Enterprise Client. How long we keep profiles, and the information used to build them, is described in Section 9. Model training and product development. We use personal information for analysis, research, and product development, including to develop, test, train, and improve the models that power our recommendations, our Automated Features, and the Gesture Intelligence Companion. Information you provide to us as a registered user, and content you post through the Services, may be used for these purposes in identifiable, aggregated, or de-identified form, as described in Section 8 of the Terms and subject to the rights described in Section 8 of this Privacy Policy. We do not use private personal messages between a Sender and a Recipient for marketing or public display without the Sender’s consent. We may use information an Enterprise Client provides, and the enrichment and scores we generate from it, to improve our Services and models, but we do not use that information to perform services for any other organization, to build or modify a profile of you for another organization’s use, or to correct or add to information we obtained from another source. Models we use across more than one Enterprise Client’s campaign are not built or trained in a way that could reproduce any Enterprise Client’s information. We do not use data we license from third-party data providers to train our models. For campaigns run by an Institution, we use the information the Institution provides to improve our models only after it has been de-identified, as described in Section 7. Where we de-identify data, we take reasonable measures to ensure it cannot be associated with an individual, we publicly commit to maintain and use it only in de-identified form and not to attempt to re-identify it, and we contractually require any recipient of the data to do the same. Profiling and automated processing. The preference profiles described above are used to rank and recommend Items, to personalize the content you see, and to help an Enterprise Client decide whom to include in its campaign and what to offer. They are not used to make decisions that produce legal or similarly significant effects on you, such as decisions about credit, insurance, housing, employment, education, or access to essential services, without human involvement. Residents of certain states may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, as described in Section 8. You may also ask us to delete your profile at any time. Public sources. When we locate public social media profiles or other public signals, we collect only information that the individual has made publicly available, we do so through methods that comply with the terms of the source platform, and we do not collect information from accounts set to private or from minors’ accounts where the age is apparent.

• Provide, personalize, and improve the Services, including AI-driven recommendations, the Gesture Intelligence Companion, and your eligibility for promotional offers • Process orders, deliveries, payments, and wallet transactions, including generating and delivering G-Links, arranging delivery through Merchants and Delivery Providers, and confirming delivery • Verify age and identity where required by law, including for alcohol and other age-restricted Items, and obtain and record parental consent for users under 18 • Operate Enterprise Client campaigns and experiences, including eligibility matching, gated redemptions, and timed unlocks • Score and segment each Enterprise Client’s campaign audience for that Enterprise Client’s campaign • Communicate with you, including transactional and, with your consent where required, marketing messages and push notifications • Operate Moments and other community features, including moderating content and enforcing our Content Guidelines • Analyze usage of the Services, measure the performance of campaigns and features, and improve our Services and models as described in Section 3 • Fraud prevention, security, legal compliance, and enforcement of our Terms, including responding to legal process and protecting the rights and safety of users and the public We do not use personal information for purposes that are materially different from, unrelated to, or incompatible with those described here without providing you notice and, where required, obtaining your consent.

This Section describes what Gesture does with your information as the business responsible for it, and what an Enterprise Client that invited you can see about you before and after you register. For information an Enterprise Client provides to us, Gesture acts as that Enterprise Client’s service provider under our agreement with it. • Enterprise Clients: before you register, the Enterprise Client that invited you receives only your delivery status, whether you have registered, and statistics about its campaign that do not identify you. After you register and accept our Terms and this Privacy Policy, the Enterprise Client may also see the scores, rankings, and inferences our intelligence engine generates about you for its campaign, and your activity in that campaign (for example, redemption and engagement). An Enterprise Client never sees data we license from third-party data providers, and an inference shown to an Enterprise Client will not restate such data. It receives information only about its own campaign audience and never receives your account credentials, payment information, personal messages, or your activity outside its campaign. If we identified you for a particular campaign rather than the Enterprise Client providing your information, the Enterprise Client receives only statistics that do not identify you until you register. Where the Enterprise Client is an Institution, the information reported is limited as described in Sections 6 and 7. • Merchants and Delivery Providers: to fulfill an order, the Merchant receives the Item selection, the delivery address, and any Gift Content to be included with the Item; the Delivery Provider receives the Recipient’s name, delivery address, phone number where required for delivery, delivery instructions, and, for age-restricted Items, the requirement to verify age. Merchants and Delivery Providers are independent businesses and may not use this information for any purpose other than fulfilling the order. • Other users: a Recipient sees the Sender’s name and any Gift Content; a Sender sees delivery status and, where available, a delivery confirmation photo. Items you send or receive may appear in your and the Recipient’s Moments feed according to the visibility setting selected at checkout or in account settings, and a Recipient who has an account may separately control whether an Item they receive is visible on their profile. If you post on Moments, your username, profile photo, and content are visible to other users according to your settings. • Service providers: cloud hosting, payment processing, CRM, delivery and fulfillment partners, communications and push providers, analytics, and attribution tools, bound by contract to use data only to provide services to us • Data providers: we send an email address (and, where provided, a social handle or postal address) to licensed data providers and to providers of publicly available web and social information, which use it solely to return matching information to us • Wireless carriers and messaging platforms: phone numbers and message content necessary to deliver text messages, subject to carrier requirements • Corporate events: in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the successor to honor this Privacy Policy or provide you notice and any choices required by law • Legal: to comply with law, protect rights and safety, and enforce agreements Sale and sharing of personal information. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or use it for targeted advertising, as those terms are defined under state privacy laws. In particular: we do not sell, license, or otherwise disclose to any third party the enrichment data or inferences that we obtain from licensed data providers or public sources or that our intelligence engine generates, and we use that information only within our own Services; the identifiers we transmit to licensed data providers are provided solely so that the provider can return matching data to us; Enterprise Clients receive only the information described above; and we do not use third-party advertising or retargeting technologies on the Services. Using information to improve our Services or to train our models, as described in Section 3, is not a sale or sharing of that information. Because we do not sell or share personal information, and because we process the information an Enterprise Client provides as its service provider, we are not a “data broker” under the laws of California, Texas, Vermont, or Oregon, and no opt-out of sale or sharing is required. If our practices change, we will update this Privacy Policy before the change takes effect and provide any opt-out mechanism required by law. We do not knowingly sell or share the personal information of anyone under 16.

If someone sends you an Item through Gesture, or an Enterprise Client includes you in its campaign, we may process your name, email, address, phone number, and enrichment data as described above, even if you do not have an account. If an Enterprise Client invited you, we may deliver the Enterprise Client’s gift or kit to you before you register; registering is voluntary and lets you continue the experience in the Gesture App. When you are first contacted about an Item or a campaign, the message will identify Gesture, link to this Privacy Policy, and tell you how to decline and how to stop further messages. Before you redeem a G-Link or accept an Item, we will show you a short summary of how we use your information and the choices you have. You do not need an account to redeem a G-Link, accept or decline an Item, stop messages, or exercise the rights in Section 8. If you do not redeem or accept an Item within the Redemption Period described in the Terms, the order is cancelled and the Sender is refunded. You may stop messages at any time by replying STOP or by following the instructions in the message, and you may ask us not to deliver further Items to you from a particular Sender, or at all, by contacting support@gesture.vip. If an Enterprise Client invited you, what the Enterprise Client sees before and after you register is described in Section 5, and you may also contact that Enterprise Client directly with questions about the information it shared with us before you registered. Recipients under 18. If the Sender indicates that you are under 18, or we otherwise learn that you are, we will direct acceptance and delivery communications to your parent or legal guardian, who alone may accept the Item or redeem a G-Link for it, and we will not build a preference profile, send you marketing, or include you in a campaign audience. Your parent or guardian may exercise the rights in Section 8 on your behalf.

Where an Institution runs a campaign, participation is voluntary and has no effect on your standing at the school, and the school controls which of its information is provided to us. Where a school provides information from education records, we act as the school’s service provider under a written agreement and as a “school official” under the Family Educational Rights and Privacy Act, and we use that information only for the campaign the school directs and as that law permits. Registering for a Gesture account governs only the information you provide to us directly; it does not expand what we may do with information your school provided. We do not use student campaign data for unrelated advertising. We do not build preference profiles from, or enrich, information about students that a school identifies as under 18, and any student under 18 is included only through the parental process described in Section 11. A school may use the campaign reporting we provide only to administer its campaign, and may not use it to evaluate, rank, admit, discipline, or make any academic or financial-aid decision about a student; we do not provide schools with outputs of our intelligence engine or the Gesture Intelligence Companion about individual students. We use information your school provides to improve our models only after it has been de-identified so that no student can reasonably be identified. After you register, information you provide to us directly and your activity in the Services are used as described in Section 3.

Depending on your state (currently California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and other states as their laws take effect), you may have some or all of the following rights with respect to your personal information: • Access / know: to confirm whether we process your personal information and to obtain a copy, including the inferences and scores we have generated about you, and to learn the categories collected, the sources, the purposes, and the categories of third parties to whom it was disclosed, sold, or shared • Correct inaccurate personal information • Delete personal information, including the inferences and scores we have generated about you, subject to exceptions permitted by law • Portability: to receive your personal information in a portable and readily usable format • Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, and of any sale or sharing of personal information or targeted advertising should we ever engage in those practices (we currently do not) • Limit the use of sensitive personal information to the purposes permitted by law • Appeal a decision we make on your request • Non-discrimination: we will not deny you services, charge you a different price, or provide a different level of service because you exercised these rights, except as permitted by law How to exercise your rights. Email privacy@gesture.vip or submit the Privacy Requests form in the App or at gesture.vip/privacy. You may also call 1-347-960-2110 for assistance with a request. You do not need an account to submit a request, and the web form is available to anyone whose information we hold. We will verify your identity by matching information you provide against information we hold (for example, the email address or phone number at which you were contacted) and by asking you to confirm a code or link sent to that email address or phone number; for accounts, we may instead require you to be logged in. We may ask for additional information for deletion requests or requests involving sensitive information. An authorized agent may submit a request on your behalf if the agent provides your signed permission or a power of attorney and we can verify your identity. We will respond within 45 days, and may extend once by 45 days where reasonably necessary, in which case we will notify you. Where we hold information as an Enterprise Client’s service provider, we will identify the Enterprise Client, forward your request to it, and support it in responding, or act on your request as the law requires. Appeals. If we deny your request in whole or in part, you may appeal by replying to our decision or emailing privacy@gesture.vip with “Appeal” in the subject line within 60 days. We will respond within 45 days (60 days for Colorado residents) with a written explanation. If your appeal is denied, you may contact your state Attorney General; we will provide the contact information with our decision. Opt-out preference signals. The Global Privacy Control (“GPC”) is a setting available in certain web browsers and browser extensions that automatically tells each website you visit that you do not want your personal information sold or shared. Because we do not sell or share personal information, a GPC signal does not change how we process your information. If our practices ever change, we will treat a GPC signal as a request to opt out of sale, sharing, and targeted advertising for that browser and, if you are logged in, for your account. Additional choices. You may opt out of marketing emails via unsubscribe links; opt out of marketing text messages by replying STOP (see Section 13); manage push notifications in device settings; turn off location services in your device settings; control who can see your Moments content, and whether Items you send or receive appear in Moments, in your account settings; delete your account at any time from account settings or by emailing support@gesture.vip; and limit cookies via browser controls (see Section 14).

We retain personal information as long as needed for the purposes above, and no longer than the periods below unless a longer period is required by law, litigation hold, or a specific legal obligation: • Account data: for the life of the account; deleted within 45 days after you delete your account or we verify your deletion request, with removal from backups within a further 90 days, except as described in the Terms • Order, delivery, and wallet transaction records: seven years after the transaction, for tax, accounting, and dispute purposes • Recipient contact information and Gift Content for an order that is cancelled or that the Recipient never redeems or accepts: deleted within 30 days after cancellation, except as part of the transaction record • Personal messages and other Gift Content: for the life of the Sender’s account or until deleted by the Sender, except that a Recipient who has retained a message keeps their copy • Age-verification outcome records: retained as part of the order record for the transaction-record period stated above, or longer where required by state alcohol law • Enrichment, scores, and preference profiles built from information you provide to us as a registered user: for the life of the account, and deleted within 45 days of a verified request; information we license from third-party data providers is kept no longer than our license to it allows • Information an Enterprise Client provides, and the enrichment and scores we generate from it: deleted or de-identified within 30 days after the earliest of completion of the Enterprise Client’s campaign, the end of the Enterprise Client’s agreement with us, or the Enterprise Client’s request; registering with Gesture does not extend how long we keep information an Enterprise Client provided. Deletion does not extend to trained models that cannot reproduce the information • Device, usage, and analytics data: 24 months, after which it is deleted or aggregated • Records of your privacy requests: 24 months, as required by law

We use administrative, technical, and physical safeguards, including encryption in transit and at rest for sensitive data, access controls, logging and monitoring, vendor security review, and cloud infrastructure security, designed to meet the requirements of the New York SHIELD Act and similar state laws. No system is completely secure, and we cannot guarantee the security of your information. If we become aware of a breach of security affecting your personal information, we will notify you and regulators as required by applicable law. You are responsible for keeping your account credentials confidential.

The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will delete it; if you believe a child under 13 has provided us information, contact privacy@gesture.vip. Users aged 13 to 17. A person aged 13 to 17 may use the Services only if a parent or legal guardian has agreed to the Terms on their behalf through the parental-consent process in the Services, which requires the parent to provide contact information and confirm consent. For users under 18, we: (a) collect and use personal information only as strictly necessary to provide the Services the user requests and for security, or with the parent’s informed consent; (b) do not build preference profiles for enrichment or campaign scoring; (c) do not sell or share their personal information or use it for targeted advertising; (d) do not include them in any Enterprise Client’s campaign audience; and (e) apply the Moments protections described below. Parents may review, correct, or delete their teen’s information, or withdraw consent and close the account, by contacting privacy@gesture.vip. Moments. For users under 18, we do not display Moments content using an algorithm that relies on their personal information or engagement history unless a parent has consented, and we do not send them notifications between midnight and 6:00 a.m. Eastern Time without parental consent, in each case as required by New York law. Recipients under 18. See Section 6.

We will post updates here and notify you of material changes through the Services or by email before they take effect, and we will update the Last Updated date. Where a change materially reduces your rights, we will obtain your consent where required by law. Questions or requests: Gesture US, Inc., 1412 Broadway, 21st Floor, New York, NY 10018, privacy@gesture.vip, 1-347-960-2110. If you have a disability and need this Privacy Policy in an alternative format, contact support@gesture.vip.

We send transactional messages (order status, delivery updates, G-Link and redemption reminders, security alerts, and legal notices) by email, text message, push notification, and in-app message to the contact information on your account or, for Recipients, the contact information the Sender provided. We send marketing text messages only to people who have separately opted in as described in Section 24 of the Terms. You can stop marketing texts by replying STOP, and you can stop transactional texts, including texts from Delivery Providers about a delivery, by replying STOP, by turning them off in your account settings, or by any other reasonable means; we honor such requests within ten business days. Message and data rates may apply. We share phone numbers and message content with our messaging platform provider and wireless carriers solely to deliver messages, and, with your authorization in the Terms, carriers may share account and device information with us to verify your identity and prevent fraud. We do not share text-messaging opt-in data or consent with third parties for their marketing purposes.

Like most websites and apps, ours use small technologies that store or read information on your device: cookies (small text files that a website places in your browser), pixels (tiny images or code snippets that tell us a page or email was opened), local storage (a browser feature that saves settings), and software development kits or “SDKs” (pre-built code inside our mobile apps that provides functions such as analytics and crash reporting). We use them to operate the Services, remember your preferences, keep you signed in, measure how the Services are used, and attribute app installs and campaign responses to the link, G-Link, QR code, or smart tag that brought you to us. We use the following categories: strictly necessary (required to operate the Services), functional (preferences), and analytics and measurement, each provided by companies that act as our service providers. We do not use third-party advertising or retargeting cookies, pixels, or SDKs on the Services. You can control cookies through your browser settings and through any cookie preferences tool we make available on our websites; disabling some cookies may affect functionality. We do not respond to “Do Not Track” signals, for which no industry standard exists; Section 8 explains how we treat Global Privacy Control signals. If you sign in with Google, Apple, Facebook, or LinkedIn, that provider shares with us the information described in Section 2, and your use of the provider is governed by its privacy policy; you can disconnect a third-party login in your account settings. Our analytics providers process usage information only on our behalf and under contracts that prohibit them from using it for their own purposes.