Privacy Policy

Privacy Policy

Circled LLC  ·  Last updated: October 10, 2026

Circled LLC, and its affiliates and subsidiaries (referred to as “Circled,” “we,” “us,” or “our”) respects and highly values your privacy, and we are committed to protecting it through our compliance with this Privacy Policy (this “Policy”).

Circled LLC is the data controller for the personal information described in this Policy. This Policy describes the types of personal data that Circled collects from and about you, explains how Circled collects, retains, uses, discloses, and protects your personal data when you use joincircled.com (the “Site”) and the Circled in Light community platform (together, "the Platform") and your choices and legal rights with respect to such information, and our practices for using, maintaining, protecting, and disclosing that information. This Policy governs the Platform, which is designed for women who are separated, divorced, widowed, single, facing an empty nest, or otherwise navigating life solo, including women who feel alone within a marriage.

This Policy may change from time to time and we will notify active members by email. Your continued use of the Platform after any revisions to this Policy means you accept those changes, so please check this Policy periodically for updates.

We collect, use, disclose, and otherwise process your personal data only in accordance with applicable data protection and privacy laws and this Policy. By using the Platform, you agree to the collection, use, and disclosure of your personal data as described in this Policy. If you do not agree, please do not access or use the Platform. Please review this Policy carefully, especially before providing any personal data through the Platform. The Platform may collect and use location-aware and cross-device data.

This Policy applies only to information we collect:

• Through the Platform.
• In communications, including email, text, chat, and other electronic messages, between you and the Platform.

It does not apply to information collected by:

• Us offline or through any other means, including on any other website operated by Circled or any third party (including our affiliates and subsidiaries) that does not link to this Policy; or
• Any third party (including our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or through the Platform. Third parties to which we may provide links may have their own privacy policies, which we encourage you to read before providing information to them.

We may provide additional or different privacy policies that are specific to certain features, services, or activities.

IF YOU DO NOT WISH TO HAVE US COLLECT, USE, AND SHARE INFORMATION AS DESCRIBED IN THIS PRIVACY POLICY, PLEASE DO NOT USE THE PLATFORM.

Notice of Terms of Use, Including Arbitration: Your use of the Platform is subject to our Terms of Service, which includes binding individual arbitration of any disputes which may arise in connection with such use. Please note that your use of the Platform constitutes your express agreement to our Terms of Service, including its arbitration provisions and class action waiver. Please read the Terms of Service - including the arbitration provisions - carefully, and do not use the Platform if you do not agree.

For purposes of this Policy, “personal data” refers to any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you as an individual as well as could reasonably be used to contact or locate you. Examples of personal data may include, without limitation, your name, your location, your email address, your mailing address, your payment information, and your phone number. We also collect, and may create from personal data, information about you that is not personal data (“Non-PII”). If we combine personal data collected via the Platform with other of your personal data or with Non-PII, that combined data will be treated as personal data subject to this Policy.

Please contact us with any questions regarding this Policy and our privacy practices as instructed in the Contact section of this Policy below.

NON-US RESIDENT PRIVACY NOTICE

If you are in the UK, EU, or other country outside of the United States, please see Appendix B - Non-US Resident Privacy Notice.

CHILDREN AND PERSONS UNDER THE AGE OF 18

The Platform is not intended for children and persons under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we learn we have collected or received personal information of anyone under 18, we will delete that information. If you believe we might have any information from or about anyone under 18, please contact us at Circled LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, Attn: Support Department, or privacy@joincircled.com.

1. Information you provide and what we collect

Depending on your use of the Platform and how we otherwise interact with you, we may collect or obtain information from and about you in several ways, including (A) directly from you; (B) automatically when you interact with the Platform; and (C) from third parties.

Personal data and non-PII may be collected on, through, or in connection with the Platform. Circled collects information from you when you choose to share it with us.

Types and categories of personal data that we may collect or process include:

• Account and contact information, including name, address (such as home address, work address, or other address), email address, phone number, username, and other contact information you provide us.
• Payment information, including credit card or debit card information and information about the payment methods and services (such as PayPal or Venmo) you use in connection with the Platform.
• Account history, including information about your membership, account, transactions, purchases, order history, or discounts.
• Demographic information, including your age, gender, income level, education, or family or marital status, if you have consented to such information collection.
• Location information, including general geographic location such as country, state or province, or city and precise geolocation, if you have enabled and consented to location information collection.
• Device information, including your IP address, device identifiers, operating system and version, preferred language, hardware identifiers, browser type and settings, and other device information.
• Content and information you elect to provide as part of your profile or in any posts you make through the Platform or emails, chats, or other communications sent to us.
• Images, voice recordings, and videos collected or stored in connection with the Platform, if you have consented to such information collection.
• Identity document information, such as driver’s license numbers, if you have consented to such information collection.

When you use a joining form on our website, we ask for your email address and your first name, your confirmation that you are 18 or older, that you agree to our Terms of Service and Circle Code and that you have read this Policy, and whether you would like to receive our optional email updates. Our email provider also records when you signed up and the IP address used.

When you create your account on our community platform, you provide your first and last name, your email address, and a password, which the platform stores on its own systems.

When you request membership, you answer a small number of required application questions. They include a short answer in your own words, written confirmations about your age and about our Terms of Service, Circle Code, and this Privacy Policy, and a separate Yes or No question about sensitive information, described in section 4A.

Other information collected may include when and how you access the Platform, interact with other users on the Platform, and make payments through or related to the Platform.

Apart from these, anything else you share (a photo, a bio and other profile details, your posts, comments, reactions, and private messages inside the community) or otherwise provide information for publication or display (“Posted”) in areas of the Platform you access (collectively, “User Contributions”) is optional and shared at your discretion. Your User Contributions are Posted and transmitted to others at your own risk. Although you may set certain privacy settings for such information under your account profile, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of third parties with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

If you write to us, we receive your message and your email address. If you joined our earlier paid beta, our payment processor holds the billing information described in section 4.

We and our service providers also receive basic technical information, such as your IP address, browser and device type, and approximate region, and information collected through the cookies and similar technologies described in section 6, as needed to operate the Platform securely.

You may choose to provide us access to information directly from your device (which may be a computer, tablet, smartphone or other device you use to access the Platform). This may include your location information, and/or your physical movements.

We may also receive and supplement the information we directly collect from or about you with information from third parties, and to the extent it is combined with personal data collected via the Platform, it will be governed by this Policy. If you are on a third party website or service and you opt-in to receive information from us, the third party may forward to us your email address and other information about you so that we may contact you as requested.

If you are a California resident, to access our supplemental California privacy statement, please see Appendix A , CCPA Privacy Policy, which supplements this Policy as applicable.

Some of the information identified above, including identification document information and precise geolocation information may be considered sensitive data under certain laws. If required under applicable law, we will collect and process sensitive personal data only with your consent. If you choose not to provide or allow us to collect some information, we may not be able to provide you with requested features, services, or information.

We may also collect:

• Statistics or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal data. For example, we may aggregate personal data to calculate the percentage of users accessing a specific Platform feature.
• Technical information. Technical information includes information about your internet connection and usage details about your interactions with the Platform, such as clickstream information to, through, and from our Platform (including date and time), products that you view or search for; page response times, download errors, length of your visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from a page.

If we combine or connect non-personal statistical or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as personal information.

We collect information about you when you interact with the Platform. Information is also collected related to when you place an order, subscribe, or make a purchase, financial contribution or request, participate in surveys, or create, upload, or post content to the Platform, including reviews, media such as photos, videos, or audio recordings.

2. What we use it for and who we disclose your information to

Information collected is used to review and decide your request for membership; to create, update, and manage your membership and give you access to the community once your membership is complete; to provide you with the Platform and any contents, features, information, or services that we make available through the Platform; to send you our welcome emails and essential emails about your membership, your account, or the community; to provide notices about your membership; if you have chosen to receive them, to send you occasional news, event invitations, and information about other Circled in Light offerings; to operate the community platform, chapters, and events; to reply to messages and to handle privacy requests; to improve the Platform; to keep the Platform safe and enforce the Circle Code; to fulfill any other purpose for which you provide it; to carry out our obligations and enforce our rights arising from any agreements entered into between you and Circled; notify you when Platform updates are available and about changes thereto; in any other way we may describe when you provide the information; and to comply with legal obligations.

Section 6 explains the analytics and advertising-related technologies that our community platform provider may use: some are used whatever cookie choice you make there, and others may be switched on if you choose "Accept All".

Your application answers are stored on our community platform and are reviewed by the people Circled authorizes to manage membership requests.

Our email provider records, for each person and each email we send, whether it was delivered, opened and clicked. We use this to see whether our emails are working.

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may also disclose personal data that we collect or you provide as described in this Policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to support our organization and who are bound by contractual obligations to keep personal data confidential and use it only for the purposes for which we disclose it to them.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Circled's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by Circled is among the assets transferred.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal data:

To comply with any court order, law, or legal process, including to respond to any government or regulatory request.

To enforce or apply our Terms of Service and other agreements, including for billing and collection purposes.

If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our organization, our members, or others.

The categories of personal data we may disclose include:

Account and contact information.

Payment information.

Account history, including information about your subscription, account, transactions, purchases, order history, or discounts.

Demographic information.

Location information.

Device information.

Content and information you elect to provide to us.

Images, voice recordings, and videos collected or stored in connection with the Platform, if you have consented to such information collection.

Identity document information.

3. Legal bases (for members in the EU/EEA and UK)

We rely on different bases for different things.

• Running your membership. Hosting your account and your contributions, providing the community you joined, and moderating it, is the performance of our membership agreement with you. Membership is complimentary, and that does not change this: accepting the Terms of Service creates an agreement between us whether or not money changes hands.
• Before you become a member. Handling our website joining forms and the contact record they create, reviewing your application answers, and deciding your request to join: our legitimate interest in considering requests to join and welcoming the women who make them.
• Welcome and onboarding emails that are purely functional, because they explain how to join and how to use the community: for members, the performance of our membership agreement; for people who have used a joining form but are not yet members, our legitimate interest in explaining how joining works.
• Optional emails about news, events, invitations and other offerings. We send these only if you have chosen to receive them, on the basis of your consent, which you may withdraw at any time using the unsubscribe link in any email or by writing to us.
• The community platform's artificial intelligence features. Our legitimate interest in operating the platform's features. Those features are currently switched off, as described in section 5.
• Keeping the Platform secure, keeping backups, and responding to incidents. Our legitimate interest, and, where a specific legal obligation applies such as breach notification, that obligation.
• The legacy payment records described in section 4. The performance of the agreement those records were created under, and the legal obligations that apply to billing, tax and accounting records.
• Correspondence, privacy requests, and our own internal working, legal and governance records, kept at a proportionate level of detail, including the administrative tools described in section 4: our legitimate interest in running Circled soundly, and our legal obligations where they apply.
• Sensitive information you choose to share in your profile, your written application answer, or your posts. Your explicit consent, given through the separate question described in section 4A.

Where we rely on your consent, you may withdraw it at any time, and withdrawing it does not affect anything we did before you withdrew it.

See Appendix B for further information on our policy.

4. Who else is involved in running Circled in Light

Different services do different things for us. Mighty Networks provides the community platform, where your account, your application answers, your profile, your private messages and everything you post are held. Mailchimp provides our email: it holds the contact record created when you use a joining form on this website, and it sends our welcome emails and any email updates. Netlify hosts this website. Google Workspace provides our own email and the one-time form described in section 4A, so any message you send us, and any answers given in that form, are held there. GitHub holds a private copy of our own working records. We also keep backup copies of our own records with a cloud storage provider. Each of these services handles your information for us under its own security and privacy commitments.

Mighty Networks also handles some information for its own purposes, including information about your Mighty Networks account, as described in its own privacy policy at mightynetworks.com/privacy-policy.

We also use general-purpose artificial intelligence assistants, currently provided by Anthropic and OpenAI, to help with our own administrative, drafting and organizational work. Information about members and applicants may be included in that work. Those providers handle that information under their own terms.

Your profile and your posts can be seen by other signed-in members, and your private messages by the members taking part in them. We may also disclose information where the law requires it, or where it is necessary to protect the safety of a member or another person.

Payments. Membership is complimentary, and joining through our current joining route sends nothing to a payment provider. Where a payment is made to Circled, we or our third party payment processors may collect payment card number and related financial information (such as CVV, expiration date, and billing address) or information about other payment methods. Circled does not collect or retain your full payment card information, and where a payment is made to Circled, it is processed by Stripe. Stripe also holds subscription records created in 2026 for members who joined our earlier paid beta. Stripe keeps its own records of those payments as an independent controller under its own legal obligations. Circled never stores your card details.

Where your information goes.

We use a small number of service providers to help us operate the Platform. Mailchimp (through Intuit), Netlify, GitHub, Stripe, and Google are each certified under the Data Privacy Framework between the European Union and the United States, which the European Commission recognizes as providing an adequate level of protection for personal data transferred to certified US organizations; their agreements with us also include the Standard Contractual Clauses as a further safeguard. Our transfers to Mighty Networks rely instead on the Standard Contractual Clauses approved by the European Commission and, for transfers from the UK, the UK Addendum. You may request further information about these safeguards by writing to privacy@joincircled.com.

See Appendix B for further information on our policy.

4A. Sensitive information you choose to share

Nothing we ask requires you to share information that data protection law treats as sensitive, such as information about your health, including your mental health, your religious or philosophical beliefs, or similar information. Some women choose to share information like this in an application answer, in their profile, or in posts, comments or messages in the community. If you do, it is held on our community platform with the rest of that content. Your profile and posts can be seen by other signed-in members, your private messages by the members taking part in them, and your application answers by the people Circled authorizes to manage membership requests.

When you request membership, our application asks a separate question about sensitive information, which you answer Yes or No. Answering No does not affect your request to join. Answering Yes gives your explicit consent for information of this kind that you choose to share in your profile, your written application answer, or your posts to be processed as described in this Policy. Acknowledging this Policy is not that consent. Women who were already members, or whose requests to join were already waiting, when this question was introduced can provide this consent separately through a one-time form that also asks them to agree to the updated Terms of Service. Their answer to the sensitive-information question does not affect their membership or their request to join. You can withdraw your consent at any time by writing to privacy@joincircled.com. Withdrawing does not affect anything we did before you withdrew, and it does not by itself end your membership. Our community platform does not give us a way to prevent information of this kind from being shared, so if you have answered No or withdrawn your consent, please do not share it.

5. AI features

Our community platform provider, Mighty Networks, offers optional AI-powered features that may process the text you add to your profile (such as your bio or "About Me" section) using OpenAI and Anthropic as its sub-processors, for the purpose of legitimate interest.

These features are currently turned off for Circled in Light, so no profile text is being sent to OpenAI or Anthropic through them. If we turn any of them on, we will update this Policy before we do.

6. Cookies and similar technologies

As you navigate through and interact with the Platform, we may use automatic data collection technologies to collect information that may include personal data. Information collected automatically may include usage details, IP addresses, operating system, and browser type, and information collected through cookies, web beacons, and other tracking technologies including details of your interactions with the Platform, such as traffic data, location data, logs, and other communication data, and which resources and the Platform features that you access and use.

The technologies we use for this automatic data collection may include:

• Cookies. A cookie is a small file placed on your device when you interact with the Platform. You may refuse to accept or disable cookies by activating the appropriate setting on your browser or device. However, if you select this setting, you may be unable to access certain features of the Platform.
• Web Beacons. Some parts of the Platform and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Circled, for example, to count users who have visited those parts or opened an email and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity).

To the extent any of these automated technologies are considered a personal data sale, targeted advertising, or profiling, under applicable laws, depending on where you live, you may opt out from use of these automated technologies for such uses by emailing privacy@joincircled.com. Please note that some Platform features may be unavailable as a result.

When you interact with the Platform, there are third parties that may use automatic collection technologies to collect information about your or your device. These third parties may use tracking technologies to collect information about you when you use the Platform. The information they collect may be associated with your personal data or they may collect information, including personal data, about your online activities over time and across different websites, apps, platforms, and other online services. We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

Our website. joincircled.com does not set cookies of its own and does not load analytics or advertising tools. When you close the cookie notice on our website, your browser stores a small record so that the notice is not shown to you again.

Our joining forms. When you submit a joining form, your details are sent to our email provider, Mailchimp, which may set its own cookies on its own domain.

Our community. The community at community.joincircled.com runs on Mighty Networks, which provides and manages the cookies and similar technologies used there, and its own cookie notice. Some of these technologies are used whatever choice you make, including technologies for security and protection against automated traffic, website performance analytics provided by Cloudflare, Mighty Networks' own analytics, feature testing, the platform's support chat tool when you are signed in, and a security check when you create an account. If you choose "Accept All" in the community's cookie notice, further technologies may be switched on, including Google Analytics and Google Tag Manager, error monitoring, and advertising-related technologies. In our testing, choosing "Reject All" switched those additional technologies off. The Mighty Networks mobile app may use its own technologies, which are described in Mighty Networks' own privacy policy. Our Cookie Policy at joincircled.com/cookie-policy.html lists these technologies.

7. How long we keep it

Different information sits in different places, and some of it is kept on schedules we do not control. We keep information for as long as it is needed for the purposes described in this Policy, and where it is necessary or permitted for legal, tax and accounting obligations, security, fraud prevention, resolving disputes, or enforcing our Terms. This is what that means in practice.

Your membership and your community account. Ending your membership ends your access to the community. It does not by itself delete your account on our community platform, the content you have contributed, or your email contact record.

Your posts, comments and private messages. Unless they are deleted, your posts and comments remain visible to members, with your name attached, for as long as your account exists. If you leave the community, or we remove you from it, your posts, comments and reactions may remain visible to members under your name, and your private messages may remain visible to the members you exchanged them with. Mighty Networks states that members can permanently delete their own account from a web browser, and that doing so removes their activity and posts from the community; that removal happens on Mighty Networks' own schedule. Our community platform does not allow a name to be removed from a post while the post itself remains.

Your application answers. Your application answers are kept by our community platform with your request to join, including if your request is declined. We have not been able to confirm a way to permanently delete a declined applicant's answers. We have asked our provider about this, and we cannot currently promise a date by which they will be removed.

Your email contact record. If you unsubscribe, we keep your address on our email suppression list indefinitely, because that record is what stops us emailing you again. For other marketing information about someone who never became a member, or who left long ago, our criterion is to delete it after 24 months without activity, unless we have another legal or operational reason to keep it.

Payment records. Stripe may keep its payment records, including the earlier paid beta subscriptions, for as long as the law requires it to. We keep our own payment records for as long as we need them to meet our legal, tax and accounting obligations.

Website visitor data. Our hosting provider makes website request data available to us for about one day, and we keep no copy of it.

Privacy requests. We keep our record of a privacy request for three years after the request is closed.

Our own records and correspondence. We keep our own email, working, legal and governance records for as long as we need them to run the business and to meet our obligations, at a proportionate level of detail.

Backups. Copies of information may remain in backup copies held by us and by our service providers.

8. Your rights

Depending on where you live, you may have rights over your personal information as further described below. These may include the right to ask for access to the personal information we hold about you and for a copy of it; to ask us to correct information that is inaccurate or incomplete; to ask us to delete it; to receive a copy of certain information you have provided to us for your own use elsewhere; to object to, or ask us to restrict, certain processing; and, where we rely on your consent, to withdraw that consent at any time. These rights are not absolute. They may be subject to exceptions and limitations under applicable law, for example where we must keep information to comply with a legal obligation or to establish, exercise or defend legal claims, or where acting on a request would affect the rights of other people.

Cookies and Other Tracking Technologies. You can set your browser to refuse all or some browser cookies or other tracking technology files, or to alert you when these files are being sent. You can choose whether or not to allow the Platform to collect information through other tracking technologies by emailing privacy@joincircled.com. If you disable or refuse cookies or similar tracking files, some Platform features may be inaccessible or not function properly. Some browsers include a "Do Not Track" (DNT) setting that can send a signal to the online services you visit indicating you do not wish to be tracked. Because there is not a common understanding of how to interpret the DNT signal, the Platform may not respond to all browser DNT signals. Instead, you can use the range of other tools to control data collection and use, including cookie controls and advertising controls.

Marketing and Promotional Communications: You can opt out of receiving marketing and promotional communications from us at any time by using the contact information below or following the instructions included in any marketing or promotional communications that you receive from us. Note that even if you opt out of receiving marketing and promotional communications from us, you will still receive non-marketing or transactional messages from us, including messages about your account and responses to your inquiries/requests.

Location-Based Services: If you use the Platform, you may control our collection and use of location-based information by adjusting the settings on your device. If you disable or refuse location-based information and tracking, some parts of the Platform may then be inaccessible or not function properly.

Your Legal Rights

Depending on where you reside or were located when we collected your personal data, you may have certain rights in relation to your personal data, as described below. For more information about jurisdictions where these options are available, please review Appendix A and Appendix B to this Privacy Policy.

• Right of Access:
• You may ask us to confirm whether we are processing your personal data and, if so, details regarding our processing of the personal data.
• You may also request that we provide your personal data, in a portable and, to the extent technically feasible, readily usable format.
• You may request information about our disclosure of your personal data to third parties, including a list of any third parties to whom we disclosed your personal data for direct marketing purposes
• Right to Delete: Subject to certain exceptions, you may request that we delete your personal data. There are some reasons we will not be able to fully address your request, such as if we need to complete a transaction for you, to detect and protect against fraudulent and illegal activity, to exercise our rights, or to comply with a legal obligation.
• Right to Correct: Subject to certain exceptions, you may request that we correct inaccuracies in your personal data. We will take commercially reasonable efforts to make the corrections that you request.
• Right to Opt Out of Certain Types of Information Uses and Disclosures: As described in this Policy, we may use and disclose to third parties personal data. If you are interested in exercising your right to opt out of the disclosure of your personal data, you may submit a request at any time by contacting privacy@joincircled.com.
• Right to Revoke Consent: We may seek your affirmative consent to process your personal data for certain purposes. Where applicable, you may revoke your consent at any time.
• Right to Limit Certain Processing Activities or to Object to Certain Processing Activities: Where we have not sought your affirmative consent to process your personal data, you may have the right to limit or object to our continued processing of that personal data.

If you exercise any of the foregoing rights, we will not discriminate against you.

How to make a request. Email privacy@joincircled.com. We may need to confirm that the request comes from you, usually by asking you to write from the email address we already hold for you. Where applicable, we will use the requested information for verification purposes only. We may decline certain requests if we cannot verify your identity and confirm the personal data we maintain relates to you. When we receive your request, we will provide additional information about the timing of our response, any additional information we may need from you, and if we are unable to fully comply with your request. You may authorize someone to submit a privacy rights request on your behalf. If someone makes a request on your behalf, we may ask for evidence that they are authorized to do so using the submission methods outlined above. An authorized agent will need to demonstrate that you have authorized them to act on your behalf. Depending on the evidence provided, we may also contact you to verify your identity directly with us or request confirmation from you that the agent is authorized to make the request. We will endeavor to respond to your requests within one month of your request, or within three months for complex requests, or such timeframe established by the applicable law. If we need additional time to respond to your request, we will inform you within the first month and of the reasons why. If we decide not to take action on your request, we will explain the reasons why. We may place reasonable limits on responding to repeated requests, where allowable by law. If we decide not to take action in response to your request, you may submit an appeal by email at privacy@joincircled.com. If you send an appeal via email, you must put the statement “Privacy Rights Appeal” in the subject field and provide enough information for us to understand the request you made and the rationale for the appeal. We will resolve your appeal within the timeframes established by applicable law. If your appeal is denied, we will explain why. If you continue to dispute our decision or would like to lodge a complaint regarding our handling of your personal data, you may contact the regulator in your jurisdiction that handles privacy complaints.

Email updates. You can stop our email updates at any time using the unsubscribe link in any email we send, or by writing to us. Unsubscribing does not end your membership, and ending your membership does not unsubscribe you, because our email service and our community platform are separate systems. Emails that our community platform sends about your account or about community activity are not controlled by our unsubscribe link.

Information held by our service providers. Some of your information is held in systems operated by the service providers described in section 4. Those providers determine certain technical aspects of how information can be retrieved, corrected, deleted or retained in their systems, including how their backups are handled and which records they are required to keep. We remain responsible for what applicable law requires of us, and we will take the steps that are available to us and required of us. We cannot, however, guarantee the deletion or retrieval of information held in systems or records that are outside our technical control, and where that affects your request we will tell you. In particular:

• ending your membership does not by itself delete your posts, comments or private messages;
• we cannot delete your community platform account for you, although Mighty Networks states that you can delete it yourself, as described in section 7;
• we can permanently delete your contact record from our email service, but that cannot be undone, so we will explain what it means before we act;
• payment records held by Stripe may be kept by Stripe as the law requires; and
• copies held in our providers' backups are handled according to those providers' own practices.

We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative (“NAI”) on the NAI’s website.

If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

9. US state privacy rights (including California)

If you live in California or another US state with a consumer privacy law, you may have rights similar to those described above: to know what personal information we collect and how we use it; to access it; to correct it; to delete it; and to opt out of the sale or sharing of your personal information. These rights are subject to the exceptions in your state's law.

Depending on your state of residency, you may have certain rights related to your personal data, including:

• Access and Data Portability. You may confirm whether we process your personal data and access a copy of the personal data we process. To the extent feasible and required by state law, depending on your state, data will be provided in a portable format. Depending on your state, you may have the right to receive additional information and it will be included in the response to your access request.
• Correction. You may request that we correct inaccuracies in your personal data that we maintain, taking into account the information's nature and processing purpose.
• Deletion. You may request that we delete personal data about you that we maintain, subject to certain exceptions under applicable law.
• Opt Out of Using Personal Data for Sales, Targeted Advertising, and Profiling for Certain Legal or Similarly Significant Decisions. You may request that we do not use your personal data for these purposes. Some states may also grant you the ability to learn more about or challenge those automated decisions.

Important: The exact scope of these rights vary by state. There are also several exceptions where we may not have an obligation to fulfill your request.

Our community platform provider's cookie notice, described in section 6, controls whether its additional analytics and advertising-related technologies run while you use the community, and you can choose "Reject All" in that notice. Some technologies, including some analytics, are used whatever choice you make, as section 6 explains. You can also make any request under your state's law by emailing privacy@joincircled.com. To appeal a decision regarding a consumer rights request email privacy@joincircled.com. We will never treat you differently for exercising any privacy right. We will respond within the timeframe required by your state's law. If you live in Washington, or your health information was collected in Washington, our Washington Consumer Health Data Privacy Policy at joincircled.com/washington-health-data-privacy explains your rights under the Washington My Health My Data Act, including how to appeal a decision, and what we will do about deletion, including backups and notifying our service providers.

If you live in California, please see Appendix A , CCPA Privacy Policy for more information.

10. Confidentiality inside the community

Circled in Light is a private community. Its rooms and member profiles can be seen only by signed-in members, and it is not open to the public or listed by search engines. Private chats are visible to the members taking part in them, and your application answers are not shown to other members. Our community platform provider and the service providers described in section 4 process community content in order to run the Platform, and the people Circled authorizes to administer the community can access information where needed to operate it, moderate it and keep it safe. Some notifications about community activity, such as emails, may include parts of what members have posted.

Every member agrees to the Terms of Service and the Circle Code, which make confidentiality a condition of membership. Please remember, however, that no community platform can absolutely guarantee the conduct of every individual; share at the level you are comfortable with.

11. Security

We take reasonable and appropriate physical, administrative, and technical steps to safeguard the information we collect from and about our users. Please be advised, however, that the internet and other technologies and communication channels are, by their nature, not entirely secure, and your personal data and non-PII may therefore be subject to interception or loss which is beyond our reasonable control. No security system is perfect, and we cannot guarantee or warrant the absolute security of any personal data or non-PII you transmit to us or that we otherwise collect. Any transmission of information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures we provide. You are responsible for keeping your login in credentials confidential. We ask that you do not share your login credentials with anyone. Accordingly, as permitted by applicable law, we assume no responsibility or liability for disclosure of your personal data or non-PII due to errors in transmission, unauthorized third-party access, or other causes beyond our reasonable control.

We use reputable providers, encryption in transit, and access controls appropriate to a community of our size. No system is perfectly secure; if we ever become aware of a breach affecting your personal data, we will notify you as required by law.

12. Changes

We reserve the right, in our sole and absolute discretion, to change, modify, add, remove, or otherwise revise portions of this Policy at any time. The “Last updated” date at the top of this page indicates when this Policy was last revised. When we make changes, we will revise the date at the top of this page to reflect the date such changes occurred. If we make material changes to this Policy, we will notify active members by email before such changes take effect. Unless otherwise stated, your continued use of the Platform following the posting of a revised version of this Policy constitutes your acceptance of the changes, including our future use of personal data or other information previously or thereafter collected in accordance with the updated Policy. If you do not accept the changes, please immediately discontinue your use of the Platform and close your account with us.

13. Governing Law

If you are not a resident of the United States, please be aware that data protection laws in the United States (as well as the legal procedures for courts, governmental authorities, and parties in civil litigation to obtain access to our user data) may differ substantially from the laws and procedures in your country of residence. In addition, if you submit your personal data to us, you are consenting to the processing, storage, use and transfer of that personal data within the United States.

The interpretation and application of this Policy shall be governed by the laws of the United States and the State of Delaware without regard to its conflict of law provisions. Except as otherwise expressly provided in our Terms of Service, your use of the Platform is not intended to subject us to the laws or jurisdiction of any state, country or territory other than that of the United States and the State of Delaware.

14. Updating Your Information, Choice and Opt-Out

You are responsible for maintaining the accuracy of any information you submit to us, such as your contact information. If you have any questions about updating your information, privacy choices and/or opting out of certain programs, services, and data activities, please visit section 15 (Contact) below for more information and instructions to contact us. You may opt out of receiving marketing emails by: (i) following the opt-out instructions provided to you in those emails; (ii) visiting your account settings or similar features on the Platform; or (iii) contacting us as provided in section 15 below. Please note that as long as you remain registered with or a user of the Platform, even if you opt out of marketing emails, you may still receive administrative and transactional emails, such as notices about service and status updates and changes to our Terms of Service or Privacy Policy. If you sign up to receive text (SMS) messages from the Platform, you may unsubscribe from any text SMS messages received by replying “STOP”. You may remove or disable cookies and/or opt out of interest-based advertising as described above and you may clear your browser history in accordance with the system settings of your web browser. You may also opt out of providing your geo-location information to us by turning off the location services for your device located in your account settings (if available) or in your device settings. If you do not want the Platform to collect any personal data or non-PII about you, you should email us at privacy@joincircled.com

15. Contact

If you have any feedback, questions or comments about the Policy, please contact our Privacy Team at Circled LLC, privacy@joincircled.com, or direct your communication to us by mail to: 30 N Gould St Ste N, Sheridan WY 82801, USA

Our representative in the European Union. Under Article 27 of the General Data Protection Regulation, Circled LLC has appointed a representative in the European Union. If you are in the European Union, you may contact our representative, in addition to or instead of contacting us, on matters relating to the processing of your personal information: Bufete Montesinos, SLP, Calle Muntaner, 231, 4-2B, Barcelona 08021, Spain, montesinos@montesinos.biz.

Our representative in the United Kingdom. Under Article 27 of the UK General Data Protection Regulation, Circled LLC has appointed a representative in the United Kingdom. If you are in the United Kingdom, you may contact our representative, in addition to or instead of contacting us, on matters relating to the processing of your personal information: Cecilia Pereira-Yates, 47 Bounty Drive, Kingswood, Hull, HU7 3FN, United Kingdom, cpy8870@yahoo.co.uk.

Appendix A

CCPA PRIVACY POLICY

Effective Date: October 10, 2026

This CCPA Privacy Policy describes how Circled and its subsidiaries, affiliates, and related entities (collectively, "Circled," "Company," "we," or "us") collect and process personal information about our consumers who reside in California. The California Consumer Privacy Act ("CCPA") requires us to provide our California consumers with a privacy policy that contains a comprehensive description of our online and offline practices regarding our collection, use, sale, sharing, and retention of their personal information, along with a description of the rights they have regarding their personal information. This CCPA Privacy Policy provides the information the CCPA requires, together with other useful information regarding our collection and use of personal information. Any terms defined in the CCPA have the same meaning when used in this policy.

This CCPA Privacy Policy does not apply to our collection and use of personal information in an employment capacity. This CCPA Privacy Policy does not apply to our collection and use of personal information from residents outside of California. Consumers residing in other locations should see our general Privacy Policy.

Personal Information Collected

We collect and use information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household ("personal information"). Personal information does not include:

• Publicly available information, including from government records, through widely distributed media, or that the consumer made publicly available without restricting it to a specific audience.
• Lawfully obtained, truthful information that is a matter of public concern.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA's scope, like:
• health or medical information covered by the Health Insurance Portability and Accountability Act (HIPAA) and the California Confidentiality of Medical Information Act (CMIA), clinical trial data, or other qualifying research data; or
• personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act.

Personal Information Categories Chart

The chart below identifies the categories of personal information we may collect.

Sensitive Personal Information Categories Chart

Sensitive personal information is a subtype of personal information consisting of the specific information categories listed in the chart below. Importantly, the CCPA only treats this information as sensitive personal information when we collect or use it to infer characteristics about a consumer.

The chart below identifies which sensitive personal information categories, if any, we may collect from our members.

Sources of Personal Information

We may obtain the categories of personal information listed above from the following categories of sources:

Directly from you, such as from the forms or other information you provide to Circled.

Indirectly from you, such as from your interactions with Circled’s websites, mobile applications, and social media platforms.

From our service providers, such as order fulfillment and shipping providers, customer service support providers, data analytics providers, data brokers, advertising networks.

Inferences generated by Circled’s or our service providers' computer systems.

How We Use Personal Information

Personal Information Collection, Use, and Disclosure Purposes

We may use and disclose the personal information, including sensitive personal information, we collect to advance Circled’s business and commercial purposes, specifically to:

Develop, offer, and provide you with the Platform.

Meet our obligations and enforce our rights arising from any contracts with you, including for billing or collections, or to comply with legal requirements.

Fulfil the purposes for which you provided your personal information or that were described to you at collection, and as the CCPA otherwise permits.

Improve the Platform and related products or services, marketing, or customer relationships and experiences.

Notify you about changes to the Platform and related products or services.

Administer our systems and conduct internal operations, including for troubleshooting, data analysis, testing, research, statistical, and survey purposes.

Protect Circled, personnel, or operations.

Manage your consumer relationship with us, including for:

online account creation, maintenance, and security; and

reaching you, when needed, about your account.

Perform data analytics and benchmarking.

Administer and maintain Circled’s systems and operations, including for safety purposes.

Comply with all applicable laws and regulations.

Exercise or defend the legal rights of Circled and its personnel.

Respond to law enforcement requests and as required by applicable law or court order.

Sensitive Personal Information Use and Disclosure Purposes

We may use or disclose sensitive personal information for the following statutorily approved reasons (Permitted SPI Purposes):

Performing actions that are necessary for our consumer relationship and that an average consumer in a relationship with us would reasonably expect.

Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information.

Defending against and prosecuting those responsible for malicious, deceptive, fraudulent, or illegal actions directed at Circled.

Ensuring physical safety.

Short-term, transient use, such as non-personalized advertising shown as part of your current interactions with us, where we do not:

disclose the sensitive personal information to another third party; or

use it to build a profile about you or otherwise alter your experience outside your current interaction with Circled.

Services performed for Circled, including maintaining or servicing accounts, processing or fulfilling transactions, verifying consumer information, processing payments, or providing financing, analytic services, storage, or similar services for Circled.

Activities required to:

verify or maintain the quality or safety of a product, service, or device that we own, manufacture, had manufactured, or control; or

improve, upgrade, or enhance the service or device that we own, manufacture, had manufactured, or controlled.

Collecting or processing sensitive personal information that we do not use for the purpose of inferring characteristics about a consumer.

We do not use or disclose sensitive personal information for purposes other than the Permitted SPI Purposes. For more on your right to limit these additional sensitive personal information use purposes, see Your Rights and Choices.

Additional Categories or Other Purposes

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. If required by law, we will also seek your consent before using your personal information for a new or unrelated purpose.

We may collect, process, and disclose aggregated or deidentified consumer information for any purpose, without restriction. When we collect, process, or disclose aggregated or deidentified consumer information, we will maintain and use it in deidentified form and will not to attempt to reidentify the information, except to determine whether our deidentification processes satisfies any applicable legal requirements.

Disclosing, Selling, or Sharing Personal Information

Business Purpose Disclosures

We disclose personal information to the service providers identified in this Policy (our community platform, email, website hosting, payment processing, and backup providers, and the AI tools described above) as necessary to operate, secure, and support the Platform. These are functional disclosures required to provide the Platform to you; they are not sales of personal information, and we do not disclose personal information for any independent commercial or marketing purpose of a third party.

Selling or Sharing Personal Information

We do not sell your personal information, including sensitive personal information, to third parties. We do not share your personal information with third parties for cross-context behavioral advertising purposes .

Your Rights and Choices

If you are a California resident, the CCPA grants you the following rights regarding your personal information:

Right to Know and Data Portability Requests

You have the right to request that we disclose certain information to you about our collection and use of your personal information (the "right to know"), including the specific pieces of personal information we have collected about you (a "data portability request"). You may exercise your right to know twice in any 12-month period. Once we receive your request and confirm your identity (see How to Exercise Your Rights), we will disclose to you:

• The categories of:
• personal information we collected about you; and
• sources from which we collected your personal information.
• The business or commercial purpose for collecting your personal information and, if applicable, selling or sharing your personal information.
• If applicable, the categories of persons, including third parties, to whom we disclosed your personal information, including separate disclosures identifying the categories of your personal information that we:
• disclosed for a business purpose to each category of persons; and
• sold or shared to each category of third parties.
• When your right to know submission includes a data portability request, a copy of your personal information, subject to any permitted redactions.

Right to Limit Sensitive Personal Information Use and Disclosure to Permitted SPI Purposes

You have a right to ask businesses that use or disclose your sensitive personal information to limit those actions to just the CCPA's Permitted SPI Purposes (the "right to limit"). As we do not use or disclose sensitive personal information beyond the CCPA's Permitted SPI Purposes, we do not currently provide this consumer right.

Personal Information Sales or Sharing Opt-Out and Opt-In Rights

You have the right to request that businesses stop selling or sharing your personal information at any time (the "right to opt-out"), including through a user-enabled opt-out preference signal. Similarly, the CCPA prohibits businesses from selling or sharing the personal information of consumers it actually knows are under 16 years old without first obtaining consent from consumers who are between 13 and 15 years old or the consumer's parent or guardian for consumers under age 13 (the "right to opt-in").

As we do not sell or share consumers' personal data, we do not currently provide these consumer rights.

Right to Non-Discrimination

You have the right not to be discriminated or retaliated against for exercising any of your privacy rights under the CCPA.

How to Exercise Your Rights

Exercising the Rights to Know, Delete, or Correct

To exercise the right to know (including data portability), delete, or correct described above, please submit a verifiable request to us by either:

Mail at Circled LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, Attn: Privacy Department.

Email at privacy@joincircled.com.

Please describe your request with sufficient detail so we can properly understand, evaluate, and respond to it. You or your authorized agent may only submit a request to know, including for data portability, twice in a 12-month period.

Exercising the Right to Limit or Opt-Out

You can submit your request to limit or opt-out through:

Mail at Circled LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, Attn: Privacy Department.

Email at privacy@joincircled.com.

You can also submit your request to opt-out of personal information sales and sharing through an opt-out preference signal.

Verification Process and Authorized Agents

Only you, or someone legally authorized to act on your behalf, may make a request to know, delete, or correct related to your personal information. We may request specific information from you or your authorized representative to confirm your or their identity before we can process your right to know, delete, or correct your personal information.

We cannot respond to your request to know, delete, or correct if we cannot verify your identity or authority to make the request and confirm the personal information relating to you. We will only use personal information provided in the request to verify the requestor's identity or authority to make the request.

We consider requests made through your password-protected account with our company sufficiently verified when the request relates to personal information associated with that specific account. You do not need to create an account with us to submit a request to know, correct, or delete.

For requests to limit or opt-out, we ask for the information necessary to complete the request, which may include, for example, the consumer's name, email address, or account username.

Responding to Your Requests to Know, Delete, or Correct

We will confirm receipt of your request within ten business days. If you do not receive confirmation within the ten-day timeframe, please contact privacy@joincircled.com.

We endeavor to substantively respond to a verifiable request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We will deliver our written response to your verified email address. Our substantive response will tell you whether or not we have complied with your request. If we cannot comply with your request in whole or in part, we will explain the reason, subject to any legal or regulatory restrictions. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, deleted, or made your personal information anonymous in compliance with our record retention policies and obligations.

Any disclosures we provide will cover information for the 12-month period preceding the request's receipt date.

For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Response and Timing on Rights to Limit or Opt-Out

In response to your request to limit or opt-out, we will process your request, as soon as feasibly possible, but no later than 15 business days from the date we receive the request. You do not need to create an account with us to exercise your limitation and opt-out rights. We will only use personal information provided from your request to comply with the request.

Once you make a request to limit or opt-out, we will wait at least 12 months before asking you to reauthorize the use or disclosure of your sensitive personal information for purposes other than the Permitted SPI Purposes.

How We Protect Your Personal Data

We use commercially reasonable administrative, physical, and technical measures designed to protect your personal data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your personal data transmitted to, through, using, or in connection with the Platform. In particular, email, texts, and chats sent to or from the Platform may not be secure, and you should carefully decide what information you send to us through these communications channels. Any transmission of personal data is at your own risk.

The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal data against unauthorized use, disclosure, and access.

Privacy Policy Changes

We reserve the right to update this CCPA Privacy Policy at any time. If we make any material changes to this CCPA Privacy Policy, we will update the policy's effective date and post the updated policy on joincircled.com. We encourage you to check joincircled.com to review the current CCPA Privacy Policy in effect.

Contact Information

If you have any questions or comments about this policy, the ways in which we collect and use your information described here, or your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Circled LLC

30 N Gould St Ste N, Sheridan WY 82801, USA

Email: privacy@joincircled.com

If you need to access this CCPA Privacy Policy in an alternative format due to a disability, please contact us at the above.

Appendix B

NON-U.S. RESIDENT PRIVACY NOTICE

Role and Data Controller Contact Details

The General Data Protection Regulation (“GDPR”) and other related laws distinguish between organizations that process personal data for their own purposes (known as “controllers”) and organizations that process personal data on behalf of other organizations (known as “processors”).

We act as a controller with respect to personal data collected from you as you engage with the Platform. If you have questions with respect to our processing of your information as a controller, you can contact us by email at the email address set forth in the Privacy Policy section entitled “Contact”. For members in the European Union, Circled LLC's representative under Article 27 of the GDPR is Bufete Montesinos, SLP, Calle Muntaner, 231, 4-2B, Barcelona 08021, Spain, who can be reached at montesinos@montesinos.biz. For members in the United Kingdom, Circled LLC's representative under Article 27 of the UK GDPR is Cecilia Pereira-Yates, 47 Bounty Drive, Kingswood, Hull, HU7 3FN, United Kingdom, who can be reached at cpy8870@yahoo.co.uk.

Lawful Basis for Processing

The GDPR and related laws require a “lawful basis” for processing personal data. Our lawful bases include the following:

• Consent: We may collect, use, and disclose your personal data on the basis of the consent that you provide us at the point of information collection or disclosure.
• Contractual necessity: We may collect and use certain personal data where it is either necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. This may include personal data used to provide you with the Platform and related transaction information.
• Compliance with a legal obligation: We are subject to various legal requirements in the jurisdictions in which we operate, and we may use, disclose, and retain your personal data if necessary for us to comply with a legal obligation arising under an applicable law to which we are subject.
• Legitimate interests: We may collect and use your personal data to the extent necessary to carry out our legitimate interests (or those of a third party), provided that such interests do not outweigh your interests or fundamental rights and freedoms. For example, we may collect and use your personal data in reliance on a legitimate interest in managing our relationship with you; conducting and managing our business; providing you with customer support; developing and enhancing the Platform; detecting and preventing fraud and other harmful activities; and monitoring and maintaining the security of our information, systems, and networks.

Onward Transfer

Circled or its service providers may process, transfer, and store personal data on servers located in a number of countries inside of the EEA (e.g., Germany) and UK or outside of the EEA and UK, including in the United States. Since we are committed to protecting your personal data, we take steps to ensure that there are appropriate safeguards in place when we transfer personal data across international borders. If the GDPR applies and your data is transferred outside the UK or the EEA to the United States or any other country, we will transfer your personal data subject to appropriate safeguards, such as an adequacy decision by the European Commission on the basis of Standard Contractual Clauses or other applicable regulation, as provided from time to time by the European Commission. You can receive additional information about where your personal data is transferred and the appropriate safeguards by contacting us.

Your Data Subject Rights

Your Rights. If you are a data subject under the GDPR or similar jurisdictions, subject to certain conditions, you have the right to:

• Access, rectify, or erase any personal data we process about you;
• Data portability , that is, asking us to transfer your personal data to any third party of your choice;
• Restrict or object to our processing of your personal data; and
• Where applicable, withdraw your consent at any time for any processing of your personal data.

Please see “Your Legal Rights” in the Privacy Policy for more information on how to exercise these rights.

Complaints

If you have a complaint about our use of your personal data or our response to your request(s) regarding your personal data, you may submit a complaint to the Data Protection Supervisory Authority in your jurisdiction. We would, however, appreciate the opportunity to address your concerns before you approach a data protection regulator and welcome you to first direct an inquiry to us. You may contact us at the email address or mailing address under the “Contact ” section of the Privacy Policy.