1. Introduction

MechMaxx Inc. ("MechMaxx," "Company," "we," "our," or "us") respects your privacy and is committed to protecting the Personal Information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, store, retain, and otherwise process Personal Information when you access or use the MechMaxx mobile application (the "App"), create or manage an account, purchase products, participate in our rewards program, request customer support, apply for promotional or discount programs, or otherwise interact with the products and services made available through the App (collectively, the "Services").

This Privacy Policy is intended to explain:

• what information we collect;
• how and from what sources we collect it;
• why we collect and use it;
• how and to whom we disclose it;
• how long we retain it;
• the choices available to you; and
• the privacy rights that may be available under applicable law.

This Privacy Policy applies only to the Services identified in this Policy. Additional privacy notices may apply where required by law or where a particular product, promotion, program, or service is governed by a separate notice.

By accessing or using the Services, you acknowledge that you have read and understand this Privacy Policy.

2. Who We Are

The Services are owned and operated by:

MechMaxx Inc.

866 United Nations Plaza #522

New York, New York 10017

United States

Email: info@mechmaxx.com

Website: https://www.mechmaxx.com

Unless otherwise indicated, MechMaxx is the organization responsible for determining how and why Personal Information described in this Privacy Policy is processed.

3. Scope of This Privacy Policy

This Privacy Policy applies to Personal Information collected through or in connection with:

• the MechMaxx mobile application;
• your MechMaxx customer account;
• purchases made through the App;
• the MechMaxx Rewards Program;
• customer support communications submitted through the App;
• applications for Military, Veteran, Healthcare Professional, or similar discount programs;
• marketing communications, promotional offers, and push notifications delivered through the App; and
• other interactions with MechMaxx through the Services.

This Privacy Policy applies regardless of whether Personal Information is collected directly from you, automatically through your use of the Services, or from third parties acting at your direction or in connection with the Services.

Third-Party Services

The Services may contain links to, integrate with, or permit access to websites, applications, products, or services operated by third parties. Those third parties maintain their own privacy practices, which are governed by their respective privacy policies and terms. Except as expressly described in this Privacy Policy, MechMaxx is not responsible for the privacy, security, or data handling practices of third parties that are not owned or controlled by MechMaxx.

4. Definitions

“Personal Information” information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual or household, as defined under applicable law. Personal Information does not include information that has been deidentified, anonymized, or aggregated in a manner that no longer reasonably identifies an individual, except where applicable law provides otherwise.

“Sensitive Personal Information” Personal Information designated as sensitive under applicable privacy laws, including, where applicable, government-issued identification numbers, financial account credentials, precise geolocation information, certain health-related information, biometric information, and other categories afforded heightened legal protection.

“Process or Processing” any operation performed on Personal Information, whether by automated or manual means, including collecting, recording, organizing, storing, accessing, using, analyzing, disclosing, transferring, retaining, deleting, anonymizing, or otherwise handling Personal Information.

“Service Providers” vendors, contractors, processors, hosting providers, payment processors, cloud service providers, technology providers, professional advisors, and other parties that process Personal Information on MechMaxx's behalf for legitimate business purposes and pursuant to contractual restrictions on their use of such information.

“Third Parties” persons or entities other than MechMaxx, you, and Service Providers acting solely on our behalf.

“Rewards Program” the MechMaxx customer loyalty program, including membership tiers, rewards points, promotional benefits, account incentives, and related features.

“Verification Documents” documentation voluntarily submitted to establish eligibility for Military, Veteran, Healthcare Professional, or similar promotional programs offered by MechMaxx.

“Services” the App and the products, features, functionality, customer support, promotions, loyalty programs, communications, and related services made available through the App.

5. Information We Collect

The Personal Information we collect depends on how you interact with the Services, the features you choose to use, and the information you choose to provide. We collect information directly from you, automatically through your use of the Services, and from certain third parties that support authentication, payments, customer account management, fulfillment, communications, and other operational functions.

A. Information You Provide Directly

1. Account Registration and Authentication

When you create a MechMaxx account, sign in, or manage your account through the App, we may collect:

• full name;
• email address;
• phone number;
• password credentials managed through our authentication provider and not stored in plain text by MechMaxx;
• authentication method, such as email and password, Google, Apple, or Facebook;
• account verification status; and
• account preferences and settings.

If you authenticate through Google, Apple, or Facebook, we receive only the information the applicable provider makes available based on your account settings and authorization choices.

2. Customer Profile and Rewards Program Information

• saved shipping addresses;
• membership tier;
• rewards points balance;
• rewards transaction history;
• marketing and communication preferences; and
• account-related preferences and settings.

3. Orders and Transactions

• order number;
• products purchased;
• purchase date and time;
• order value;
• billing and shipping information;
• shipping and delivery details;
• order status and fulfillment updates;
• returns, exchanges, refunds, and warranty-related information; and
• transaction confirmations and related communications.

Payment card information is entered directly into Shopify Payments or another payment processor’s hosted environment. MechMaxx does not receive or store complete payment card numbers, expiration dates, or security codes, although we may receive transaction status, payment confirmation, billing information, and other information necessary to fulfill orders and administer transactions.

4. Customer Support Communications

• name;
• email address;
• phone number;
• order or account identifiers;
• message contents;
• attachments, photographs, screenshots, or other materials you voluntarily provide; and
• records of communications and support interactions.

5. Reviews, Ratings, and User-Generated Content

• reviewer name or display name;
• product rating;
• review text;
• photographs or videos you choose to upload; and
• date of submission.

Reviews, ratings, and related content may be publicly displayed in connection with the relevant product listing.

B. Discount Program Verification Information

If you apply for a Military, Veteran, Healthcare Professional, or similar discount program, you may voluntarily submit Verification Documents demonstrating eligibility, such as military or veteran documentation, healthcare employment verification, professional credentials, or other documentation reasonably necessary to verify eligibility.

Verification Documents may contain Sensitive Personal Information, including government-issued identification or employment-related information. We process such information solely for eligibility verification, fraud prevention, administration of the applicable program, legal and regulatory compliance, and related recordkeeping.

Verification Documents are transmitted for review and may be stored within MechMaxx’s customer relationship management systems. Access is restricted to authorized personnel who require access for the purposes described above. Verification Documents are not used for advertising or unrelated profiling.

C. Information Collected Automatically

• device type and model;
• operating system and version;
• App version;
• device language settings;
• time zone;
• IP address;
• authentication and session tokens; and
• basic diagnostic and connectivity information.

We use this information to maintain secure authentication sessions, prevent unauthorized access, diagnose technical issues, maintain compatibility, deliver updates, and improve the reliability and performance of the Services.

D. Location Information

With your permission, the App may access location information while you are actively using the App to identify nearby warehouses, provide delivery estimates, and support other requested location-based functionality. The App does not request background location access. MechMaxx does not intentionally retain location history or use location information for cross-context behavioral advertising. If you do not provide location access, you may manually enter a ZIP code or postal code.

E. Camera, Photo Library, and File Access

With your permission, the App may request access to your camera, photo library, or file storage when you voluntarily choose to upload documents, images, or other materials. The App does not access such content unless you initiate the upload process.

F. Information Received From Third Parties

• authentication providers when you choose to sign in through their services;
• Shopify in connection with customer accounts, orders, payments, and fulfillment;
• payment processors through transaction confirmations and payment status information;
• shipping and fulfillment providers through delivery and tracking updates;
• customer relationship management and communications platforms; and
• review and customer feedback platforms.

G. Sensitive Personal Information

The Sensitive Personal Information we may process includes government-issued identification information contained in Verification Documents, certain employment or professional verification information, and other information classified as sensitive under applicable law when voluntarily provided in connection with customer support, warranty claims, or verification requests. We use such information only for limited purposes, including identity or eligibility verification, fraud prevention, security, legal compliance, and providing requested services. We do not use Sensitive Personal Information to infer characteristics about you for advertising or unrelated commercial profiling.

H. Information We Do Not Intentionally Collect

• complete payment card numbers, expiration dates, or security codes;
• continuous location history or background precise geolocation;
• advertising identifiers, such as IDFA or AAID, for targeted advertising through the App;
• biometric identifiers for identification purposes; or
• Personal Information beyond what is reasonably necessary to provide, maintain, secure, and improve the Services.

6. Cookies, SDKs, and Similar Technologies

To operate, secure, and improve the Services, MechMaxx uses software development kits ("SDKs"), application programming interfaces ("APIs"), local storage, authentication technologies, embedded content, device permissions, and other technologies that perform functions similar to cookies used by traditional websites.

A. Essential and Functional Technologies

These technologies may authenticate your account, maintain secure sessions, remember preferences, prevent fraud, protect the Services, route network requests, deliver content and updates, support rewards functionality, facilitate account recovery, provide location-based features, support media playback, and enable customer support. Disabling certain permissions or platform features may affect functionality.

B. Authentication Technologies

Depending on your selection, the Services may support email and password authentication, password resets, account verification, Google Sign-In, Sign in with Apple, Facebook Login, and secure session management.

C. Embedded Content and Third-Party Features

The Services may incorporate third-party functionality, such as instructional videos, maps, customer reviews, authentication services, payment processing, and communications platforms. When you interact with such features, the provider may receive information necessary to deliver the requested functionality under its own privacy practices.

D. Device Permissions

The App may request permission to access location services, camera, photo library, file storage, notifications, or other device capabilities required for a feature you choose to use. You may grant, deny, or revoke most permissions through your device settings.

E. Analytics and Diagnostics

MechMaxx may use operational diagnostics and technical monitoring tools to identify software errors, maintain application stability, improve performance, and enhance security. Where reasonably practicable, these tools are configured to minimize Personal Information and limit processing to operational and diagnostic purposes. MechMaxx does not use technical monitoring tools to create behavioral advertising profiles or deliver cross-context behavioral advertising.

F. Marketing Technologies

The Services may use technologies that facilitate transactional emails, account notifications, order confirmations, shipping updates, password resets, promotional emails, rewards communications, and push notifications. Promotional communications are sent where permitted by law and consistent with your preferences. Transactional and service-related communications may continue where necessary to administer your account or fulfill contractual obligations.

G. Do Not Track

Because there is no uniform industry standard governing responses to browser or platform "Do Not Track" signals, the Services do not currently respond differently based solely on receipt of such a signal unless required by applicable law.

H. Global Privacy Control

Where required by applicable law and where technically supported, MechMaxx recognizes Global Privacy Control ("GPC") and other legally recognized opt-out preference signals as requests to opt out of activities that constitute a sale or sharing of Personal Information under applicable law.

I. Changes to Technology

The technologies used to operate the Services may evolve as we improve functionality, enhance security, replace vendors, or implement new features. Specific SDKs, APIs, and providers may change, provided that resulting processing remains consistent with this Privacy Policy or is otherwise disclosed as required by law.

7. How We Use Personal Information

A. Providing and Operating the Services

• create and manage accounts;
• authenticate users and maintain secure sessions;
• process purchases and transactions;
• fulfill and deliver orders;
• administer the Rewards Program;
• maintain customer profiles;
• process returns, exchanges, refunds, and warranty requests;
• verify eligibility for promotions and discount programs;
• provide customer support; and
• otherwise perform our contractual obligations.

B. Processing Transactions

• verify payment authorization;
• coordinate shipping and delivery;
• communicate order status;
• administer returns, exchanges, refunds, and credits;
• maintain transaction records;
• comply with accounting and tax obligations; and
• detect and prevent fraudulent transactions.

C. Communicating With You

• respond to customer service requests;
• provide technical support;
• send order confirmations and shipping notifications;
• notify you of account changes;
• verify email addresses;
• facilitate password resets;
• administer loyalty communications; and
• send promotional communications where permitted by law and consistent with your preferences.

D. Personalizing the Customer Experience

• remember preferences;
• display relevant account information;
• maintain saved shipping addresses;
• administer rewards benefits;
• improve product recommendations;
• facilitate future purchases; and
• customize portions of the App based on your interactions.

E. Maintaining Security and Protecting the Services

• authenticate users;
• prevent unauthorized access;
• detect suspicious activity;
• investigate fraud;
• enforce our Terms of Use and other agreements;
• monitor for abuse or misuse; and
• protect the rights, property, and safety of MechMaxx, our customers, and others.

F. Improving and Developing the Services

• diagnose software issues;
• identify and correct technical errors;
• improve stability and functionality;
• evaluate customer experience;
• develop new products and features;
• improve operational efficiency, fulfillment, and customer service; and
• conduct internal analytics.

G. Marketing and Promotional Activities

• send promotional communications;
• administer sweepstakes, promotions, contests, or loyalty programs;
• inform you of new products and offers;
• measure engagement; and
• evaluate communication effectiveness.

H. Legal and Regulatory Compliance

• satisfy tax, accounting, and recordkeeping obligations;
• respond to lawful governmental requests and legal process;
• administer legal claims;
• establish, exercise, or defend legal rights; and
• enforce our agreements.

I. Corporate Operations

• manage vendors and Service Providers;
• conduct audits and maintain internal records;
• support business planning and governance;
• evaluate mergers, acquisitions, financing, reorganizations, or similar transactions; and
• conduct other legitimate business activities consistent with this Policy.

J. Other Permitted Uses

We may also use Personal Information with your consent, at your direction, as described at the time of collection, for compatible purposes permitted by law, or as otherwise authorized or required by law.

K. Deidentified and Aggregated Information

We may create, use, and disclose deidentified, anonymized, or aggregated information that cannot reasonably be used to identify an individual for lawful business purposes, including analytics, reporting, product development, research, quality assurance, and service improvement. Where information has been deidentified, MechMaxx will maintain and use it in accordance with applicable law.

8. Disclosure of Personal Information

MechMaxx discloses Personal Information only as reasonably necessary to operate the Services, fulfill customer requests, conduct our business, comply with applicable law, protect our rights, or with your direction or consent.

A. Service Providers and Contractors

We disclose Personal Information to trusted Service Providers and contractors that perform services on our behalf, including cloud hosting, authentication, payment processing, order fulfillment, customer relationship management, communications, technical support, fraud prevention, security monitoring, software maintenance, analytics, diagnostics, and information technology services. These recipients are subject to contractual restrictions and safeguards appropriate to their role.

B. Payment Processing

Payments are processed by third-party payment processors. Card information is entered directly into the processor’s hosted environment. MechMaxx generally receives only information reasonably necessary to confirm payment, fulfill orders, administer refunds, maintain transaction records, and comply with law.

C. Authentication Providers

If you authenticate using a third-party provider, we receive information made available by that provider in accordance with your settings and authorization choices, such as name, email address, authentication identifiers, and information necessary to create or maintain your account.

D. Shipping, Logistics, and Fulfillment Providers

We disclose customer names, shipping addresses, contact information, order details, tracking information, and delivery instructions as reasonably necessary to fulfill and deliver orders.

E. Customer Relationship Management and Communications Platforms

We disclose information to providers that assist with account administration, customer support, transactional and promotional communications, rewards administration, preference management, and customer engagement.

F. Customer Reviews and User-Generated Content

If you submit product reviews, ratings, photographs, videos, testimonials, or other user-generated content, that information may be publicly displayed through the Services.

G. Professional Advisors

We may disclose Personal Information to legal, accounting, auditing, consulting, insurance, tax, compliance, and other professional advisors subject to legal or contractual confidentiality obligations.

H. Government Authorities and Legal Process

We may disclose Personal Information where reasonably necessary to comply with law, respond to lawful requests, protect rights or safety, detect or investigate fraud or unlawful activity, enforce agreements, or establish, exercise, or defend legal claims.

I. Corporate Transactions

Personal Information may be disclosed as part of an actual or proposed merger, acquisition, financing, asset sale, restructuring, bankruptcy, reorganization, or similar corporate transaction, subject to applicable confidentiality and legal requirements.

J. With Your Direction or Consent

We may disclose Personal Information where you request, authorize, or direct the disclosure, or where disclosure is necessary to complete a transaction you initiate.

K. Deidentified and Aggregated Information

We may disclose deidentified, anonymized, or aggregated information that does not reasonably identify an individual for lawful business purposes.

L. Sale and Sharing of Personal Information

MechMaxx does not sell Personal Information in exchange for monetary consideration. Based on our current business and technical practices, we also do not knowingly disclose Personal Information for cross-context behavioral advertising in a manner that constitutes “sharing” under applicable U.S. state privacy laws. Because certain laws define “sale” more broadly than an exchange for money, we periodically evaluate our practices and will provide any notices, choices, or opt-out mechanisms required by applicable law.

9. U.S. State Privacy Notice

This Section supplements the other provisions of this Privacy Policy and applies to residents of U.S. states whose privacy laws provide consumer rights regarding Personal Information.

A. Categories of Personal Information Collected

Category	Representative Examples
Identifiers	Name, email address, phone number, account identifiers, authentication identifiers, IP address, shipping address
Customer Records	Billing and shipping information, order history, account information, rewards membership
Commercial Information	Products purchased, transaction history, returns, exchanges, refunds, warranty requests
Internet or Electronic Activity	Device information, authentication logs, session data, technical diagnostics, App interactions
Geolocation Information	Location accessed during active App use; ZIP code or postal code
Audio, Electronic, or Visual Information	Photographs, videos, screenshots, uploaded documents, review media, support attachments
Professional or Employment Information	Information submitted for Military, Veteran, or Healthcare Professional verification
Sensitive Personal Information	Government-issued identification information contained in Verification Documents and other sensitive categories voluntarily provided
Inferences	Product recommendations, inferred shopping preferences, and fraud-risk indicators

B. Sources of Personal Information

• directly from you;
• automatically through your use of the Services;
• authentication providers;
• Shopify, payment processors, and fulfillment providers;
• customer relationship management and communications providers;
• customer support interactions;
• publicly available sources where permitted by law; and
• other parties acting at your direction or as permitted by law.

C. Purposes for Collection and Use

We collect and use Personal Information for the business and commercial purposes described in Section 7, including providing and administering the Services, fulfilling transactions, maintaining accounts, administering rewards, communicating with customers, personalizing experiences, improving products and services, maintaining security, detecting fraud, complying with legal obligations, and conducting legitimate business operations.

D. Categories of Recipients

• Service Providers and contractors;
• payment processors;
• authentication providers;
• shipping, logistics, and fulfillment providers;
• customer relationship management and communications providers;
• technology and security providers;
• professional advisors;
• governmental authorities where legally required;
• parties involved in corporate transactions; and
• other recipients at your direction or with your consent.

E. Sensitive Personal Information

Where MechMaxx collects Sensitive Personal Information, we use and disclose it only to provide requested Services, verify identity or eligibility, prevent fraud, maintain security, comply with legal obligations, or for other limited purposes permitted by law. We do not use Sensitive Personal Information to infer characteristics about individuals for advertising or unrelated profiling.

F. Consumer Privacy Rights

Depending on your state of residence and applicable law, you may have the right to:

• know whether we process your Personal Information;
• access and obtain a copy of your Personal Information;
• correct inaccurate Personal Information;
• request deletion, subject to legal exceptions;
• withdraw consent where processing is based on consent;
• opt out of activities that constitute sale, sharing, targeted advertising, or certain profiling;
• limit certain uses of Sensitive Personal Information where provided by law;
• appeal certain privacy request determinations; and
• not be discriminated against for exercising applicable privacy rights.

G. Exercising Your Rights

To exercise applicable privacy rights, contact us using the methods in Section 20. We may take reasonable steps to verify your identity or authority. Verification procedures may vary based on the nature and sensitivity of the request and the risk of unauthorized disclosure. Where permitted by law, we may deny requests that cannot be adequately verified.

H. Authorized Agents

Where permitted by law, you may designate an authorized agent to submit certain requests. We may require proof of authority, verification of your identity, and other information reasonably necessary to prevent unauthorized disclosure.

I. Appeals and Response Timing

Where applicable law provides an appeal right, instructions will be provided with the relevant determination. We will respond to verified requests within the time periods required by law and may extend a response period where permitted after providing required notice.

J. Global Privacy Control

Where required by applicable law and where technically supported, GPC and similar legally recognized signals will be processed as requests to opt out of activities that constitute sale or sharing under applicable law.

10. Data Retention

MechMaxx retains Personal Information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including providing the Services, complying with legal obligations, resolving disputes, enforcing agreements, protecting legal rights, maintaining appropriate business records, and other legitimate business purposes permitted by law.

When determining retention periods, we consider the nature, sensitivity, and volume of the information; the purposes for collection; whether those purposes can be achieved by other means; applicable limitation periods; contractual obligations; tax, accounting, warranty, and recordkeeping requirements; security and fraud-prevention needs; anticipated or ongoing legal proceedings; and other operational and regulatory requirements.

Category	Typical Retention Criteria
Customer Accounts	For the life of the account and thereafter as reasonably necessary for transactions, fraud prevention, legal compliance, dispute resolution, and records management
Transaction Records	As reasonably necessary for fulfillment, tax and accounting, warranty, fraud prevention, legal compliance, and dispute resolution
Rewards Program Records	While participation continues and thereafter as reasonably necessary to administer the program and resolve disputes
Customer Support Communications	As reasonably necessary to provide support, maintain records, and protect legal interests
Verification Documents	Only as long as reasonably necessary to administer eligibility, prevent fraud, comply with law, and resolve disputes
Marketing Preferences	Until withdrawn or obsolete, and as necessary to maintain suppression records and demonstrate compliance

When Personal Information is no longer required, we will take reasonable steps to securely delete, anonymize, or otherwise dispose of it in accordance with applicable law and internal records-management practices. Residual copies may remain in secure backup systems for limited periods consistent with normal backup and disaster-recovery processes.

11. Account Deletion

Customers may request deletion of their account through the functionality provided within the Services or by contacting MechMaxx. Before processing certain requests, we may require reasonable identity verification to protect against unauthorized access or fraudulent deletion.

Once a verified request is processed, account credentials will be disabled or removed; profile information will be deleted or deidentified where appropriate; saved addresses and preferences may be removed; Rewards Program participation may terminate; rewards balances and associated benefits may be forfeited under applicable program terms; and access associated with the deleted account will generally no longer be available.

Certain information may be retained where reasonably necessary to complete pending transactions, process returns or warranty claims, comply with law, satisfy tax or accounting requirements, maintain required business records, detect or prevent fraud, resolve disputes, enforce agreements, exercise or defend legal claims, or otherwise comply with applicable law. Where feasible, retained information will be isolated, restricted, or deidentified.

12. Security

MechMaxx maintains administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, acquisition, disclosure, alteration, misuse, or destruction, taking into account the nature of the information and the risks associated with processing.

Depending on the circumstances, safeguards may include encryption in transit, authentication and access controls, role-based restrictions, network protections, security monitoring and logging, employee access controls, vendor security reviews, incident-response procedures, and backup and recovery processes.

No method of electronic transmission or storage is completely secure. Accordingly, MechMaxx cannot guarantee absolute security. Customers are responsible for maintaining the confidentiality of account credentials and should promptly notify MechMaxx of suspected unauthorized activity.

Security Incidents

If MechMaxx becomes aware of a security incident involving Personal Information, we will investigate the matter and provide any notices required by applicable law to affected individuals, regulators, or governmental authorities.

13. International Data Transfers

MechMaxx is headquartered in the United States, and the Services are primarily operated from the United States. Personal Information may be collected, processed, stored, or otherwise transferred to the United States or other jurisdictions in which MechMaxx, its Service Providers, or contractors maintain operations. Privacy laws in those jurisdictions may differ from those in your place of residence.

Where applicable law requires safeguards for international transfers, MechMaxx will implement appropriate measures designed to satisfy those requirements.

14. Automated Decision-Making and Profiling

MechMaxx does not use solely automated decision-making that produces legal or similarly significant effects concerning individuals except where permitted by applicable law. We may use automated technologies to support fraud detection, account security, product recommendations, customer experience personalization, operational analytics, and quality assurance. These activities are intended to assist operations and improve the Services, not to replace human judgment in legally significant decisions where applicable law provides otherwise.

15. Privacy Rights Outside the United States

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of Personal Information; withdraw consent; obtain information about certain automated decision-making; lodge a complaint with an applicable authority; and exercise other rights provided by law. The availability and scope of rights depend on jurisdiction, the nature of the information, and the legal basis for processing.

A. European Economic Area and United Kingdom

Where applicable, MechMaxx may process Personal Information based on performance of a contract, compliance with a legal obligation, legitimate interests not overridden by your rights and freedoms, consent, or another lawful basis. Legitimate interests may include operating and improving the Services, protecting accounts, preventing fraud, maintaining security, communicating with customers, administering operations, and protecting legal rights.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing. You may also have the right to lodge a complaint with an applicable data protection authority. Nothing in this Privacy Policy represents that European or United Kingdom privacy law applies where it does not.

B. Canada, Including Quebec

Where Canadian privacy law applies, MechMaxx processes Personal Information in accordance with applicable federal and provincial requirements. Information may be transferred to and processed in the United States or other jurisdictions and may be accessible to authorities there in accordance with law. Canadian residents may have rights to access and correct information, withdraw consent subject to legal and contractual restrictions, obtain information about privacy practices and international transfers, and exercise additional rights under applicable provincial law.

16. Your Privacy Choices and Preferences

A. Account Information

You may review or update certain account information through available profile or account settings. You are responsible for keeping account information accurate and current.

B. Marketing Emails

You may opt out of promotional emails using the unsubscribe link, available preference settings, or by contacting MechMaxx. We may continue to send transactional, administrative, security, order-related, and other non-promotional communications.

C. Push Notifications

You may enable or disable push notifications through device settings. Disabling promotional notifications may not prevent essential account, security, or transaction-related information from being displayed where permitted.

D. Location Services

You may grant or revoke location access through device settings. If disabled, you may be able to enter a ZIP code or postal code manually.

E. Camera, Photo Library, and File Permissions

You may grant or revoke access through device settings. Revoking access may prevent uploads through affected features.

F. Third-Party Authentication

You may choose whether to sign in using supported third-party providers and may manage provider permissions through the provider’s account settings.

G. Account Deletion

You may request account deletion as described in Section 11. Deletion may result in permanent loss of rewards points, benefits, preferences, and account access.

H. Privacy Requests

You may submit applicable privacy requests using the methods in Section 20. Additional request methods may be provided where appropriate or required by law.

17. Children’s Privacy

The Services are intended for a general audience and are not directed to children under thirteen (13). MechMaxx does not knowingly collect Personal Information directly from children under thirteen in a manner requiring verifiable parental consent. If we learn that information has been collected in a manner inconsistent with applicable children’s privacy law, we will take reasonable steps to delete or otherwise address it. Parents or legal guardians who believe a child has provided Personal Information may contact us using Section 20. Where a jurisdiction establishes a higher minimum age for valid consent, MechMaxx will apply that requirement where applicable.

18. Third-Party Websites and Services

The Services may contain links to, integrate with, or provide access to third-party websites, applications, platforms, and services, including authentication providers, payment processors, embedded video platforms, mapping services, social media services, customer review platforms, and other functionality. When you interact directly with a third-party service, that third party may independently collect and process information under its own privacy policy and terms. Except where MechMaxx is responsible for the applicable processing, MechMaxx does not control and is not responsible for third-party privacy, security, content, or data handling practices.

19. Changes to This Privacy Policy

MechMaxx may update this Privacy Policy periodically to reflect changes in the Services, business operations, information practices, applicable law, regulatory guidance, technology, security practices, or other relevant circumstances. When updated, we will revise the “Last Updated” date. Where required by law, we may provide additional notice through the App, email, website, a request for consent, or another legally sufficient method.

Any revised Privacy Policy will become effective on the date identified in the updated Policy unless otherwise stated. Where consent is legally required for a material change, MechMaxx will obtain it before applying the change to affected processing activities. Continued use after an update constitutes acknowledgment but not consent where law requires another method.

20. Contact Us

Questions, concerns, complaints, and privacy rights requests may be directed to:

MechMaxx Inc.

866 United Nations Plaza #522

New York, New York 10017

United States

Email: info@mechmaxx.com

Website: https://www.mechmaxx.com

Please include “Privacy Request” in the subject line of privacy-related correspondence. Provide sufficient information to identify the nature of your request, locate relevant records, verify your identity where appropriate, and allow us to respond. Do not send government-issued identification documents by unsecured email unless MechMaxx specifically requests them and provides an appropriate submission method.

We will use information submitted in connection with a privacy request only to verify, evaluate, document, and respond to the request, protect the request process, and comply with legal obligations.

Complaints

If you have concerns about MechMaxx’s privacy practices, please contact us so we may review and respond. Contacting MechMaxx does not limit any right to contact an applicable regulatory or data protection authority.

21. Accessibility

MechMaxx is committed to making this Privacy Policy reasonably accessible. If you require this Policy in an alternative format because of a disability or accessibility need, please contact us using Section 20. We will take reasonable steps to provide an appropriate alternative format.

22. Language

This Privacy Policy is provided in English. Where MechMaxx provides a translated version, the translation is provided for convenience unless applicable law requires otherwise. In the event of a conflict, the version controlling under applicable law will govern.

23. Supplemental U.S. State Privacy Disclosures

This Section supplements the information provided elsewhere in this Privacy Policy and applies where required by applicable U.S. state privacy laws. MechMaxx does not necessarily collect every listed category from every individual. “Sold” and “Shared” have the meanings assigned under applicable law. Retention periods are general criteria rather than guaranteed fixed periods and remain subject to legal holds, fraud-prevention needs, warranty obligations, and other legitimate requirements.

Category	Examples	Sources	Purposes	Recipients	Sold	Shared	Retention Criteria
Identifiers	Name, email, phone, account/authentication IDs, IP address, shipping address	You; authentication providers; Shopify; automatically	Accounts; authentication; orders; support; communications; security; compliance	Technology, authentication, payment, fulfillment, CRM, communications, advisors, authorities	No monetary sale	No, based on current practices	Life of account and as needed for transactions, fraud, compliance, disputes, and records
Customer Records	Billing and shipping information, account and transaction details	You; Shopify; payment and fulfillment providers	Transactions; returns; refunds; account administration; legal records	Shopify; payment; logistics; CRM; advisors; authorities	No monetary sale	No, based on current practices	Based on account status, tax/accounting, warranty, fraud, and limitation periods
Commercial Information	Products, orders, transaction value, rewards, returns, warranties	You; Shopify; payment and fulfillment providers; internal records	Fulfillment; rewards; support; personalization; analytics; legal compliance	Shopify; payment; logistics; CRM; communications; advisors	No monetary sale	No, based on current practices	As needed for fulfillment, service, warranty, accounting, tax, fraud, and disputes
Internet/Electronic Activity	Device, OS, App version, IP, sessions, authentication events, diagnostics	Automatically; device; hosting, authentication, and diagnostic providers	Operate and secure Services; authentication; fraud; diagnostics; updates	Hosting; authentication; diagnostics; security; technology contractors	No monetary sale	No, based on current practices	As needed for security, diagnostics, fraud prevention, account administration, and operations
Geolocation	Location during active use; ZIP or postal code	You; device permissions	Nearby warehouses; delivery estimates; requested location functionality	Mapping and technology providers as necessary	No monetary sale	No, based on current practices	Precise location not intentionally retained after requested use; postal information may remain in records
Visual/Uploaded Content	Photos, videos, screenshots, documents, review media, support attachments	You	Verification; support; reviews; warranty; fraud prevention	CRM; support; review platforms; authorized personnel; advisors	No monetary sale	No, based on current practices	Based on purpose of submission, support, review, verification, warranty, fraud, and law
Professional/Employment	Healthcare employment, professional credentials, military/veteran documentation	You	Eligibility verification; fraud prevention; program administration	CRM; authorized personnel; advisors where necessary	No monetary sale	No, based on current practices	Only as needed for eligibility, program administration, fraud, law, and disputes
Sensitive Personal Information	Government-issued identification and other sensitive information voluntarily submitted	You	Eligibility; identity verification; fraud prevention; security; compliance	CRM; authorized personnel; security providers; advisors; authorities where necessary	No monetary sale	No, based on current practices	Minimum period reasonably necessary, subject to fraud, legal, records, and disputes
Account/Profile	Rewards tier, points, history, preferences, saved addresses	You; generated through Services	Accounts; rewards; personalization; purchase facilitation; communications	Hosting; Shopify; CRM; communications	No monetary sale	No, based on current practices	While active and thereafter as needed for law, fraud, accounting, and disputes
Communications/Support	Inquiries, messages, support history, correspondence, attachments	You; communications with MechMaxx	Support; complaints; returns; warranty; improvement; legal records	CRM; communications; advisors; authorities where required	No monetary sale	No, based on current practices	As needed to resolve matters, maintain records, comply with law, and protect interests
Marketing/Preferences	Subscriptions, push settings, preferences, promotional engagement	You; communications providers; interaction data	Authorized communications; preferences; rewards; engagement measurement	Communications; CRM; marketing providers acting on our behalf	No monetary sale	No, based on current practices	Until withdrawn or obsolete, plus suppression and compliance records
Inferences	Product recommendations, shopping preferences, fraud-risk indicators	Generated from account, transaction, and interaction data	Personalization; recommendations; service improvement; fraud and security	Technology; CRM; fraud-prevention and security providers	No monetary sale	No, based on current practices	As needed for personalization, improvement, security, fraud prevention, and law

A. Categories of Personal Information Sold or Shared

• MechMaxx does not sell Personal Information in exchange for monetary consideration.
• Based on current practices, MechMaxx does not knowingly share Personal Information for cross-context behavioral advertising.
• MechMaxx does not knowingly sell or share Personal Information of consumers under sixteen (16).
• MechMaxx does not use or disclose Sensitive Personal Information to infer characteristics for advertising or unrelated profiling.

Some laws define “sale” more broadly than an exchange for money. MechMaxx periodically evaluates its disclosures and technology practices and will provide required notices, choices, and opt-out mechanisms where applicable.

B. Business Purposes for Disclosure

• auditing interactions and transactions;
• maintaining and securing accounts;
• detecting and preventing security incidents and fraudulent or unlawful activity;
• processing and fulfilling transactions;
• providing customer service;
• administering rewards, promotions, and verification programs;
• maintaining and servicing the App;
• debugging and repairing technical errors;
• conducting internal research and service improvement;
• maintaining quality and safety;
• complying with legal and regulatory requirements;
• exercising or defending legal claims; and
• conducting corporate transactions and other lawful activities consistent with this Policy.

C. Use and Disclosure of Sensitive Personal Information

MechMaxx uses and discloses Sensitive Personal Information only for limited and permitted purposes, including providing requested goods or services, verifying identity or eligibility, maintaining account and transaction security, preventing and investigating fraud, resisting unlawful activity, processing warranty or support requests, complying with law, and maintaining required records. If practices change in a manner that triggers a statutory right to limit use, MechMaxx will provide the required notice and method for exercising that right.

D. Financial Incentives and Rewards Program

MechMaxx may offer rewards points, membership tiers, discounts, promotional benefits, or similar incentives through the Rewards Program. Participation is voluntary and governed by applicable program terms. Information reasonably necessary to administer the program may include name, contact information, account identifiers, purchase and transaction history, rewards activity, membership tier, points balance, and communication preferences.

Where an offer constitutes a regulated financial incentive, bona fide loyalty program, or price or service difference, MechMaxx will provide any additional program-specific notice required by law, including material terms, the categories of Personal Information involved, how the benefit is reasonably related to the value of the information, how to participate, and how to withdraw. Withdrawal may result in forfeiture of unused points, membership status, or benefits.

E. Consumer Request Metrics

Where required by law, MechMaxx may compile and disclose metrics concerning consumer privacy requests, including requests received, complied with, and denied, and the average or median time taken to substantively respond. Required metrics will be published in the manner and at the time required by law.

Publication Note: This Privacy Policy should be reviewed against MechMaxx’s actual data flows, vendor configurations, retention practices, consumer-request procedures, App Store and Google Play disclosures, and Rewards Program terms before publication.