CLIMB CRAFTS PRIVACY POLICY

Last Updated: August 26, 2026

1. Scope and Applicability

This Privacy Policy describes how CLIMB Crafts LLC (“CLIMB,” “we,” “us,” or “our”) collects, uses, discloses, retains, protects, and otherwise processes personal information when you access or use the Services, otherwise interact with CLIMB in connection with the Services, or receive communications from CLIMB.

The Services include CLIMB’s websites, applications and, where available, membership services, Maker Profile, Your CLIMB Guide, Maker Journey, Maker Vault, community features, Guided Experiences, Contributions, Maker Spotlights, support, referrals, research and testing activities, trust and safety functions, and other services that link to or reference this Policy (collectively, the “Services”). This Policy applies whether or not you maintain a CLIMB account. For purposes of this Policy, “personal information” includes “personal data” and comparable information protected under applicable privacy law.

CLIMB Crafts LLC is responsible for personal information that CLIMB processes under this Policy. Where applicable law uses the term “controller” or a comparable term, CLIMB acts in that capacity when CLIMB determines the purposes and means of the applicable processing. Vendors, contractors, and other service providers may process personal information on CLIMB’s behalf subject to applicable contractual, confidentiality, security, and other legally required restrictions.

Where CLIMB processes personal information on behalf of another organization under a specific Service relationship, the applicable privacy notice, Service terms, or agreement may identify different or additional privacy roles for that processing. Additional or feature-specific privacy notices may supplement this Policy by providing more specific information concerning an identified Service or processing activity. For the applicable processing activity, the more specific notice applies to the extent it addresses that processing more specifically; this Policy otherwise continues to apply.

This Policy governs CLIMB’s processing of personal information and does not govern the independent privacy practices of third-party websites, applications, resources, integrations, or services. An independent third party’s processing is governed by its applicable privacy policy or notice. This Policy continues to apply to personal information that CLIMB itself receives or processes in connection with the interaction.

Nothing in this Policy expands a Member Content license or record-specific permission otherwise governed by the CLIMB Crafts Terms of Service, applicable Additional Terms, or the applicable permission record.

2. What Information We Collect

The personal information CLIMB collects depends on the Services you access or use, the features you activate, and how you interact with CLIMB.

Information You Provide. Depending on the applicable Service, CLIMB may collect account, contact, authentication, profile, and preference information; Maker Profile information, including Maker Path, Journey Stage, craft interests, projects, goals, support preferences, and guidance or participation history; Member Content, including posts, comments, reactions, files, images, videos, audio, messages, drafts, Contributions, attribution information, and related metadata; information submitted through Guided Experiences, Check-Ins, surveys, interviews, research, Product Feedback, support requests, referrals, waitlists, reports, appeals, copyright or intellectual-property matters, privacy requests, accessibility requests, security or safety matters, applications, or other communications; and acceptance, consent, permission, authorization, withdrawal, revocation, publication, and preference records. Some information is required to create or secure an account or provide a selected Service; other information is optional. The applicable interface or notice may identify information required for the applicable function.

Information From Other People. CLIMB may receive personal information about you from other members, collaborators, rights holders, reporters, claimants, requesters, referrers, authorized organizations, or other persons when they tag or mention you; communicate with or about you; refer you; identify you as a collaborator, author, rights holder, representative, or participant; submit a photograph, video, audio recording, or other content involving you; make a report, complaint, ownership or authorship assertion, copyright notice, counter-notice, security or safety request, or other rights or safety request; or provide information in connection with an appeal, investigation, dispute, or other Service relationship. Where participation is authorized or administered by another person or organization, CLIMB may receive information from an applicable parent, guardian, school, library, nonprofit, organization, instructor, program sponsor, or other authorized person as described in the applicable Service notice or relationship.

Rights, Safety, and Request Information. Information submitted or generated through reporting, copyright or intellectual-property, privacy, accessibility, security, safety, appeal, dispute, urgent-removal, or similar processes may include identity and contact information; account, transaction, activity, or content identifiers; information concerning the affected person and a requester’s authority to act; signatures where applicable; information sufficient to identify or locate affected content or activity; statements, supporting facts, evidence, correspondence, request identifiers, status information, and final-disposition records.

Urgent Image-Removal Information. Information submitted through CLIMB’s designated urgent image-removal process may include the requester’s identity and contact information; information identifying the depicted individual and the requester’s authority to act; a physical or electronic signature; information sufficient to identify and locate the reported content; a good-faith statement concerning lack of consent; request identifiers and status history; correspondence; and information submitted or generated in connection with review, known-identical-copy handling, evidence preservation, or final disposition. The designated process generally relies on information sufficient to locate the reported material and does not require submission of the intimate image itself unless an applicable protected process expressly requests a particular item.

Information Collected Automatically. When you access or use the Services, CLIMB may automatically collect log, device, browser, operating-system, application, session, network, IP-address, approximate-location, usage, diagnostic, error, performance, security, cookie, consent-preference, and analytics information. Usage information may include pages or resources viewed, searches, links selected, features used, interactions with content or recommendations, participation activity, and dates, times, frequency, or duration of relevant activity. The particular information collected depends on the Service, device, settings, applicable consent choices, and technologies in use. This information may be collected whether or not you maintain a CLIMB account.

Derived or Inferred Information. Depending on the Service, CLIMB may derive or infer information from information you provide and from your use of the Services, including recommendation or routing signals, inferred interests or needs, possible Maker Path or Journey Stage indicators, participation or progress information, and spam, abuse, fraud, security, or account-risk indicators or other operational classifications. Derived or inferred information remains subject to this Policy to the extent it constitutes personal information under applicable law and does not constitute a professional, legal, medical, financial, or other determination about you.

Information From Connected Services, Integrations, and Service Providers. CLIMB may receive personal information from a third-party service that you authorize or intentionally connect to a Service and from vendors, contractors, integrations, or other service providers used to provide, secure, support, or administer the Services. The categories of information received depend on the applicable connection, authorization, or Service. Independent third-party processing remains subject to Section 1 of this Policy and the applicable third party’s privacy notice.

Verification Information. Where an applicable Service or rights or safety process requires verification of age, identity, eligibility, account ownership, authority, or similar information, CLIMB may collect information reasonably necessary for the applicable verification. The categories collected depend on the applicable process and may include age or age range, date of birth where necessary, identity or authority information, verification results, or supporting documentation. Information collected for an identified verification purpose does not authorize an unrelated use.

Paid or Transactional Services. If CLIMB offers a paid or transactional Service and you initiate or participate in a transaction, CLIMB may collect transaction, order, billing, payment-authorization, refund, cancellation, fulfillment, and related records and may receive limited payment-related information or transaction status from the applicable payment service provider. Additional information concerning the applicable processing may be provided before the transaction through the checkout flow, applicable Additional Terms, or feature-specific privacy notice.

Sensitive or Protected Information. Depending on information submitted through an applicable Service or protected request process, certain information may be considered sensitive or subject to special protections under applicable law. General profile, community, email, and support fields are not intended for passwords, full payment-card data, government identification numbers, medical records, intimate material, private legal evidence, or another person’s confidential or sensitive information unless a Service expressly requests the information through an appropriate protected process.

Future Youth, Family, or Managed Services. CLIMB does not currently collect information through an active youth or guardian-managed member-account Service. If CLIMB later activates a designated youth, teen, family, school, library, nonprofit, organization-sponsored, or other managed Service, the applicable youth or feature-specific privacy notice will identify the additional categories of information collected for that Service. Depending on the applicable Service, those categories may include age or age range; date of birth where necessary; parent or guardian information and applicable authorization or consent records; organization affiliation; participant profile, content, project, progress, participation, support, accessibility, or safety information; transaction authorization where applicable; and device, usage, notification, security, or other technical information.

3. How We Use Your Information

CLIMB may use personal information to provide, maintain, operate, secure, administer, and improve the Services; create, authenticate, administer, and protect accounts; verify account ownership, eligibility, identity, or authority where reasonably necessary for an applicable Service or rights or safety process; provide Maker Profile, maker-navigation, recommendation, routing, progress, and continuity functionality; personalize the Services as further described in Section 4; operate community, messaging, participation, and resource-discovery features; and provide Guided Experiences.

CLIMB may use personal information to administer Contributions, Maker Spotlights, attribution, permissions, referrals, waitlists, participation records, and other applicable Service-specific activities; provide customer support and accessibility assistance; send technical, administrative, account, security, privacy, legal, participation, and other Service-related communications; and administer surveys, research, usability testing, analytics, pilots, and Service development as further described in this Policy and applicable feature-specific notices.

CLIMB may use personal information to detect, prevent, investigate, mitigate, and address fraud, scams, spam, abuse, account compromise, security incidents, prohibited conduct, policy violations, infringement, and unlawful activity; protect CLIMB, members, other persons, and the Services; enforce applicable Terms of Service, Additional Terms, and policies; and maintain the integrity, availability, and security of the Services.

CLIMB may also use personal information to administer reports, moderation, appeals, copyright and intellectual-property matters, privacy and data-rights requests, accessibility requests, security matters, urgent image-removal requests, safety matters, disputes, and other rights or safety processes. These uses may include identifying and locating relevant accounts, content, or activity; reviewing reports and supporting information; evaluating known identical copies where applicable; preserving evidence and records; communicating with applicable parties; providing confirmations or status information; documenting outcomes; preventing recurrence or abuse; and complying with applicable legal obligations.

If CLIMB offers a paid or transactional Service and you initiate or participate in an applicable transaction, CLIMB may use transaction and related information to administer the transaction; provide or facilitate the applicable Service or fulfillment; communicate concerning the transaction; process or administer payment status, refunds, cancellations, or disputes; prevent fraud; maintain appropriate financial or transaction records; and comply with applicable tax, accounting, legal, or regulatory obligations. Additional information concerning the applicable processing may be provided in the checkout flow, applicable Additional Terms, or feature-specific privacy notice.

CLIMB may use personal information for administration, auditing, analytics, recordkeeping, troubleshooting, testing, Service development, legal and regulatory compliance, and to establish, exercise, or defend legal rights. CLIMB may also use information for another purpose disclosed at the time of collection or with your consent or other authorization where required by applicable law.

General participation in the Services does not authorize CLIMB to use identifiable Member Content, a Maker Story, testimonial, name, image, voice, likeness, Contribution, or other material subject to separate permission for external advertising, publicity, or another record-specific promotional use unless the applicable separate permission has been obtained. The collection or use of personal information under this Policy does not expand the scope of a Member Content license or record-specific permission.

If CLIMB later activates a designated youth, teen, family, educational, library, nonprofit, or organization-sponsored Service, CLIMB may use personal information for the purposes identified in the applicable youth or feature-specific privacy notice, which may include administering a managed or linked profile; providing age-appropriate Services, resources, recommendations, and Guided Experiences; tracking applicable progress or participation; supporting authorized parents, guardians, schools, libraries, or sponsoring organizations; administering authorization, consent, assent, and permissions; providing safety, moderation, security, and support; preventing fraud or misuse; administering account transition; and responding to applicable privacy requests. CLIMB will not treat external advertising, publicity, identifiable research publication, or AI-model training as a general youth-Service purpose where applicable law, notice, consent, or separate permission is required for that use.

4. Personalized Services; Internal Access; Automated Processing and Review

CLIMB may process Maker Profile information, settings and preferences, prior participation, Service activity, progress or results information, recommendation and routing signals, and other personal information permitted under this Policy to personalize the Services. Personalization may include selecting, organizing, prioritizing, or recommending features, content, resources, Maker Vault materials, community spaces, Guided Experiences, support, or other actions relevant to the applicable Service.

Personalization may involve automated processing and, where appropriate, review by authorized personnel. Recommendations, routing, classifications, or other personalized outputs are used to administer and provide the Services and do not constitute a professional, legal, medical, financial, employment, or other determination about you. Where a materially different personalization or profiling use requires additional notice, consent, or another lawful basis under applicable law, CLIMB will provide the applicable notice or obtain the required authorization before that processing begins.

Authorized CLIMB personnel and service providers acting on CLIMB’s behalf may access personal information where reasonably necessary and proportionate to the applicable purpose, including to provide guidance, navigation, support, or accessibility assistance; administer a Guided Experience or other Service; investigate or resolve a report, appeal, privacy request, copyright or intellectual-property matter, urgent image-removal request, security concern, fraud concern, or safety matter; troubleshoot technical issues; protect an account or the Services; enforce applicable Terms of Service, Additional Terms, or policies; comply with legal obligations; or otherwise perform an authorized Service function. Access to non-public personal information is limited according to role, purpose, and legitimate operational need and is subject to applicable confidentiality, security, and contractual requirements.

CLIMB does not rely solely on automated processing to make permanent account-termination, final copyright or intellectual-property enforcement, or other materially consequential protection decisions where review by authorized personnel is required by applicable CLIMB policy or law. If CLIMB uses automated processing to make or materially contribute to a decision producing legal or similarly significant effects and applicable law provides notice, review, appeal, opt-out, or other rights concerning that processing, CLIMB will provide the applicable rights as required by law.

Use of Maker Profile, participation, routing, recommendation, progress, support, or similar information for maker navigation or support does not, by itself, authorize CLIMB to use or disclose that information for an unrelated third party’s independent advertising purposes. Any advertising, profiling, or materially different use subject to additional disclosure, consent, or opt-out requirements will be governed by the applicable provisions of this Policy, feature-specific notices, consent or preference controls, and applicable law.

If CLIMB later activates a designated youth, teen, family, educational, library, nonprofit, organization-sponsored, or other managed Service, personalization, internal access, automated processing, and review for that Service may be subject to additional age-appropriate limitations, parent or guardian controls, organization-specific roles, privacy notices, permissions, and safeguards required for the applicable Service and jurisdiction.

5. Public and Non-Public Content

The audience, visibility, or access setting associated with an applicable Service determines who may access Member Content through that Service. Depending on the Service and applicable settings, content may be designated as public, visible to CLIMB members, limited to an identified group or Service, available only to identified participants, or restricted to authorized CLIMB access.

Public Content. Member Content made available through a public portion of the Services may be accessible to persons who do not maintain a CLIMB account and, where public indexing is enabled, may be indexed or displayed by search engines or other third-party services. Persons who can access public content may link to, download, copy, capture, screenshot, quote, or reshare that content. CLIMB cannot control all subsequent uses, disclosures, copies, or distributions made independently by recipients or third parties after information has been lawfully made available to them.

Making Member Content public does not transfer ownership of that content or, by itself, grant CLIMB, another member, or a third party any right to use the content beyond the rights provided under the Terms of Service, an applicable license or permission, the functionality of the applicable Service, or applicable law. Public availability does not, by itself, authorize external advertising, publicity, merchandise, Maker Spotlight use, testimonial use, name-image-voice-likeness use, event use, AI-model training or fine-tuning, or another use for which CLIMB requires a separate agreement or record-specific permission.

Non-Public Content. Member-only, group- or Service-limited, participant-limited, private, and restricted content is not made publicly available merely because CLIMB processes that information to provide or protect the Services. Persons who are authorized to receive or access non-public Member Content may nevertheless retain, copy, screenshot, download, forward, disclose, or otherwise use information contrary to CLIMB’s rules or the content owner’s expectations. CLIMB cannot guarantee that an authorized recipient will not independently misuse information after receiving access.

Authorized CLIMB personnel and service providers acting on CLIMB’s behalf may access relevant non-public information only as described in this Policy, including where reasonably necessary to provide or administer the Services; provide support or accessibility assistance; protect an account or the Services; investigate or resolve reports, appeals, privacy requests, copyright or intellectual-property matters, urgent image-removal requests, fraud, security, or safety matters; troubleshoot technical issues; enforce applicable Terms of Service, Additional Terms, or policies; comply with legal obligations; or perform another authorized Service function. Such access remains subject to the limitations described in Section 4.

Contributions and Other Material Subject to Separate Permission. Where Member Content is submitted through a Contribution, Maker Spotlight, testimonial, publicity, recording, or other process requiring separate permission, the audience, destination, and permitted use recorded for that content govern the applicable CLIMB presentation or use. Approval or permission for one audience, destination, channel, or purpose does not authorize a different audience, destination, channel, or materially different use unless the applicable agreement or permission provides otherwise.

Changing a content setting, removing content from public or member-facing availability, closing an account, withdrawing a Contribution, withdrawing a record-specific permission, and exercising a privacy deletion right are distinct actions and may have different effects. Removal from public or member-facing availability does not necessarily require immediate deletion of records that CLIMB may lawfully retain for account administration, appeals, fraud prevention, copyright or intellectual-property matters, privacy requests, safety, security, disputes, evidence preservation, legal compliance, backups, or other purposes described in Section 10. Copies retained by recipients or independent third parties may remain outside CLIMB’s possession or control.

If CLIMB later activates a designated youth, teen, family, educational, library, nonprofit, organization-sponsored, or other managed Service, the applicable privacy notice and Service controls will identify the audiences available for youth information and content. Participation in such a Service will not, by itself, make a minor’s profile, content, image, voice, creative work, project, school or organization affiliation, or identifiable participation publicly available or authorize a broader publicity or promotional use.

6. Research, Feedback, and Test Features

CLIMB may collect and use personal information submitted or generated through Guided Experiences, Check-Ins, surveys, interviews, usability studies or observations, research activities, pilot programs, preview or early-access features, beta features, controlled tests, and similar activities to provide, evaluate, test, troubleshoot, secure, develop, and improve the Services. Information collected or generated through these activities remains subject to this Policy and any applicable feature-specific privacy notice, Additional Terms, or other notice governing the applicable activity.

Participation in an interview, survey, usability study, research activity, or other activity expressly identified as optional is voluntary. Information generated through use of a Service may nevertheless be processed for analytics, testing, troubleshooting, research, security, and Service-improvement purposes as otherwise described in this Policy.

CLIMB may use aggregated or deidentified information for analytics, research, evaluation, reporting, testing, and Service improvement. CLIMB will not intentionally attempt to re-identify information maintained as deidentified except as permitted by applicable law. Aggregation or deidentification does not expand any rights in the underlying Member Content or material subject to separate permission.

For purposes of this Policy, Product Feedback has the meaning provided in the Terms of Service and refers to ideas, suggestions, comments, feature requests, evaluations, bug reports, or similar input intentionally submitted to CLIMB for the purpose of evaluating, improving, developing, or testing CLIMB products or Services. CLIMB may process Product Feedback as described in the Terms of Service and this Policy.

Member Content; creative works or concepts submitted for another purpose; Maker Profile information; Check-Ins; private messages; Guided Experience or other private Service responses; project information; Maker Stories; testimonials; Contributions; applications; confidential information; safety or protection reports; privacy requests; copyright or urgent-removal submissions; permission records; youth information; and other information submitted for an identified purpose other than Product Feedback do not become Product Feedback merely because CLIMB may use permitted findings from that information to evaluate or improve the Services. Such information is treated as Product Feedback only when it is expressly submitted as Product Feedback through an applicable feedback process.

Participation in research, testing, a Guided Experience, a Contribution, community activity, or another Service does not, by itself, authorize CLIMB to publish or use your name, username, image, photograph, video, voice, likeness, testimonial, Maker Story, identifiable research response or experience, private response, creative work, or other material subject to separate permission for external advertising, publicity, social-media promotion, identifiable research publication, a Maker Spotlight, external presentation, merchandise, or another record-specific promotional use. Any such use remains subject to the applicable agreement or separate record-specific permission.

Product Feedback, research participation, testing, and Service-improvement processing do not, by themselves, grant CLIMB permission to use Member Content, private or protected information, or other material subject to separate permission to train or fine-tune an artificial-intelligence or machine-learning model. AI-assisted processing and any applicable model-training or fine-tuning permissions are governed by Section 7, the Terms of Service, applicable feature-specific notices, and any required separate permission.

If a research activity, pilot, preview, beta, or test feature involves a materially different category or purpose of personal-information processing for which applicable law requires additional disclosure, consent, authorization, or another legal basis, CLIMB will provide the applicable notice or obtain the required authorization before that processing begins.

If CLIMB later makes a research activity, Guided Experience, pilot, or test feature available to a youth participant, the applicable youth or family privacy notice, Additional Terms, parent or guardian authorization or consent, youth assent where appropriate, and age-appropriate safeguards will govern the applicable processing. Participation by a youth does not, by itself, authorize identifiable research publication, external advertising or publicity, or AI-model training or fine-tuning.

7. AI-Assisted Features

If CLIMB makes an AI-assisted feature available, CLIMB will provide any notice, choice, consent, or other authorization required for the applicable processing. General acceptance of this Privacy Policy does not, by itself, constitute consent to an optional AI-assisted feature or permission to use personal information, Member Content, or other material subject to separate permission to train or fine-tune an artificial-intelligence or machine-learning model.

AI-Assisted Service Processing. Depending on the feature, AI-assisted processing may be used to organize, summarize, classify, retrieve, analyze, or assist with drafting information; support navigation, routing, recommendations, resource discovery, or other functionality; or provide another purpose identified for the applicable feature. An AI-assisted feature may process information or instructions you intentionally submit to the feature, relevant information from the applicable Service where authorized for that feature, generated responses or outputs, interaction information, and feedback concerning the feature.

The use of information to provide an AI-assisted feature is distinct from using that information to train or fine-tune an AI or machine-learning model. Processing information to generate, organize, summarize, classify, retrieve, or recommend information for an applicable Service does not, by itself, constitute permission to use that information for model training or fine-tuning.

AI Providers. Where an AI or machine-learning provider processes personal information on CLIMB’s behalf to provide an AI-assisted feature, CLIMB may provide the information reasonably necessary for the applicable processing, subject to the Service, applicable notice, and contractual, confidentiality, privacy, security, and other restrictions applicable to that provider relationship. CLIMB will provide additional disclosure concerning provider processing where required by applicable law or appropriate for the applicable feature. Independent third-party AI services that you choose to access or use are governed by the applicable third party’s own terms and privacy practices as described in Sections 1 and 14.

Model Training and Fine-Tuning. CLIMB does not intentionally use Member Content, Maker Profiles, Maker Stories, private messages, applications, Guided Experience or other private Service responses, stated support needs, Contributions, material subject to separate permission, or information submitted through reporting, safety, copyright, privacy, urgent-removal, or other rights or safety processes to train or fine-tune a CLIMB or third-party generative-AI model without the applicable separate, informed permission.

Permission to participate in the Services, use an AI-assisted feature, submit a Contribution, participate in research or testing, provide Product Feedback, or accept the Terms of Service does not, by itself, authorize AI-model training or fine-tuning. Any record-specific permission for model training or fine-tuning applies only to the information, content, purpose, model use, and other scope identified in the applicable permission record.

CLIMB will not materially expand previously collected personal information or material subject to separate permission into AI-model training or fine-tuning solely through a general change to this Policy where applicable law, the Terms of Service, an applicable agreement, or CLIMB’s permission structure requires separate notice, consent, or permission for that use.

Automated Processing and Review. AI-assisted processing remains subject to the protections described in Section 4. Use of an AI-assisted feature does not alter CLIMB’s rules concerning access to non-public information or permit solely automated materially consequential protection decisions where review by authorized personnel or other safeguards are required by applicable policy or law.

Youth and Managed Services. If CLIMB later makes an AI-assisted feature available through a designated youth, teen, family, educational, library, nonprofit, organization-sponsored, or other managed Service, CLIMB will separately assess the processing before activation and apply the notices, age-appropriate safeguards, parent or guardian controls, organization-specific requirements, consent or authorization, and other protections required for the applicable Service and jurisdiction. Participation in a youth or managed Service does not, by itself, authorize AI-model training or fine-tuning involving the participant’s personal information or content.

8. How We Share Information

CLIMB may disclose personal information as described below and as otherwise disclosed in this Policy or at the time the applicable information is collected.

Other Members, Participants, and the Public. CLIMB may disclose personal information and Member Content to other members, participants, groups, or the public in accordance with the audience, visibility, participation, and Service settings applicable to the information, as further described in Section 5. A member’s selection of an audience or use of a sharing function does not expand any ownership, license, publicity, or other permission beyond the rights applicable to the content or information.

Service Providers. CLIMB may disclose personal information to vendors, consultants, contractors, and other service providers that process information on CLIMB’s behalf or require access to perform services for CLIMB, including where applicable hosting, infrastructure, storage, communications, analytics, security, support, technical operations, accessibility, legal, compliance, or other Service functions. CLIMB limits such disclosures to information reasonably necessary for the applicable function and subjects service-provider processing to applicable contractual, confidentiality, privacy, security, and other legally required restrictions. A service provider’s receipt or processing of Member Content or material subject to separate permission on CLIMB’s behalf does not expand the rights or permissions applicable to that material.

Connected Services and Authorized Integrations. If you intentionally connect, authorize, or direct CLIMB to interact with a third-party service, CLIMB may disclose information reasonably necessary to complete the connection, provide the requested functionality, or carry out your direction. A third party that processes information independently of CLIMB is subject to its own terms and privacy practices as described in Sections 1 and 14.

Transactions and Related Services. If CLIMB offers a paid or transactional Service and you initiate or participate in an applicable transaction, CLIMB may disclose information reasonably necessary to applicable payment, transaction, fulfillment, tax, fraud-prevention, compliance, or other providers involved in administering the transaction. The applicable checkout flow, Additional Terms, or feature-specific privacy notice may provide additional information concerning the disclosure before the transaction is completed.

Reports, Claims, Requests, Appeals, and Rights or Safety Processes. CLIMB may disclose limited personal information to a person whose rights, interests, content, account, or conduct are implicated by a report, complaint, copyright or intellectual-property notice, counter-notice, privacy request, appeal, dispute, urgent-removal request, safety matter, or other rights or safety process where the disclosure is reasonably necessary to administer the process and is permitted or required by applicable law. CLIMB may withhold or restrict information where disclosure would be unlawful, compromise security or an investigation, expose another person to risk, reveal information that should remain confidential, or otherwise be inappropriate under the applicable process.

Legal, Compliance, Security, and Safety Purposes. CLIMB may disclose personal information to law-enforcement agencies, courts, government or regulatory authorities, professional advisers, or other appropriate persons where disclosure is required or permitted by applicable law or where CLIMB reasonably believes disclosure is necessary to comply with legal process; establish, exercise, or defend legal rights; enforce the Terms of Service, Additional Terms, or applicable policies; investigate or address fraud, abuse, security incidents, or unlawful activity; protect the integrity or security of the Services; or protect the rights, property, safety, or security of CLIMB, members, other persons, or the public. CLIMB may also disclose information in an emergency where reasonably necessary and legally permitted to address a risk of serious harm.

Business Transactions. CLIMB may disclose or transfer personal information in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, corporate transaction, or transfer of all or part of CLIMB’s business, subject to applicable law and appropriate confidentiality or other protections where required.

At Your Direction or With Your Consent. CLIMB may disclose personal information when you direct CLIMB to do so, request a disclosure, or provide the applicable consent or authorization. A consent or permission applies only to the information, recipient, purpose, audience, channel, duration, or other scope identified in the applicable consent or permission record.

Aggregated and Deidentified Information. CLIMB may disclose aggregated or deidentified information that does not reasonably identify an individual. CLIMB will not intentionally attempt to re-identify information maintained as deidentified except as permitted by applicable law.

Nothing in this Section expands a Member Content license, Contribution permission, Maker Spotlight permission, testimonial permission, publicity or name-image-voice-likeness permission, external-marketing permission, event-recording permission, AI-model-training or fine-tuning permission, or other record-specific permission.

Disclosures involving cookies, analytics, advertising technologies, regulated sale or sharing of personal information, targeted advertising, or applicable opt-out preference signals are addressed in Section 9.

If CLIMB later activates a designated youth, teen, family, educational, library, nonprofit, organization-sponsored, or other managed Service, the applicable privacy notice and Service terms will identify any personal information disclosed to an authorized parent, guardian, school, library, sponsoring organization, program administrator, instructor, or other authorized person and the purposes of that disclosure. Participation in such a Service does not, by itself, authorize unrestricted disclosure of a youth participant’s personal information, content, communications, or material subject to separate permission.

9. Cookies, Analytics, Advertising, and Communications

Cookies and Similar Technologies. CLIMB and service providers acting on CLIMB’s behalf may use cookies, pixels, tags, local-storage technologies, and similar technologies in connection with the Services. Depending on the applicable technology and Service, these technologies may be used to authenticate users; maintain sessions; provide and secure the Services; prevent fraud or abuse; remember settings and preferences; understand use of the Services; diagnose errors or performance issues; perform analytics or measurement; and carry out other purposes disclosed in this Policy, the Cookie Policy, or the applicable consent or preference interface.

Some technologies may be necessary to provide, secure, or administer requested functionality. Other technologies may be subject to consent, opt-out, or other preference controls under applicable law. Where applicable law requires consent or another choice before a non-essential technology or processing activity is used, CLIMB will provide the applicable control. Restricting certain technologies may affect the availability or operation of some features.

Cookie and Privacy Choices. Additional information concerning the categories and purposes of cookies and similar technologies in use, applicable providers, retention information where available, and available choices is provided through CLIMB’s Cookie Policy and applicable consent or preference controls. CLIMB will maintain those disclosures and controls to reflect the technologies and processing activities to which they apply.

Analytics and Measurement. CLIMB may use analytics and measurement technologies to understand how the Services are accessed and used; measure performance, reliability, and engagement; evaluate features and communications; diagnose technical issues; prevent abuse; and improve the Services. Analytics processing may involve information described in Section 2, including device, browser, network, usage, event, cookie, consent-preference, and similar information. Where applicable law requires consent, an opt-out, or another control for analytics processing, CLIMB will provide the applicable choice.

Advertising and Regulated Processing. CLIMB may introduce advertising, promotional measurement, attribution, or related technologies or processing where permitted by applicable law and subject to the notices, choices, consent requirements, Additional Terms, or other controls applicable to the particular Service or processing activity.

If CLIMB processes personal information in a manner that constitutes a “sale” of personal information, “sharing” for cross-context behavioral advertising, targeted advertising, or another regulated advertising or data-use practice under applicable privacy law, CLIMB will provide the notices, opt-out methods, consent mechanisms, or other rights required by that law. The meaning and application of these terms depend on the applicable law and the processing activity involved.

Nothing in this Section constitutes permission to use Member Content, Maker Profiles, Contributions, Maker Stories, testimonials, name, image, voice, likeness, support information, or other material subject to separate permission for external advertising or promotional content where a separate agreement or record-specific permission is required under the Terms of Service or this Policy.

Opt-Out Preference Signals. Where applicable law requires CLIMB to recognize and process a qualifying browser- or device-based opt-out preference signal, CLIMB will process the signal as required by that law for the processing activities to which the signal legally applies. A browser “Do Not Track” setting and a legally recognized opt-out preference signal are not necessarily the same. CLIMB’s treatment of browser or device signals is subject to applicable law, the processing activity involved, and the controls made available through the Services.

Service and Administrative Communications. CLIMB may send communications reasonably necessary to provide, administer, protect, or support the Services, including account and authentication messages; technical notices; security alerts; privacy and legal notices; safety communications; support and accessibility communications; Guided Experience or participation communications; research-related communications; transaction-related communications where an applicable transaction exists; and other administrative or Service-related messages.

Promotional Communications. CLIMB may send promotional or marketing communications where permitted by applicable law and consistent with the applicable communication preferences or consent. Creating an account, accepting the Terms of Service, acknowledging the CLIMB Maker Trust Pledge, participating in a Guided Experience, submitting a Contribution, granting a content or publicity permission, or participating in research does not, by itself, constitute consent to receive marketing communications where separate consent is required.

You may use the unsubscribe mechanism or other available communication preference controls to stop receiving applicable promotional communications. Withdrawing from promotional communications does not close your account, withdraw a Contribution or content permission, or prevent CLIMB from sending non-promotional communications reasonably necessary concerning your account, security, safety, legal rights or obligations, an active Service, a transaction, or another administrative matter.

If CLIMB later activates text messaging, mobile push notifications, or another communication channel requiring additional notice or consent, CLIMB will provide the applicable notice and obtain any authorization required before using that channel for the applicable purpose.

Youth and Managed Services. If CLIMB later activates a designated youth, teen, family, educational, library, nonprofit, organization-sponsored, or other managed Service, CLIMB will evaluate the cookies, analytics, advertising, embedded content, communications, and other third-party technologies used for that Service before activation. The applicable technologies may be disabled, limited, configured for permitted Service operations, delayed until required authorization or consent is obtained, or subject to additional age-appropriate notices, controls, retention requirements, and disclosure restrictions. Adult consent or preference settings will not automatically be treated as sufficient for a youth Service where different requirements apply.

10. Data Retention and Deletion

CLIMB retains personal information for as long as reasonably necessary for the purposes for which it was collected or otherwise processed, to provide or administer the applicable Services, and for other purposes permitted or required under this Policy or applicable law. Retention periods may vary according to the category of information, the applicable Service, and the circumstances in which the information was collected or generated.

Retention Criteria. In determining how long to retain personal information, CLIMB may consider the purpose for which the information was collected or generated; whether an account, Service, transaction, Contribution, permission, request, dispute, or other relationship remains active; the nature and sensitivity of the information; applicable member choices; operational, security, fraud-prevention, abuse-prevention, safety, audit, and recordkeeping needs; applicable limitation periods; and legal, regulatory, contractual, tax, accounting, evidentiary, or other requirements. Where personal information is no longer reasonably necessary for an applicable purpose, CLIMB may delete, deidentify, aggregate, or otherwise restrict the information as appropriate and permitted by law.

Account, Profile, and Service Information. Account, authentication, Maker Profile, navigation, participation, progress, recommendation, routing, community, messaging, Guided Experience, support, referral, waitlist, research, and similar Service information may be retained while reasonably necessary to maintain the account, provide the applicable Service, preserve Service continuity, respond to requests, or satisfy another purpose described in this Policy. Different categories of information associated with the same account may have different retention periods.

Member Content and Contributions. Removal of Member Content from public or member-facing availability does not necessarily result in immediate deletion of every copy or related record. Contributions may also be subject to the applicable Contribution and Publication Agreement, recorded audience, withdrawal terms, prior distribution, and other applicable rights. CLIMB may retain content or related records where reasonably necessary and legally permitted for backups, copyright or intellectual-property matters, moderation or appeals, safety, fraud prevention, disputes, evidence preservation, legal compliance, or another purpose described in this Policy. Copies retained independently by other members, recipients, search engines, or third parties may remain outside CLIMB’s possession or control.

Acceptance, Consent, and Permission Records. CLIMB may retain records of acceptance of the Terms of Service or Additional Terms and records concerning consent, authorization, assent, Contribution publication, Maker Spotlights, testimonials, publicity, name-image-voice-likeness use, event recording, external marketing, AI-model training or fine-tuning, communication preferences, and other record-specific permissions. These records may include the applicable document or permission version, scope, date, status, withdrawal or revocation, and related evidence reasonably necessary to establish what was accepted, authorized, declined, changed, or withdrawn. Retention of a historical permission or consent record does not expand the permission or authorize continued use after the permission has ended or been withdrawn to the extent the applicable agreement, permission, or law requires the use to stop.

Rights, Safety, Legal, and Request Records. CLIMB may retain reports, moderation and enforcement records, appeals, copyright notices and counter-notices, urgent image-removal requests, safety and security records, fraud or abuse records, privacy requests, accessibility requests, disputes, investigations, and related correspondence or evidence for as long as reasonably necessary to administer the applicable process; protect persons or the Services; prevent repeated abuse or circumvention; establish, exercise, or defend legal rights; preserve evidence; comply with law; or satisfy other legitimate recordkeeping requirements. Access to retained non-public records remains subject to the access limitations described in Section 4.

Analytics, Technical, and Security Records. Usage, analytics, diagnostic, consent-preference, log, security, and similar technical information may be retained for periods appropriate to the applicable operational, analytics, security, fraud-prevention, troubleshooting, compliance, or measurement purpose. Applicable cookie or technology-specific retention information may also be provided through the Cookie Policy or consent and preference controls where appropriate.

Transactions. If CLIMB offers a paid or transactional Service, transaction, billing, payment-status, refund, cancellation, fulfillment, tax, accounting, fraud-prevention, and related records may be retained for the periods reasonably necessary for the transaction and applicable financial, accounting, tax, dispute, fraud-prevention, legal, or regulatory requirements.

Account Closure and Privacy Deletion. Account closure, removal or deletion of Member Content, withdrawal of a Contribution, withdrawal or revocation of a record-specific permission, and deletion of personal information under an applicable privacy right are separate actions and may have different consequences. Closing an account does not automatically require deletion of every record associated with the account, and deleting personal information does not require CLIMB to delete information that applicable law permits or requires CLIMB to retain. Privacy deletion rights and applicable exceptions are addressed further in Section 11.

Backups and Technical Copies. Personal information may remain temporarily in backups, archives, logs, or other technical copies after information is removed from active systems. Such information may be retained subject to applicable backup, security, legal, and recordkeeping requirements and deleted, overwritten, deidentified, or otherwise disposed of in accordance with the applicable retention process when the reason for retention ends.

Deidentified and Aggregated Information. CLIMB may retain aggregated or deidentified information for longer periods where the information no longer reasonably identifies an individual. CLIMB will not intentionally attempt to re-identify information maintained as deidentified except as permitted by applicable law.

Youth and Managed Services. If CLIMB later activates a designated youth, teen, family, educational, library, nonprofit, organization-sponsored, or other managed Service, CLIMB will establish retention and deletion criteria appropriate to the activated Service and applicable law. Those criteria may address age-screening or age-assurance records; parent or guardian information; authorization, consent, assent, and withdrawal records; youth profiles and content; Guided Experience and participation information; messages; safety and moderation records; permissions; school or organization records; transaction information where applicable; analytics and security information; backups; and account-transition records. Exact retention periods will be established for the applicable Service where required and will not be inferred solely from the adult-account retention framework.

11. Your Rights and Choices

Depending on your location, the personal information involved, the applicable Service, and applicable law, you may have certain rights concerning personal information that CLIMB processes about you. These rights may include the rights described below.

Access and Copies. You may have the right to request confirmation of whether CLIMB processes personal information about you, access that information, obtain information concerning the processing, or receive a copy of personal information subject to the request.

Correction. You may have the right to request correction of inaccurate personal information. Some account or profile information may also be corrected directly through available account settings.

Deletion. You may have the right to request deletion of personal information, subject to applicable exceptions and retention rights. A privacy deletion request is distinct from account closure, removal of Member Content, withdrawal of a Contribution, or withdrawal or revocation of a record-specific permission, as further described in Sections 5 and 10. You may request account deletion through any account-deletion control CLIMB makes available or through the privacy-request methods identified below. Closing an account does not necessarily require deletion of information that CLIMB is permitted or required to retain under Section 10.

Portability. Where applicable law provides a portability right, you may have the right to receive certain personal information in a portable and, where required, technically usable format.

Consent and Permission Choices. Where CLIMB processes personal information based on consent, you may have the right to withdraw that consent. Withdrawal applies prospectively and does not affect processing lawfully conducted before withdrawal. Withdrawal of privacy consent is distinct from withdrawal of a Contribution, publicity permission, AI-model-training permission, marketing consent, or another record-specific authorization, each of which is governed by the applicable agreement, permission record, or Service process.

Objection and Restriction. Where applicable law provides these rights, you may have the right to object to or request restriction of certain processing, including processing based on particular legal grounds or certain profiling or automated processing.

Advertising and Sensitive-Information Rights. Where CLIMB engages in processing subject to applicable sale, sharing, targeted-advertising, profiling, sensitive-information, or similar privacy-law rights, you may have the applicable right to opt out, limit processing, withdraw consent, or exercise another choice provided by law. Additional information concerning cookies, advertising, preference signals, and related controls is provided in Section 9 and the Cookie Policy.

Available Account and Service Controls. Depending on the Services and functionality available to you, you may be able to manage certain profile information, visibility or audience settings, account settings, notifications, marketing preferences, cookie choices, connected services, and other available preferences directly through the Services. Use of these settings does not limit any additional privacy right available under applicable law.

How to Submit a Privacy Request. Privacy questions and requests to exercise applicable privacy rights may be submitted to:

CLIMB Crafts LLC

1870 The Exchange SE Ste 220, PMB 829798

Atlanta, GA 30339-2171

United States

Email: support@climbcrafts.org

Where CLIMB provides a dedicated privacy-request or account-deletion control through the Services, you may also use that control for the requests it supports.

Verification. CLIMB may take reasonable steps to verify your identity, account ownership, authority, or the authenticity of a privacy request before fulfilling the request. Verification may include use of an authenticated account, confirmation through the email address associated with an account, or additional information reasonably necessary based on the nature, sensitivity, and risk of the request. CLIMB will not request more verification information than reasonably necessary for the applicable verification purpose. If CLIMB cannot reasonably verify a request, CLIMB may request additional information, limit the information disclosed, or decline the request to the extent permitted by applicable law.

Authorized Agents. Where applicable law permits another person to submit a request on your behalf, an authorized agent may submit the request using the applicable privacy-request method. CLIMB may require written authorization, proof of the agent’s authority, identity verification, or direct confirmation from you unless applicable law provides otherwise. Different requirements may apply to a legally authorized representative acting under a power of attorney, guardianship, or other legally recognized authority.

Appeals. If CLIMB denies a privacy request and applicable law provides a right to appeal, CLIMB’s response will explain the basis for the decision and the applicable appeal process. Unless a different method is provided in the response, you may submit an appeal by replying to the denial or by emailing support@climbcrafts.org with “Privacy Appeal” in the subject line and identifying the request being appealed. Any deadline or other appeal requirement imposed by applicable law will apply; this Policy does not establish a shorter appeal period.

Nondiscrimination. CLIMB will not unlawfully discriminate or retaliate against you for exercising a privacy right available under applicable law. This does not prohibit differences in Services, functionality, or treatment that are reasonably related to the information necessary to provide a requested Service or otherwise permitted by law.

Youth, Parent, Guardian, and Managed-Service Rights. If CLIMB later activates a designated youth, teen, family, educational, library, nonprofit, organization-sponsored, or other managed Service, the applicable privacy notice will describe the rights and controls available for that Service. Depending on applicable law and the Service, an authorized parent or guardian may have rights to receive notice; review, access, or correct a participant’s personal information; request deletion; withdraw consent or authorization; prevent further collection or processing; manage applicable visibility or communication settings; review permissions; or close a managed profile.

A youth or teenager may also have privacy rights exercisable directly by that individual under applicable law. Privacy rights concerning a youth participant may therefore be exercisable by the participant, a parent or guardian, or another legally authorized person depending on the applicable law, the nature of the information, and the Service involved. CLIMB will not treat parent or guardian authority as automatically superseding rights that applicable law grants directly to the youth participant.

12. Security

CLIMB uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized or unlawful access, acquisition, use, disclosure, alteration, loss, destruction, or other misuse. Safeguards may vary based on the nature and sensitivity of the personal information, the applicable Service and processing activity, reasonably foreseeable risks, and applicable legal requirements.

Access to non-public personal information is limited to authorized CLIMB personnel and service providers acting on CLIMB’s behalf where access is reasonably necessary for an authorized purpose. Such access is subject to the role, purpose, legitimate-need, confidentiality, security, and other limitations described in this Policy, including Section 4.

CLIMB may use vendors, contractors, and other service providers to host, store, transmit, secure, support, or otherwise process personal information on CLIMB’s behalf. As applicable to the provider relationship and processing involved, CLIMB requires appropriate contractual, confidentiality, privacy, security, or other restrictions designed to protect the personal information processed on CLIMB’s behalf. A service provider’s access to information does not expand any Member Content or record-specific permission.

If CLIMB identifies or reasonably suspects a security incident involving personal information, CLIMB may investigate the incident; take reasonable measures to contain, mitigate, remediate, or prevent further harm; preserve information reasonably necessary for security, evidentiary, or legal purposes; coordinate with applicable service providers or other appropriate persons; and provide notifications to affected individuals, regulators, law-enforcement authorities, or others where required or permitted by applicable law.

No security measure, information system, website, application, method of electronic transmission, or method of storage can be guaranteed to be completely secure. Accordingly, although CLIMB uses safeguards designed to protect personal information, CLIMB cannot guarantee that unauthorized access, disclosure, alteration, loss, or other security incidents will never occur.

You are responsible for maintaining the confidentiality and security of your account credentials as provided in the Terms of Service. If you believe your CLIMB account or credentials have been compromised or that personal information associated with your account may have been accessed without authorization, you should notify CLIMB through the applicable support or security-reporting method made available through the Services.

If CLIMB later activates a Service involving categories of personal information or participants that require additional security protections, including a designated youth, family, educational, organization-sponsored, transactional, or other higher-risk Service, CLIMB may apply additional access restrictions, safeguards, notices, procedures, or Service-specific requirements appropriate to the applicable processing and law before or in connection with activation of that Service.

13. Children’s and Teen Privacy

Current Account Availability. CLIMB’s current independent adult-account registration process is available only to persons who satisfy the eligibility and legal-capacity requirements applicable to an independent adult account under the Terms of Service. Until CLIMB activates an applicable youth participation pathway, a minor may not independently register through the adult-account process or misrepresent age, identity, or eligibility to obtain an adult account.

This limitation on the current adult-account process does not mean that CLIMB is permanently unavailable to children or teenagers. CLIMB may make designated youth, teen, family, educational, library, nonprofit, organization-sponsored, or other age-appropriate Services available in the future subject to the applicable Additional Terms, privacy notices, parent or guardian authorization or consent, youth assent where appropriate, organizational authorization where legally permitted, and other safeguards required for the applicable Service.

The availability of a public tutorial, resource, informational page, or other content that can be viewed without registration does not mean that a youth account or youth member Service is available. This Privacy Policy may apply to information collected from visitors to public portions of the Services regardless of whether the visitor maintains an account.

Information About Minors Submitted Through Adult Services. CLIMB may receive personal information or Member Content involving a minor from an adult member or another person as described in Section 2, including photographs, video, audio, project information, stories, collaboration information, reports, safety information, or other content involving the minor. A person submitting such information must have the authority, rights, consents, or other permissions required for the applicable submission and use.

Submission of information involving a minor does not, by itself, authorize CLIMB to use the minor’s name, image, photograph, video, voice, likeness, creative work, project, testimonial, Maker Story, school or organization affiliation, identifiable participation, or other personal information for a Maker Spotlight, external advertising, publicity, social media promotion, event recording, merchandise, AI-model training or fine-tuning, or another use requiring separate permission.

Future Youth, Family, and Managed Services. Before collecting personal information through a designated youth or managed-participation pathway, CLIMB will provide the privacy notice and obtain the authorization, consent, or other legal basis required for the applicable Service and jurisdiction. An applicable Children’s and Teen Privacy Notice or other feature-specific notice may supplement this Policy and will identify the categories of information actually collected, the purposes of processing, the applicable participants and account relationships, the available features and settings, disclosures, retention criteria, rights, and request procedures.

Depending on the activated Service, youth participation may involve a parent- or guardian-managed profile, family participation, teen participation, school or library participation, organization-sponsored participation, or another age-appropriate structure. CLIMB will not treat the existence of a parent, guardian, school, library, nonprofit, instructor, or sponsoring organization as blanket authority for every collection, disclosure, publication, transaction, communication, publicity use, or other processing activity.

Children Under 13. If the Children’s Online Privacy Protection Act and its implementing Rule apply to a CLIMB Service involving a child under 13, CLIMB will provide the notices required by law and obtain verifiable parental consent before collecting, using, or disclosing the child’s personal information unless an applicable exception permits the processing without prior parental consent.

Where applicable law requires separate parental consent for a disclosure to a third party or another processing activity, CLIMB will obtain the required separate consent. CLIMB will also provide the parent or guardian with the applicable rights concerning review, access, deletion, withdrawal of consent, prevention of further collection or use, data minimization, retention, and security.

CLIMB may use age screening, age assurance, or other eligibility measures where reasonably necessary for an applicable Service. Information collected for age or eligibility purposes will be processed in accordance with this Policy, the applicable youth notice, and applicable law and will not, by itself, authorize an unrelated use.

Teen Privacy. CLIMB will not assume that a participant who is 13 or older is outside all child- or teen-specific privacy requirements. If CLIMB activates a teen Service, the applicable privacy and participation framework may address contractual capacity, parent or guardian involvement, sensitive information, visibility and public content, messaging, location information, advertising, profiling, automated processing, purchases, safety, moderation, age-appropriate design, and other requirements applicable to the Service and jurisdiction.

A teenager may have privacy rights exercisable directly by the teenager under applicable law. Parent or guardian involvement does not automatically eliminate rights that applicable law grants directly to the teen participant.

School, Library, and Organization-Sponsored Participation. Where applicable law permits a school to authorize the collection of a child’s personal information on behalf of a parent for a school-authorized educational purpose, CLIMB will rely on that authorization only within the scope permitted by law and the applicable educational relationship. School authorization will not be treated as authorization for an unrelated commercial, advertising, publicity, or promotional use.

A library, nonprofit, instructor, community organization, or other sponsoring organization will not automatically be treated as having the same authority as a parent, guardian, or school. Before an applicable sponsored Service is activated, CLIMB and the sponsoring organization will determine the privacy roles, authorization structure, notices, participant rights, data uses, and other requirements applicable to that Service.

Age-Appropriate Features and Privacy Controls. If CLIMB activates a youth or teen Service, CLIMB may establish different features, defaults, settings, or safeguards based on age, developmental considerations, jurisdiction, risk, account or participation type, and the nature of the Service. These may include age-appropriate treatment of profile and search visibility, public content, messaging and communications, groups and connections, contact or location information, external links and downloads, personalization and recommendations, cookies and analytics, advertising, transactions, AI-assisted processing, retention, and other features.

The particular features and controls available to an activated youth Service will be identified through the applicable Service and privacy notices. Nothing in this Policy represents that a particular youth feature is currently available or permanently prohibits CLIMB from offering a lawful youth feature later under appropriate terms, permissions, notices, and safeguards.

Youth Content, Publicity, Research, and AI. Participation in a youth, family, educational, or sponsored Service does not, by itself, authorize external advertising or publicity, a Maker Spotlight, testimonial use, external social-media promotion, identifiable research publication, event recording, name-image-voice-likeness use, AI-model training or fine-tuning, or another materially different use of a youth participant’s information or content.

Any separate permission required for such a use will identify the applicable content, purpose, audience, channel, or other scope. Where applicable law or the nature of the use requires parent or guardian authorization, youth assent, or both, CLIMB will obtain the legally appropriate authorization before the use begins. General parent or guardian authorization for participation will not be treated as blanket permission for these separate uses.

Youth Transactions and Communications. If CLIMB later offers a paid youth, family, educational, or sponsored Service, applicable purchase, payment, cancellation, refund, fulfillment, and privacy information will be presented before the applicable transaction. A parent, guardian, school, library, sponsoring organization, or other authorized payer may be required to authorize or complete the transaction where applicable. Participation in a free youth or family Service does not authorize a later charge. Marketing communication consent remains separate from participation, account management, content permissions, and transaction authorization as described in Section 9.

Retention, Rights, and Withdrawal. Youth personal information will be subject to the retention and deletion principles described in Section 10 and to any additional youth-specific requirements applicable to the Service. Youth-specific retention may distinguish among account or profile closure, removal of child-created content, parent-requested deletion, consent withdrawal, permission withdrawal, restricted safety or moderation records, legal preservation, consent evidence, backups, and copies retained independently by other persons.

The rights available to parents, guardians, youth participants, and legally authorized representatives are addressed in Section 11 and any applicable Children’s and Teen Privacy Notice. Depending on applicable law, these rights may include access, correction, deletion, withdrawal of consent or authorization, prevention of future collection, management of visibility or communications, review of child-created content or permissions, account or profile closure, and other rights provided by law.

Transition to Independent Account Control. If CLIMB later permits a managed youth profile or youth account to transition to independent adult control, the participant must satisfy the then-applicable eligibility and legal-capacity requirements and independently accept the then-current adult Terms of Service before independent adult-account control begins. A parent’s, guardian’s, school’s, library’s, or organization’s prior acceptance will not automatically become the participant’s acceptance of the adult Terms.

A transition may result in updated privacy choices, changes in account control, or changes in parent, guardian, or organization access. Historical content, consent records, and permissions will remain governed by their recorded scope. Transition does not automatically expand, renew, or replace a prior Contribution, publicity, likeness, event-recording, external-marketing, or AI permission.

International Youth Participation. Before CLIMB activates a youth or teen Service for participants in a jurisdiction with additional children’s or teen privacy requirements, CLIMB will evaluate and apply the requirements applicable to the Service and jurisdiction. These requirements may include age-appropriate design, age or consent verification, parental responsibility, privacy defaults, data minimization, profiling and advertising restrictions, geolocation controls, automated-processing requirements, international-transfer safeguards, and rights exercisable directly by a youth participant.

14. Third-Party Services and International Data Transfers

Third-Party Services. The Services may contain links to, integrations with, embedded content from, or functionality provided in connection with third-party websites, applications, platforms, resources, or services. Where a third party processes personal information independently of CLIMB, that processing is governed by the third party’s own terms, privacy policy, notices, settings, and practices. CLIMB does not control and is not responsible for the independent privacy practices of third parties.

A third party that processes personal information on CLIMB’s behalf as a vendor, contractor, or other service provider is subject to the service-provider framework described in Sections 1, 8, and 12. A service provider’s processing on CLIMB’s behalf does not become an independent permission to use Member Content or other material subject to separate permission for unrelated purposes.

If you intentionally connect, authorize, or interact with a third-party service through the Services, personal information may be transmitted to or received from that third party as reasonably necessary for the applicable connection, functionality, or direction. Information that CLIMB receives and processes from the interaction remains subject to this Policy as described in Section 1.

International Processing and Transfers. CLIMB Crafts LLC is based in the United States. Personal information may be transferred to, stored in, accessed from, or otherwise processed in the United States and in other jurisdictions where CLIMB or applicable service providers process information in connection with the Services. Privacy and data-protection laws in those jurisdictions may differ from the laws of the jurisdiction in which you reside.

Where applicable law requires a particular lawful basis, transfer mechanism, contractual protection, technical or organizational safeguard, assessment, notice, or other measure for an international transfer of personal information, CLIMB will use an appropriate lawful mechanism or safeguard applicable to the transfer.

CLIMB will not identify a particular international transfer mechanism, adequacy determination, certification, regional representative, or similar arrangement in this Policy unless that mechanism or arrangement applies to CLIMB’s actual processing activities.

Regional Privacy Requirements. If CLIMB offers or operates Services in a jurisdiction that requires additional privacy disclosures or rights, CLIMB may provide a regional privacy notice or other supplemental disclosure. Depending on the applicable law and processing activity, such a notice may address the legal bases for processing; contractual necessity; legitimate interests; legal obligations; consent; rights to object to or restrict processing; sensitive or specially protected information; profiling or automated processing; complaint rights before a privacy or data-protection authority; international-transfer safeguards; and any legally required local or regional representative. A regional notice applies only to the processing and persons within its stated scope and supplements this Policy as described in Section 1.

International Youth and Managed Services. Before CLIMB activates a designated youth, teen, family, educational, library, nonprofit, organization-sponsored, or other managed Service for participants in a jurisdiction with additional children’s or teen privacy requirements, CLIMB will evaluate the applicable regional requirements, including any requirements concerning data transfers, privacy defaults, consent or parental responsibility, age assurance, profiling, advertising, geolocation, automated processing, data minimization, retention, or regional representation. The applicable youth or regional notice will provide additional information where required.

15. Changes to This Privacy Policy

CLIMB may revise this Privacy Policy from time to time to reflect changes in the Services, personal-information processing, legal or regulatory requirements, or other developments relevant to this Policy. The published Policy will identify its applicable effective date, last-updated date, or both.

For revisions that do not materially affect the processing of personal information or your rights, CLIMB may provide notice by publishing the revised Policy and updating the applicable date.

If CLIMB makes a material change to this Policy, CLIMB will provide any additional notice required by applicable law or otherwise reasonably appropriate under the circumstances. Depending on the nature of the change and the applicable Service, notice may be provided through the Services, by email or another available communication method, through a prominent notice, or through another legally sufficient method.

Where a change introduces a materially different processing purpose or otherwise affects processing for which applicable law requires consent, authorization, or another affirmative choice, CLIMB will obtain the required consent, authorization, or choice before beginning the applicable new processing. Continued access to or use of the Services does not substitute for affirmative consent where affirmative consent is required by applicable law.

A revision to this Privacy Policy does not, by itself, expand a Member Content license, Contribution publication permission, Maker Spotlight permission, testimonial permission, publicity or name-image-voice-likeness permission, external-marketing permission, event-recording permission, AI-model-training or fine-tuning permission, or any other record-specific permission. Any materially different use requiring a separate agreement, permission, notice, or consent remains subject to that requirement.

Feature-specific or regional privacy notices may be revised separately and may identify their own effective or last-updated dates. Where a more specific notice governs particular processing, the relationship between that notice and this Policy remains as described in Section 1.

CLIMB may preserve prior versions of this Policy, applicable dates, notices of material changes, consent or authorization records, and related information for legal, compliance, audit, evidentiary, or recordkeeping purposes as described in Section 10.

16. Contact Us and Additional Privacy Notices

Contact Us. CLIMB Crafts LLC is responsible for personal information processed under this Policy where CLIMB determines the purposes and means of the applicable processing as described in Section 1.

Questions concerning this Privacy Policy or CLIMB’s privacy practices may be directed to:

CLIMB Crafts LLC

1870 The Exchange SE Ste 220, PMB 829798

Atlanta, GA 30339-2171

United States

Website: https://climbcrafts.org

Email: support@climbcrafts.org

Telephone: +1 (404) 808-2531

Requests to exercise applicable privacy rights, including applicable requests concerning access, correction, deletion, portability, authorized agents, or appeals, may be submitted through the methods described in Section 11 or through any dedicated privacy-request control CLIMB makes available for the applicable request.

Other matters, including copyright or intellectual-property complaints, safety reports, urgent image-removal requests, accessibility concerns, account-security concerns, or other specialized requests, may be subject to a separate reporting or request process identified through the applicable Service, policy, notice, or CLIMB Trust and Legal resources. Use of the general privacy contact does not replace a specialized process where applicable law or the applicable CLIMB process requires particular information or procedures.

Additional Privacy Notices. Additional or feature-specific privacy notices may apply to particular Services, participants, jurisdictions, or processing activities. Where applicable and made available, these notices may include:

• the Maker Profile & Personalized Guidance Privacy Notice;
• the Community Content & Communications Privacy Notice;
• the Guided CLIMB Experience Privacy Notice;
• the Campaigns, Waitlists & Opportunities Privacy Notice;
• the Trust, Safety, Reporting & Moderation Privacy Notice;
• the CLIMB Crafts Mobile App Privacy Summary;
• a Children’s and Teen Privacy Notice or other youth, family, educational, library, nonprofit, organization-sponsored, or managed-Service privacy notice;
• an applicable regional privacy notice; and
• a notice applicable to an AI-assisted feature or other Service requiring additional processing disclosure.

A supplemental or feature-specific privacy notice applies only to the Service, processing activity, participant relationship, or jurisdiction it identifies. Where the notice addresses particular processing more specifically than this Policy, the relationship between that notice and this Policy is governed by Section 1.

A privacy notice describes the processing applicable to the activity it addresses. It does not, by itself, expand a Member Content license or constitute a Contribution-publication permission, Maker Spotlight permission, testimonial permission, publicity or name-image-voice-likeness permission, external-marketing permission, event-recording permission, AI-model-training or fine-tuning permission, marketing-communication consent, or another record-specific authorization.

Where an applicable Service requires separate consent, authorization, assent, Additional Terms, or a record-specific permission, CLIMB will obtain or present that separate authorization through the applicable process rather than treating acknowledgment of this Privacy Policy or a supplemental privacy notice as the required permission.