Effective: August 28, 2026

Last updated: August 28, 2026

This Privacy Policy explains how CU Media Corp. ("CU," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you use the CU mobile application, website, and related services (the "Service"). CU is designed to help friends make plans, coordinate arrivals, temporarily share event-related location, communicate, invite others, and create and share memories from real-world activities.

1. Scope and Who We Are

CU Media Corp. operates CU and is responsible for the personal information described in this Privacy Policy, subject to applicable law. This Policy applies to information processed through the CU mobile app, CU-controlled websites and webpages, account and support interactions, safety and moderation processes, marketing subscriptions, and related services.

CU Media Corp. has designated a Privacy Officer to oversee privacy compliance and respond to privacy questions, access or correction requests, deletion requests, withdrawals of consent, and complaints. The Privacy Officer can be contacted at support@cuitup.com.

This Policy does not apply to third-party services that are not acting on CU's behalf, even if CU links to, embeds, or interoperates with them.

2. Age Requirement

CU is intended only for people who are at least 16 years old. You may not create an account or use the Service if you are under 16. If you are 16 or older but under the age of majority where you live, you may use CU only with parent or guardian consent where required by applicable law.

We may request an age, date of birth, age-range declaration, or similar eligibility confirmation where reasonably necessary to enforce age restrictions, protect users, or comply with legal or platform requirements. If we learn that a person under 16 has created an account or provided personal information, we may restrict or delete the account and associated information, subject to legal, safety, security, abuse-prevention, child-protection, and evidence-preservation requirements.

CU does not knowingly collect personal information from children under 13 and is not directed to children. If you believe a child under 13 has provided personal information to CU, contact support@cuitup.com and we will take appropriate steps to delete it.

2.1 Age Signals and Parental Consent From App Stores

Some jurisdictions require app stores to collect age-category information and, for minors, parental consent, and require app developers to receive and act on that information. Where an app store provides CU with an age category or a parental-consent status for your account, CU uses that information only to determine eligibility and appropriate experiences, to comply with legal obligations, and to support safety features. CU does not use app-store age or consent signals for advertising or profiling, and deletes or de-identifies them once they are no longer needed for those purposes.

Where required, CU assigns an age rating to the app and notifies app stores of material changes to the Service, these policies, or monetization features so that parental consent can be confirmed or renewed.

2.2 Additional Protections for Users Aged 16 and 17

Users aged 16 and 17 are minors under our Child Safety Standards. For accounts CU knows or reasonably believes belong to a user under 18, CU does not sell or share personal information, does not use personal information for targeted or cross-context behavioural advertising, does not use precise location for advertising purposes, keeps event location sharing off unless the user turns it on for a specific event, and prioritizes reports involving minors for safety review.

3. Information We Collect

The information we collect depends on how you use CU, the features you interact with, and the device permissions you choose to grant.

3.1 Account, Profile, and Authentication Information

• Name, username, display name, email address, profile photo, and other profile details you choose to provide.

• Password credentials in protected or hashed form, authentication tokens, session information, account-security information, and, if CU offers third-party sign-in, limited authentication identifiers received from the sign-in provider.

• Age, date of birth, age range, or other eligibility information if CU requests it to confirm that you meet the minimum age requirement, and any age category or parental-consent status provided by an app store.

• Account settings, privacy and notification choices, blocked-user information, support requests, and communications with CU.

3.2 Friends, Groups, Plans, Events, and Invitations

• Friend requests, friend lists, group names and membership, invitation activity, RSVP or join status, host and attendee status, and related connection information.

• Plans or events you create, join, host, are invited to, or invite others to, including title, description, date, time, location, invited users, attendee status, participation activity, and related metadata.

• Information needed to support invitations to people who do not yet use CU, such as a phone number or email address selected by a user, the inviter, invite link, delivery or referral information, and whether the link was opened or used.

3.3 Location and Map Information

• Approximate location, such as IP-based region, for security, service operation, fraud prevention, analytics, or legal compliance.

• Precise device location when you grant the relevant device permission and use or enable a CU feature that requires precise location.

• Precise device location collected while the CU app is running in the background, but only while you have event location sharing turned on for a specific plan or event and only during that event's active sharing window. This is described in more detail in Section 6.

• Event-related location information, including map display, arrival status, and signals used to indicate whether a participating friend appears to be on the way, late, nearby, or arriving.

• Map searches, place selections, addresses, coordinates, distance or route-related information, and venue details used to display plans, event markers, or location-based features.

Precise geolocation is treated as sensitive personal information under some laws. See Section 9 for how CU handles sensitive personal information.

3.4 Photos, Videos, Stories, Chat, and Other User Content

• Photos, videos, captions, thumbnails, messages, comments, reactions, event media, stories, profile content, plan or Card content, and other content you create, upload, send, store, or share through CU.

• Camera, microphone, and photo-library information only when you grant permission and use a feature that requires it, such as capturing, selecting, or posting media.

• Content and surrounding context associated with reports, support requests, safety reviews, moderation decisions, appeals, or enforcement actions.

CU does not collect, capture, scan, or store biometric identifiers or biometric information, such as faceprints, voiceprints, retina or iris scans, or fingerprints, and does not use facial recognition to identify people in photos or videos. CU does not use your User Content to train generative artificial-intelligence models, and does not license your User Content to third parties for that purpose.

3.5 Contacts, Invitations, and Non-User Information

If you choose to use contact selection, friend-finding, or invitation features, CU processes only the specific contacts you select or authorize for that purpose. CU does not upload, copy, or store your entire address book, and does not use your contacts to build profiles, suggest unrelated connections, or send marketing. CU processes a selected contact's name, phone number, or email address only for the purpose of finding or inviting that person, and retains it only as long as reasonably necessary to deliver and attribute the invitation, prevent abuse, and meet legal obligations.

CU does not use non-user contact information for advertising or marketing. When an invitation is sent through CU, we may process information necessary to deliver, attribute, secure, and troubleshoot the invitation and to prevent spam, fraud, or abuse. Invitations sent through CU identify the CU user who initiated them. Users must only invite people they know or otherwise have a reasonable and lawful basis to contact.

If you received an invitation from CU and do not want to be contacted again, you may follow the opt-out instructions in the message or contact support@cuitup.com to request that your contact information be suppressed.

3.6 Calendar, Device Permissions, Notifications, and Sharing Tools

• Calendar-export information, such as plan or event title, date, time, location, and CU link, when you choose to export a CU plan or event to your device calendar. CU does not read your existing calendar entries in order to export a CU event.

• Device permission status for location, background location, camera, microphone, photos, contacts, calendar, and notifications, where applicable.

• Push-notification tokens, notification preferences, delivery status, and related information used for account, invitation, plan, event, safety, and service notifications.

• Information generated when you use your operating system's sharing tools or other device features to share CU content externally.

3.7 Website, Newsletter, Support, and Marketing Information

• Information you provide through CU-controlled websites, including first and last name, email address, newsletter or launch-update subscription preferences, and related form information.

• Records reasonably necessary to document marketing consent and unsubscribe choices, such as the date, source, and status of a subscription.

• Information you provide when contacting CU, including the content of your message, attachments you choose to send, and information reasonably necessary to respond to your request.

3.8 Spin the Wheel and Interactive Feature Data

• Prompts, wheel settings, participants, timing, results, and the associated plan or event.

• Photos, videos, recordings, captions, reactions, or other content you choose to create or share through an interactive feature.

• Safety, abuse-prevention, troubleshooting, and support information related to interactive features.

3.9 Technical, Analytics, Crash, and Security Information

• Device type, operating system, app version, browser type, IP address, language, time zone, device or app identifiers, diagnostic information, crash logs, performance logs, server logs, and security logs.

• Usage information such as screens viewed, buttons tapped, plans created, invitations sent, events joined, media posted, feature usage, session activity, referral activity, and general engagement metrics.

• Fraud, spam, abuse, account-security, integrity, and trust-and-safety signals.

• Cookie, SDK, local-storage, or similar information used on CU-controlled web properties for service operation, security, analytics, and preferences, as described in Section 20.

3.10 Information From Other Users and Service Providers

Other users may provide information about you when they invite you, add you to a plan or group, include you in User Content, report content or conduct, or otherwise interact with you through CU.

CU may also receive limited information from service providers that help us operate the Service, such as delivery status, authentication responses, fraud or security signals, map or place-search responses, crash information, or technical diagnostics, and may receive age-category or parental-consent information from app stores as described in Section 2.1.

4. Consent, Permissions, and How We Collect Information

We collect information directly from you, automatically through your use of the Service, from other users, and from service providers acting for CU. We collect, use, and disclose personal information with consent or as otherwise permitted or required by applicable law.

Device permissions are requested in context. Before CU collects precise or background location, you will see an in-app explanation of what will be collected and why, in addition to your device's own permission prompt. Where a permission is optional, you can decline or later revoke it through your device settings. If you decline or revoke a permission, the specific feature that depends on it may be limited or unavailable. CU seeks to request permissions that are reasonably related to the feature being used and does not require unrelated permissions solely to access unrelated functionality.

5. How We Use Information

• Create, authenticate, maintain, protect, and support user accounts.

• Provide CU features, including friends, groups, plans, events, maps, place search, event location sharing, arrival status, event chat, stories, media sharing, invitations, calendar export, notifications, and Spin the Wheel.

• Display information to the people you choose to interact with, such as friends, plan participants, event participants, group members, and invitees.

• Operate the limited event location-sharing window when enabled and help participants coordinate arrival.

• Send service, support, security, invitation, plan, event, and account communications.

• Send newsletters, launch updates, or other commercial electronic messages when we have the consent or other lawful basis required to do so, and process unsubscribe requests.

• Provide sponsored, branded, business, or promotional features and measure their performance, including through aggregated or de-identified campaign reporting where appropriate.

• Provide customer support and respond to privacy, safety, account, content, and technical requests.

• Moderate content and conduct; investigate reports; enforce our Terms of Use, Community Guidelines, and Child Safety Standards; and protect users and the Service.

• Detect, prevent, investigate, and respond to spam, fraud, abuse, security incidents, illegal activity, exploitation, and other misuse.

• Confirm eligibility, apply age-appropriate experiences, and meet app-store and legal requirements relating to minors.

• Measure performance, troubleshoot, analyze feature use, improve the Service, and develop new or improved features.

• Comply with legal obligations, respond to lawful requests, preserve evidence when appropriate, protect rights and safety, and resolve disputes.

• Create aggregated or de-identified information that does not reasonably identify an individual, where permitted by law.

CU will not use personal information for a materially different purpose than those described here without providing notice and obtaining consent where required by applicable law.

6. Event Location Sharing

Event location sharing is optional and off by default. CU will not collect precise device location for event location sharing unless you grant the relevant device permission and turn the feature on for a specific plan or event.

When event location sharing is enabled for an event, CU may process precise location during a limited two-hour window beginning one hour before the scheduled event start time and ending one hour after the scheduled event start time, or for any shorter period you choose. The feature is intended to help authorized participants coordinate arrival and understand whether friends appear to be on the way, late, nearby, or arriving.

Background collection. So that arrival status remains accurate when you are travelling to an event, CU may continue to collect precise location while the CU app is in the background or not open on your screen, but only while event location sharing is turned on for a specific event and only during that event's active sharing window. CU does not collect background location outside an active sharing window. On iOS this requires you to grant "Always" location access; on Android it requires background location permission. You can turn event location sharing off at any time inside CU, and you can revoke or downgrade the underlying permission at any time in your device settings.

Live event location is intended to be visible only to authorized participants in the same CU plan or event during the active sharing window, subject to your settings, device and operating-system behavior, and the feature's design. If a feature uses reciprocal sharing, a participant who does not share their own live event location may not be able to see other participants' live event locations.

Location information may be inaccurate, delayed, incomplete, or unavailable because of device settings, connectivity, operating-system behavior, sensors, mapping data, or other factors. CU is not an emergency service and must not be relied on to locate a person in an emergency, confirm personal safety, or make legal, medical, transportation, or other safety-critical decisions.

CU does not use location information to infer or record health conditions, healthcare visits, reproductive or sexual health, religious attendance, immigration status, union membership, or other sensitive characteristics, and does not collect consumer health data as that term is used in state consumer health privacy laws.

7. How Information Is Shared

CU is a social service, so some information is shared with other users as necessary to provide the features you choose to use.

7.1 Sharing With Other CU Users

• Profile information, username, profile photo, friend status, group membership, host or attendee status, and basic account identifiers.

• Plans, events, groups, invitations, join or RSVP status, arrival status, participation details, and related event activity.

• Photos, videos, stories, event media, chat messages, comments, reactions, Spin the Wheel prompts or results, and other User Content you choose to share.

• Precise live event location during the active location-sharing window when you enable the feature and the recipient is authorized to view it.

Other users may save, screenshot, record, copy, or share content that is visible to them. CU cannot control what another person does with information after they lawfully receive or capture it outside the Service.

7.2 Service Providers

We may disclose information to service providers that help us host, secure, authenticate, map, search places, analyze performance, deliver email or SMS, operate deep links and push notifications, provide support, process website subscriptions, detect fraud or abuse, review reports, or otherwise operate the Service.

We require service providers that process personal information for CU to handle it only for authorized purposes, to act on our documented instructions, and to provide protections consistent with this Privacy Policy and applicable law. Some providers may process information in Canada, the United States, or other jurisdictions. A current list of the categories of service providers CU uses is available on request from support@cuitup.com.

7.3 Mapping, Device, and Platform Services

When you use maps, place search, device permissions, push notifications, app-store services, operating-system sharing features, calendar export, or other platform functionality, limited information may be processed by the applicable provider as necessary to deliver that function. Those providers may also have independent privacy obligations or policies.

7.4 Sponsors, Businesses, and Promotional Partners

CU may work with sponsors, businesses, creators, venues, or promotional partners. We may provide them with aggregated or de-identified campaign information, such as overall impressions, interactions, or participation metrics, where that information does not reasonably identify an individual.

CU does not sell precise location data and does not disclose your precise event location to sponsors or business partners for their independent behavioral advertising. If a feature would intentionally send identifiable information to a sponsor or business because you choose to interact with that third party, CU will provide appropriate notice or choice where required.

7.5 Legal, Safety, and Corporate Transactions

• We may disclose information where reasonably necessary to comply with law, legal process, court order, subpoena, or a valid governmental or regulatory request.

• We may disclose information to protect the rights, safety, property, users, or security of CU, CU Media Corp., or others, including to investigate or report illegal, exploitative, threatening, abusive, or harmful conduct.

• If CU Media Corp. is involved in a merger, acquisition, financing, reorganization, sale of assets, insolvency, or similar transaction, information may be transferred as part of that transaction, subject to applicable law and appropriate protections.

8. No Sale of Personal Information or Precise Location

CU does not sell personal information and does not share personal information for cross-context behavioural advertising, as the terms "sell" and "share" are defined under applicable United States state privacy laws. CU does not sell precise location data and does not disclose precise location data for third-party behavioural advertising. CU has not sold or shared personal information in the preceding twelve months, and does not sell or share the personal information of any user CU knows or reasonably believes is under 18 years of age.

Showing a contextual sponsored Card, branded placement, suggested location, or other promotion does not by itself mean that CU sold or shared personal information. Because CU does not sell or share personal information, CU does not offer a "Do Not Sell or Share My Personal Information" opt-out and does not need to process opt-out preference signals such as Global Privacy Control. If our practices materially change, we will update this Policy, honour recognized opt-out preference signals, and provide any notices, consent, or choices required by applicable law.

9. Sensitive Personal Information

Some laws treat certain categories of information as sensitive personal information or sensitive data. The only such category CU collects is precise geolocation, and CU collects it only with your consent, through the device permission you grant and the event location sharing you enable.

CU uses and discloses precise geolocation only to provide the event location sharing and map features you request, to secure and troubleshoot those features, to prevent fraud and abuse, to respond to safety concerns, and to comply with law. CU does not use precise geolocation to infer characteristics about you, does not use it for advertising or profiling, and does not sell or share it. Because CU limits its use of sensitive personal information to purposes permitted under applicable law, CU does not offer a separate "Limit the Use of My Sensitive Personal Information" control.

10. Moderation, Reports, and Safety Reviews

CU maintains moderation and safety processes for User Content and user conduct. No moderation system can identify every violation before it occurs, but CU uses technical and operational measures to detect, filter, restrict, review, and remove objectionable content and to identify spam, abuse, exploitation, fraud, or other violations.

CU provides in-app tools that allow users to report objectionable content or users and to block other users for unwanted or abusive interactions. Users may also contact support@cuitup.com. CU aims to review reports of objectionable content within 24 hours and to remove violating content and, where appropriate, remove the user who provided it. Reported content, report reasons, related messages, account identifiers, and surrounding context may be processed and retained as reasonably necessary for review, enforcement, appeals, safety, legal compliance, or evidence preservation.

Automated processing. CU uses automated tools to help detect spam, fraud, abuse, prohibited content, and safety risks. Some enforcement decisions, such as automatically filtering a message or restricting an account showing strong abuse signals, may initially be made by automated means. If a decision that significantly affects you is made exclusively by automated processing, you may contact support@cuitup.com to be told the personal information used, to submit observations, and to request review by a person.

11. Your Choices and Controls

• Manage location, background location, camera, microphone, photo-library, contacts, calendar, and notification permissions through your device settings, where applicable.

• Turn event location sharing on or off for any plan or event inside CU.

• Choose what content to create, upload, send, or share and which CU plans, groups, or event features to participate in.

• Edit or delete account or content information where the relevant feature provides that control.

• Use in-app reporting and blocking tools to manage unwanted or abusive interactions.

• Unsubscribe from marketing emails using the unsubscribe mechanism provided in the message or by contacting support@cuitup.com. Service or security communications that are necessary to operate your account may still be sent where permitted by law.

• Contact the Privacy Officer at support@cuitup.com to request privacy assistance, access, correction, deletion, withdrawal of consent, portability, or other rights that apply to you.

12. Account and Data Deletion (In-App and Web Requests)

If you create a CU account, you can initiate permanent account deletion directly from the account-management settings in the CU app. CU also provides a publicly accessible web-based account-deletion request option through the CU website that does not require you to sign in. If you need assistance, you may contact support@cuitup.com, preferably from the email address associated with your CU account. We may request information reasonably necessary to verify your identity and protect the account from unauthorized deletion.

Account deletion removes the account and personal information associated with it, including User Content associated with the account, from active systems, subject to limited exceptions permitted or required by law. Where CU uses service providers to process account data, CU will instruct applicable providers to delete or return data as appropriate to their role and legal obligations.

What is deleted and when. Once a deletion request is verified, CU deletes or de-identifies your account information and User Content from active production systems within 30 days, and from routine backups within 90 days as those backups are cycled and overwritten. Content you sent to other users, such as a message in a group chat, may remain visible to those recipients.

What may be retained. Certain information may be retained where reasonably necessary for legal compliance, fraud or abuse prevention, security, dispute resolution, enforcement, child-safety obligations, intellectual-property claims, tax or accounting requirements, or evidence preservation, and for as long as those purposes and applicable limitation periods require. Records of marketing consent and unsubscribe choices, and records of prior enforcement actions used to prevent ban evasion, may also be retained. Where possible and appropriate, retained information will be access-restricted or de-identified.

Temporary deactivation, restriction, or suspension is not treated as account deletion.

13. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain accounts, support users, secure the Service, comply with legal obligations, prevent abuse, resolve disputes, document consent where required, and enforce our agreements.

Retention periods vary by data type and context. We consider the nature and sensitivity of the information, why it was collected, whether the purpose can be achieved another way, technical requirements, legal obligations, and safety or security needs. As general guidance: account and profile information is retained while your account is active and then deleted as described in Section 12; plan, event, and message content is retained while your account is active or until you delete it; precise location data is deleted or de-identified within 30 days of the end of the relevant sharing window unless needed for a safety, security, or legal matter; technical, crash, and security logs are typically retained for up to 24 months; and safety, moderation, and enforcement records are retained for as long as needed for safety and legal purposes.

Precise live event location is not intended to remain visible to other users after the active two-hour event location-sharing window ends.

Deleted account data or User Content may remain temporarily in backups, security logs, report records, or legal records where deletion cannot immediately occur or where retention is permitted or required for safety, security, legal, or enforcement purposes. Marketing consent and unsubscribe records may be retained as reasonably necessary to demonstrate compliance with applicable anti-spam or marketing laws.

14. Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, loss, or destruction. Safeguards may include access controls, secure authentication, encrypted network transport, encryption of sensitive data at rest, monitoring, logging, vendor controls, and incident-response processes appropriate to the information and system.

No method of transmission, storage, or processing is completely secure, and we cannot guarantee absolute security. If a privacy or security incident occurs, we will investigate and provide notices to individuals or regulators where required by applicable law.

15. Cross-Border Processing

CU is operated from Canada and may use service providers in Canada, the United States, or other jurisdictions. Personal information may therefore be processed, stored, or accessed outside the province, state, or country where you live. Information processed in another jurisdiction may be subject to the laws and lawful-access requirements of that jurisdiction, including lawful requests by courts, law enforcement, and national security authorities in that jurisdiction.

Where required by law, CU conducts privacy assessments before transferring personal information outside a province or country and uses contractual, organizational, technical, or other safeguards designed to protect personal information transferred for processing.

16. Privacy Rights and Complaints

Depending on where you live and which privacy laws apply, you may have rights to request access to, correction of, or deletion of personal information; withdraw consent; obtain information about how personal information has been used or disclosed; receive a portable copy of personal information you provided to CU in a structured, commonly used technological format; object to or opt out of certain processing; appeal certain privacy decisions; or make a complaint.

To exercise a privacy right or make a privacy complaint, contact the Privacy Officer at support@cuitup.com. We may request information reasonably necessary to verify your identity and authority to make the request. Some rights are subject to legal exceptions, and withdrawing consent may affect features that require the information. We respond to requests within the time required by applicable law and, in any event, without undue delay.

If we cannot resolve a privacy concern, you may have the right to contact the privacy regulator, commissioner, attorney general, or supervisory authority that has jurisdiction where you live. In Canada, these include the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, and the Commission d'accès à l'information du Québec.

17. Your United States State Privacy Rights

This Section applies to residents of United States states with comprehensive consumer privacy laws, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states as those laws take effect. It supplements the rest of this Policy.

17.1 Notice at Collection

In the preceding twelve months CU has collected the following categories of personal information, for the business and commercial purposes described in Section 5, from the sources described in Section 3, and has disclosed each category to the categories of recipients described in Section 7. CU retains each category for the periods described in Sections 12 and 13.

• Identifiers, such as name, username, email address, phone number, IP address, device identifiers, and account identifiers.

• Customer records information, such as account and contact details you provide.

• Commercial information, such as subscription and campaign interaction records.

• Internet or other network activity, such as usage, feature interaction, crash, performance, and security information.

• Geolocation data, including approximate location and, where you enable it, precise location. Precise geolocation is sensitive personal information; see Section 9.

• Audio, electronic, visual, or similar information, such as photos, videos, and recordings you create or upload.

• Inferences drawn to operate and secure the Service, such as trust-and-safety and abuse signals.

• Age or age-range information, including age-category or parental-consent signals received from an app store, where applicable.

CU does not collect personal information in the categories of biometric information, professional or employment information, education information, or characteristics of protected classifications.

17.2 Your Rights

• Right to know or access the categories and specific pieces of personal information CU has collected, the sources, the purposes, and the categories of recipients.

• Right to delete personal information CU has collected from you, subject to legal exceptions.

• Right to correct inaccurate personal information.

• Right to obtain a portable copy of personal information you provided to CU.

• Right to opt out of the sale or sharing of personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects. CU does not engage in any of these activities, so there is nothing to opt out of at this time.

• Right to limit the use and disclosure of sensitive personal information. CU already limits its use of sensitive personal information to purposes permitted by law, as described in Section 9.

• Right to non-discrimination. CU will not deny you goods or services, charge you a different price, provide a different level or quality of service, or retaliate against you because you exercised a privacy right.

17.3 How to Submit a Request

Submit a request by emailing support@cuitup.com with the subject line "Privacy Request," or by using the account-deletion option in the app or on the CU website. To protect your account, we will verify your request, typically by confirming control of the email address associated with your account and, where the request concerns sensitive or extensive information, by asking for additional information matching what we already hold. We will not use verification information for any other purpose.

An authorized agent may submit a request on your behalf if the agent provides proof of your written permission and we can verify your identity directly. A parent or guardian may submit a request on behalf of a minor where permitted by law.

We will confirm receipt of a request within 10 business days and respond within 45 days. If we need more time, we will notify you within the initial 45-day period and may extend by up to an additional 45 days.

17.4 Appeals

If we decline to act on your request, you may appeal by replying to our response or by emailing support@cuitup.com with the subject line "Privacy Appeal." We will respond to an appeal in writing within 45 days (or 60 days where your state's law provides), explaining the reasons for our decision. If your appeal is denied, you may contact your state attorney general to submit a complaint.

17.5 California Shine the Light

California residents may request information about disclosures of personal information to third parties for those third parties' direct marketing purposes. CU does not make such disclosures. Requests may be sent to support@cuitup.com.

18. Children, Teens, and Child Safety

CU is not directed to children under 16 and does not knowingly permit users under 16 to maintain accounts. We prohibit child sexual abuse and exploitation, grooming, sextortion, child sexual abuse material, sexualization of minors, and other conduct or content that sexually exploits or endangers a person under 18.

CU maintains separate published Child Safety Standards that supplement this Policy, our Terms of Use, and our Community Guidelines. Those standards describe CU's child-safety commitments, reporting channels, and response processes in greater detail.

If you believe a person under 16 has provided personal information to CU, or you have a child-safety concern, use the in-app reporting tools or contact child-safety@cuitup.com or support@cuitup.com.

19. Third-Party Links and External Services

CU may include links, integrations, or features that interact with app stores, operating systems, maps, messaging services, calendars, websites, sponsors, businesses, or social platforms. We are not responsible for the privacy practices of third parties that are not acting as our service providers. Review their terms and privacy policies before providing information to them.

20. Cookies and Similar Technologies

CU-controlled websites use cookies and similar technologies. Strictly necessary cookies are required to operate the site, keep it secure, remember your form entries, and support subscription and deletion request forms. Analytics and performance cookies help us understand how the site is used so we can improve it. CU does not use advertising or cross-site tracking cookies and does not permit third parties to use cookies on our website for their own behavioural advertising.

You can control cookies through your browser settings, including by blocking or deleting them, and many browsers offer a "do not track" or privacy control setting. Blocking strictly necessary cookies may prevent parts of the site from working. Where required by applicable law, we will ask for your consent before setting non-essential cookies.

The CU mobile app does not use third-party advertising identifiers for cross-app tracking and does not request permission to track you across apps and websites owned by other companies.

21. Changes to This Privacy Policy

We may update this Privacy Policy as CU changes, laws evolve, or our data practices change. If a change is material, we will provide notice in the app, by email, through our website, or by another reasonable method, and, where required, notify app stores so that any necessary parental consent can be renewed. The updated Policy will identify its effective or last-updated date, and we will obtain renewed consent where required by applicable law.

22. Contact

Privacy Officer - CU Media Corp.

Email: support@cuitup.com

Child-safety matters: child-safety@cuitup.com