Privacy Policy

1. Introduction

1.1 Who we are

This Privacy Policy (this “Policy”) is issued by Mecavoy LC, a Wyoming limited liability company (Wyoming entity ID 2026-002066107), 5830 E 2nd St, Ste 7000 #38404, Casper, WY 82609, United States (“Mecavoy”, “we”, “us” or “our”). Mecavoy is the controller of the personal information described in this Policy.

1.2 Scope

This Policy applies to personal information that Mecavoy collects through the website at mecavoy.com (the “Site”) and through the emails we send, in connection with:

1. the Mecavoy mailing list, described in Section 2; and
2. applications to the Mecavoy Founding Advisor Program (the “Program”), described in Section 3.

This Policy does not apply to the Mecavoy travel planning and booking service, which is scheduled to launch in January 2027. That service will be covered by a separate privacy policy, and we will email subscribers before it takes effect.

1.3 Definitions

In this Policy, “personal information” means information that identifies, relates to or could reasonably be linked with an identified or identifiable individual, including the hashed values described in this Policy. “Offer Terms” means the Pre-Launch Offer Terms, and “Program Terms” means the Founding Advisor Program Terms.

1.4 How to contact us

Questions about this Policy and requests about your personal information may be sent to privacy@mecavoy.com. Other questions may be sent to support@mecavoy.com.

2. The Mailing List

2.1 Information you provide

1. Email address. Your email address is the only information requested on the signup form.
2. Consent record. The exact wording displayed beside the consent checkbox, the version of that wording, the date and time you submitted the form with the box checked, and the fact that your consent was given through the web form. Consent is given on the form itself; there is no separate confirmation step, except when an address that has unsubscribed rejoins the mailing list, as described in Section 6(b).

2.2 Information collected automatically when you subscribe

1. Hashed IP value. A hashed value derived from your IP address, computed with a secret key that we hold. Without that key the value does not reveal your IP address, but we treat it as personal information. Your IP address itself is not stored in your subscriber record.
2. User agent. The user agent string your browser sends, which identifies the browser and operating system.
3. Source page. The page of the Site from which you subscribed.

2.3 Information we generate

Your subscription status; the date you first subscribed; the date and time we last emailed you, and technical references used to prevent the same email being sent twice; whether the welcome email has been sent; whether a receiving mail server refused an email to you, and the reason it gave; and, if you unsubscribe, the date and time you did so. If you subscribed while subscribing required a confirmation email, or if you rejoined the mailing list after unsubscribing as described in Section 6(b), your record may also show when you clicked the confirmation link and a hashed value derived from the IP address from which you clicked it.

2.4 Server and application logs

1. Web and storage access logs. The content delivery network that serves the Site, and the storage that receives files uploaded through the application form, keep standard access logs. These logs include the IP address from which each request was made, the page or file requested, the date and time, and technical details such as the user agent. We use them only for security and diagnostics. They are not combined with subscriber or applicant records and are not used for marketing. Some of our emails include a countdown image that your email program loads from the Site when it displays the email; that request carries no identifier for you, and it is logged, with the IP address it comes from, like any other request to the Site.
2. Application logs. The systems that handle signups, unsubscribes, applications, emails and staff access to the administration console record events such as a signup, an unsubscribe, a document being opened or an error. Log entries may include IP addresses and hashed values derived from IP addresses and email addresses. We use these logs for security, auditing and troubleshooting.

2.5 Information we do not collect for the mailing list

For the mailing list, we do not collect your name, postal address, phone number, payment details, precise location or advertising identifiers. We do not buy email lists, and we add to the mailing list only addresses submitted through the signup form on the Site or at the request of the person to whom the address belongs.

2.6 How we use this information, and our legal bases

1. To send you the emails you agreed to receive (launch news, occasional updates, and Mecavoy promotions and offers). Legal basis: your consent, which you may withdraw at any time by unsubscribing. Withdrawing consent does not affect processing carried out before you withdrew it.
2. To reserve and apply your Free Year of Mecavoy Plus under the Offer Terms, and to apply the one-per-person limit, for which we treat email addresses that differ only by dots or by a “+” tag as the same address. We continue to do so after you unsubscribe, using the email address kept on the suppression list described in Section 6(b). Legal basis: performance of our agreement with you under the Offer Terms.
3. To detect and prevent automated or abusive submissions and to keep the Site secure, using the information in Sections 2.2 and 2.4. Legal basis: our legitimate interest in operating a secure service. You may object to this processing (see Section 9).
4. To understand which pages of the Site lead to signups, using the source page. Legal basis: our legitimate interest in understanding how the Site is used.
5. To keep a record of your consent and of any unsubscribe request, and to maintain a suppression list so that we do not email you after you have unsubscribed, except as described in Section 6(b). Legal basis: our legitimate interest in demonstrating that we have acted lawfully and in honoring your request not to be contacted, and compliance with our legal obligations.
6. To confirm a request to rejoin the mailing list after you have unsubscribed, by sending one email to the address entered in the signup form, as described in Section 6(b). Legal basis: our legitimate interest in making sure that an address is added back to the mailing list only by the person to whom it belongs, and, once you confirm, your consent.

Your email address is required to join the mailing list. If you do not provide it, we cannot add you to the list or reserve a Free Year for you.

3. Founding Advisor Applications

3.1 Scope of this section

This Section 3 applies to applications to the Program made through the application form at mecavoy.com/advisor-apply.html. The Program Terms are published at mecavoy.com/advisor-terms.html. The Program is open only to individuals who reside in the United States and to businesses organized or registered in the United States, as set out in the Program Terms. Sections 4 to 12 of this Policy apply to applicants as well as to subscribers. This Section 3, together with Sections 4.1 and 9.4, is our notice at collection for applicants.

3.2 Information you provide

1. Identity and contact details. Your full name, email address, phone number (if you provide one), city, state or territory, and country, which must be the United States.
2. Professional details. The track you apply for (Independent Agent or Registered Advisor), your headline, years of experience, a description of your work, specialties, destinations, languages and the services you offer, and, if you provide them, your website, Instagram and LinkedIn profiles and the name of your host agency.
3. Business details. For the Registered Advisor track, your business’s legal name, entity type and state of registration, and your seller-of-travel registration numbers and the states that issued them.
4. Headshot and documents. Your headshot and the documents you upload, which may include business registration documents, seller-of-travel certificates, proof of errors and omissions insurance, certificates or training records, and samples of your work, together with each file’s name, type and size. Each file is uploaded to our storage when you select it, before you submit the application.
5. Acceptances and choices. The version of the Program Terms you accepted, your authorization of the verification described in the Program Terms, and your confirmation that the information you provided is accurate, each with the date and time you gave it; whether you asked to receive advisor news; and, if you did, the wording of that request and the date and time you made it.
6. Other information. Any other information you give us during our review, including in emails and verification calls.

3.3 Information collected automatically

When you submit an application, we collect a hashed value derived from your IP address and your browser’s user agent, as described in Section 2.2. The access logs and application logs described in Section 2.4 also record your use of the application form. Draft answers saved in your own browser while you complete the form are not sent to us until you submit the application (see Section 5.2).

3.4 Information from other sources

When we verify an application, we may obtain information confirming whether the information you provided is accurate from the bodies that issued a certificate, registration or license you have submitted, from public registers, and from any references you have given us. We may also review the website and social media profiles you list in your application and publicly available information about your travel business. We do not obtain consumer reports from consumer reporting agencies. If we ourselves obtain public records about you in the course of verification, we will send a copy of them to the email address in your application within seven days after we obtain them, as set out in Section 5.4 of the Program Terms. You do not need to ask for the copy.

3.5 Information we generate

A record of our review, including any note recorded with our decision, our decision, the role approved (if any), the date of each step, the staff account that made each decision, and a history of the submission and each decision; a count of any later attempts to submit an application with the same email address; and the dates on which we sent you emails about your application.

3.6 How we use this information

1. To review and verify your application and to communicate with you about it, so that we can ensure that advisors on Mecavoy are who they say they are and hold the qualifications they claim.
2. If your application is approved, to prepare your advisor profile and to enter into the Advisor Agreement with you.
3. To keep a record of the terms you accepted, your authorizations and our decisions, and to establish, exercise or defend legal claims.
4. To detect and prevent automated or abusive submissions and to keep the Site secure.
5. To send you occasional Mecavoy news for advisors, if you asked to receive it. You may stop these emails at any time.

The application form asks you to authorize the verification described in the Program Terms. Decisions on applications are made by Mecavoy staff. We do not make decisions about applicants based solely on automated processing. The information marked as required on the application form is necessary for us to consider your application. Other information is optional.

3.7 Internal notification

When you submit an application, a copy of the information in it, other than the uploaded files, is emailed to an internal Mecavoy mailbox so that authorized staff can review it. Applications and uploaded files are otherwise accessed through our password-protected administration console.

3.8 How long we keep application information

1. Applications under review. For as long as the review continues.
2. Approved applications. For as long as you are a Mecavoy advisor, and afterwards for as long as the Advisor Agreement or applicable law requires.
3. Declined applications. The documents you uploaded are deleted automatically no later than 12 months after the date of our decision. The rest of the application record is kept only for as long as reasonably necessary to answer questions about the decision, to consider a future application from you, to comply with our legal obligations and to establish, exercise or defend legal claims.
4. Applications withdrawn, or deleted at your request. We delete the application, the documents uploaded with it and our internal notification of it within 30 days after we receive your request, except to the extent that the law requires us to keep them.
5. Files not submitted with an application. Files uploaded through the application form but never submitted with a completed application are deleted automatically three days after upload.

When a document is deleted, our storage provider may keep it in the storage version history for up to 30 days before it is permanently removed. Deleted application records may remain in encrypted database backups for up to 35 days.

3.9 Withdrawing an application

To withdraw your application, email support@mecavoy.com from the address you applied with. To exercise any of the rights described in Section 9, email privacy@mecavoy.com.

4. How We Disclose Personal Information

4.1 No sale or sharing for advertising

We do not sell personal information, share it for cross-context behavioral advertising, or disclose it to third parties for their own marketing. We have not done so in the preceding 12 months.

4.2 Service providers

The following service providers process personal information on our behalf, under contract, and only for the purposes described:

1. Amazon Web Services (AWS). Hosts the Site, the databases that hold subscriber and application records, the storage that holds application documents, and our logs, in the United States.
2. Mailgun (Sinch). Delivers the emails we send to subscribers and applicants, and our internal notifications of new applications. It receives the recipient’s email address and the content of each email so that it can deliver the message.
3. Our business email hosting provider. Hosts the mecavoy.com mailboxes that receive your messages to us and our internal notifications of new applications.

4.3 Other disclosures

We may also disclose personal information:

1. to issuing bodies, public registers and references you have given us, limited to what is necessary to verify your application (for example, your name and a registration number);
2. to our professional advisers, such as lawyers, accountants and insurers, where necessary and subject to duties of confidentiality;
3. where required by law, regulation, legal process or an enforceable governmental request, or where reasonably necessary to protect the rights, property or safety of Mecavoy, our users or others, or to prevent fraud; and
4. in connection with a merger, acquisition, financing, reorganization or sale of all or part of Mecavoy’s business or assets. If this occurs, we will notify you before your personal information becomes subject to a different privacy policy.

5. Cookies, Browser Storage and Tracking

5.1 No cookies on the public Site

The public pages of the Site set no cookies. The Site uses no analytics, advertising or social media tracking technologies, and loads no content from third-party servers; the typefaces are served from the Site itself.

5.2 Browser storage

The Site stores limited information in your browser, on your device, where a feature you use requires it:

1. Home page. An entry in your browser’s session storage recording that the opening animation has played. It is deleted when you close the browser tab.
2. Founding advisor application. The text answers you type into the application form, saved in your browser’s local storage so that you can finish later. Options you select, such as checkboxes, and uploaded files are not saved. This draft stays on your device and is not sent to us until you submit the application. It is deleted when you submit the application or choose “Clear saved progress” or “Start over”. A saved draft that is more than 30 days old is deleted automatically the next time you open the home page, a Founding Advisor Program page or the application form. You can also delete it through your browser settings. If you use a shared device, we recommend clearing your saved progress when you finish.

Files you upload with an application are sent directly from your browser to our storage provider, AWS, over an encrypted connection.

5.3 Staff administration console

The administration console used by authorized Mecavoy staff sets one strictly necessary session cookie when a staff member signs in. It is never set for visitors. It expires after a period of inactivity, when the staff member signs out, or 8 hours after sign-in, whichever occurs first. The console also remembers the selected view in session storage.

5.4 Global Privacy Control and Do Not Track

We do not sell or share personal information (see Section 4.1), and the Site does not track visitors over time or across third-party websites. We nonetheless treat a Global Privacy Control signal sent by your browser as a valid request to opt out of any sale or sharing of your personal information. Because we do not sell or share personal information, honoring that request does not change how the Site operates. We do not respond to a Do Not Track signal differently, because the Site does no tracking for that signal to stop. No third party collects personally identifiable information about your online activities over time and across different websites through the Site.

6. Retention

We keep personal information only for as long as necessary for the purposes described in this Policy. Retention periods for application information are set out in Section 3.8. For the mailing list and our logs:

1. Subscriber records. Until you unsubscribe or ask us to delete your information.
2. After you unsubscribe. We delete your consent record and the information described in Sections 2.2 and 2.3, except that we keep your email address, your subscription status, the dates on which you subscribed and unsubscribed, and any record that an email to you could not be delivered, on a suppression list so that we do not contact you again, except as described below. If you subscribed while Version 1 of the Offer Terms was published, we keep only your email address on the suppression list, as those terms provide, and delete everything else. We also use the email address on the suppression list to honor the Offer Terms: unsubscribing does not end the Free Year of Mecavoy Plus reserved for that address, and if you open a Mecavoy account with it, the Free Year applies as those terms provide. We use the address for that purpose only until the Offer lapses for that address. If an address on the suppression list is entered in the signup form again, we do not add it back to the mailing list. We send one email to that address asking whether it should be added back, and no more than one such email to the same address in any 24 hours, unless the link in the previous one was used. The signup form adds the address back only if the link in that email is used within 48 hours; the new subscription is then recorded as described in Sections 2.1 to 2.3 and is governed by the current Offer Terms and this Policy (see Section 11.2). Until then the suppression record does not change, whichever version of the Offer Terms you subscribed under. If you ask us, from that address, to stop sending these emails, we stop, and we keep a record of your request, identified by a pseudonymous identifier derived from the address rather than by the address itself, until you ask us to add you back or to delete your information. We keep a request to rejoin, meaning the address and the information described in Sections 2.1(b) and 2.2 that were submitted with it, separately from the suppression record, and we delete it automatically 48 hours after it is made; the deletion can take a few more days to complete. We keep the suppression record for as long as we operate the mailing list.
3. Signups that were never confirmed. Until we removed the confirmation step from the signup process, a signup became a subscription only when the confirmation link in our confirmation email was clicked. A signup that was never confirmed is not on the mailing list, receives no emails from us and does not reserve a Free Year under the Offer Terms. We delete these records, and in any event no later than 12 months after each record was created.
4. Web and storage access logs. 90 days.
5. Application logs. Up to 90 days.
6. Correspondence. Emails you send us are kept for as long as reasonably necessary to respond to you and to keep a record of any request you make.
7. Backups. Deleted or changed database records may remain in encrypted backups for up to 35 days before they are permanently overwritten.

7. Security

We encrypt personal information in transit. The databases, document storage and log storage that we operate encrypt it at rest. Access to subscriber and application records is limited to authorized Mecavoy staff, who review them through a password-protected administration console over an encrypted connection. The underlying databases and document storage are not publicly accessible, and our email sending key is held in a managed secret store.

No method of transmission or storage is completely secure. If a security incident affects your personal information, we will notify you, and any authority we are required to notify, as required by applicable law.

8. International Users

Mecavoy is based in the United States. We store and process personal information in the United States, and our service providers may also process it in other countries in which they operate, under contracts that require them to protect it. Data protection laws in those countries may differ from those of your country. The Free Year of Mecavoy Plus is available only to residents of the United States, as set out in the Offer Terms, but anyone may subscribe to the mailing list. The Program is open only to individuals who reside in the United States and to businesses organized or registered in the United States, as set out in the Program Terms. Section 9.3 describes additional rights for individuals in the European Economic Area and the United Kingdom.

9. Your Rights and Choices

9.1 Your choices

You may unsubscribe from the mailing list at any time using the link in any email we send, or by replying to any email and asking to be removed. You may stop receiving advisor news at any time in the same way or by emailing support@mecavoy.com.

9.2 Rights available to everyone

Wherever you live, you may ask us to:

1. confirm whether we hold personal information about you and give you access to it;
2. correct personal information that is inaccurate or incomplete;
3. delete your personal information, except the suppression record described in Section 6(b), information we are required by law to keep and information we need to establish, exercise or defend legal claims;
4. provide your personal information in a portable, machine-readable format;
5. stop processing your personal information on the basis of our legitimate interests (the right to object); and
6. withdraw any consent you have given, which for the mailing list you may do by unsubscribing.

If, at your request, we also delete your email address from the suppression list described in Section 6(b), we will no longer hold a record that the address was subscribed, and the Free Year of Mecavoy Plus reserved for it can no longer be applied under the Offer Terms. We will tell you this before we delete it.

These rights are subject to the limits and exceptions set by applicable law. If we cannot fulfill a request in full, we will tell you why. We do not charge for these requests, and we will not treat you differently because you make one.

9.3 Individuals in the European Economic Area and the United Kingdom

If you are in the European Economic Area or the United Kingdom, you may also ask us to restrict our processing of your personal information, and you have the right to lodge a complaint with your local data protection authority (in the United Kingdom, the Information Commissioner’s Office). We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

9.4 United States residents

Depending on the state in which you live, you may have rights under state privacy law, including rights to know, access, correct, delete and obtain a portable copy of your personal information, and to opt out of its sale, of targeted advertising and of profiling. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. For that reason we do not offer a “Do Not Sell or Share My Personal Information” link. If that changes, we will update this Policy and provide any opt-out required by law before the change takes effect. We treat a Global Privacy Control signal as described in Section 5.4.

In the preceding 12 months we have collected the following categories of personal information, from the sources and for the purposes described in Sections 2 and 3: identifiers (such as name, email address, phone number, IP address and hashed IP values); customer records information (such as name, phone number and any insurance information in documents you upload); commercial information (the Free Year reserved for your email address); professional or employment-related information (such as experience, specialties, business details and registrations); audio, electronic, visual or similar information (your headshot); and internet or other electronic network activity information (such as user agent, source page and log data). We disclose these categories only to the recipients described in Section 4, and we keep them for the periods described in Sections 3.8 and 6. We do not use sensitive personal information to infer characteristics about you.

9.5 How to make a request

Email privacy@mecavoy.com. To protect your information, we may ask you to confirm the request from the email address associated with it before we act on it. You may make a request through an authorized agent, in which case we will ask the agent for proof of their authority and may ask you to confirm the request directly.

We respond to requests within 30 days after we receive them. Where reasonably necessary, we may extend that period once by up to a further 30 days, and if we do we will tell you why. If we decline a request, we will explain why, and you may appeal the decision by replying to our response; we will respond to an appeal within the period required by applicable law. If you are not satisfied with the outcome, you may contact the attorney general of your state or, if you live in California, the California Privacy Protection Agency.

10. Children

Anyone 13 years of age or older may subscribe to the mailing list. The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. You must be at least 18 years of age to claim the Free Year under the Offer Terms or to apply to the Program. If you believe that a child under 13 has provided personal information to us, contact privacy@mecavoy.com and we will delete it.

11. Changes to This Policy

11.1 How we make changes

We will post any change to this Policy on this page with a new version number and effective date. If a change materially affects how we use personal information we already hold about you, we will email you at least 30 days before the change takes effect, and where the law requires your consent we will ask for it. Previous versions of this Policy are available on request from privacy@mecavoy.com.

11.2 Subscribers under Version 1

This Section 11.2 applies to you if you subscribed to the mailing list while Version 1 of this Policy was the version published on the Site, and only for as long as that subscription continues. If it ends and you subscribe again after Version 2 is published, Version 2 applies to the new subscription. Any change made by Version 2 of this Policy that reduces a commitment made to you in Version 1 takes effect for you 30 days after the date on which we email you notice of that change. Until then, the Version 1 commitment continues to apply to you. This Section 11.2 does not reduce any right that the Offer Terms give you, and the Free Year of Mecavoy Plus reserved for your email address remains reserved for it after you unsubscribe, as the Offer Terms provide (see Section 6(b)). The changes to which this Section 11.2 applies include the following:

1. Deletion requests (Section 9.2(c)). Version 1 stated that, on request, we delete the information we hold about you except your email address, which stays on the suppression list. This Policy also allows us to keep information that we are required by law to keep or that we need to establish, exercise or defend legal claims.
2. Response times (Section 9.5). Version 1 stated that we answer requests within 30 days, or within 45 days in California, where the period may be extended once. This Policy states that we respond within 30 days and may extend that period once by up to a further 30 days.
3. Do Not Track and Global Privacy Control (Section 5.4). Version 1 stated that we treat a Do Not Track or Global Privacy Control signal as an objection to any processing that you are entitled to object to. This Policy treats a Global Privacy Control signal as a request to opt out of any sale or sharing, and does not respond to a Do Not Track signal differently.
4. Security incidents (Section 7). Version 1 stated that, if a breach affects your information and creates a real risk to you, we will tell you and the relevant regulator without unreasonable delay. This Policy states that we will notify you, and any authority we are required to notify, as required by applicable law.
5. Encryption (Section 7). Version 1 stated that information is encrypted in transit and at rest. This Policy states that information is encrypted in transit, and at rest in the databases, document storage and log storage that we operate.
6. Disclosures (Section 4). Version 1 named Amazon Web Services and Mailgun as our only service providers, and otherwise described disclosures only to our accountants, lawyers or insurers, to authorities that the law obliges us to inform, and in connection with a sale of Mecavoy or its assets. This Policy adds our business email hosting provider, and disclosures in response to legal process or an enforceable governmental request, or where reasonably necessary to protect the rights, property or safety of Mecavoy, our users or others, or to prevent fraud.
7. How addresses are added to the mailing list (Section 2.5). Version 1 stated that we do not add addresses that were not given to us directly by the person to whom they belong. This Policy states that we add addresses submitted through the signup form on the Site or at the request of the person to whom the address belongs.
8. Logs and backups (Sections 2.4 and 6). Version 1 did not describe application logs or backups. This Policy states that application logs, which may include IP addresses, are kept for up to 90 days, and that deleted or changed records may remain in encrypted backups for up to 35 days.
9. Browser storage (Section 5). Version 1 stated that the Site sets no cookies at all. The public pages of the Site still set no cookies, but the Site stores limited information in your browser as described in Section 5.2, and the staff administration console sets a cookie for authorized staff only.

12. Contact Us

Mecavoy LC, 5830 E 2nd St, Ste 7000 #38404, Casper, WY 82609, United States.

Privacy questions and requests: privacy@mecavoy.com. All other questions: support@mecavoy.com.

Version History

This version history is provided for information and does not form part of this Policy.

Version 2.2, September 26, 2026. Sections 2.1, 2.3, 2.6 and 6(b) now describe how an address that has unsubscribed can rejoin the mailing list: if the address is entered in the signup form again, we email it one link to confirm, send no more than one such email in any 24 hours unless the link in the previous one was used, and add the address back only if the link is used within 48 hours. The suppression record, including the one kept for subscribers under Version 1, does not change unless the link is used. Section 6(b) also states how long a request to rejoin is kept, and how to stop these emails. In the Summary, the item on unconfirmed signups now says that it concerns the former two-step signup. No other provision of Version 2.1 is changed.

Version 2.1, September 26, 2026. Section 10 now states that anyone 13 years of age or older may subscribe to the mailing list, in place of the statement that the Site is intended for adults. The age requirements for claiming the Free Year and for applying to the Program are unchanged. No other provision of Version 2 is changed.

Version 2, September 25, 2026. Version 2 replaces Version 1, which covered the mailing list only. The changes are as follows:

1. Section 3 is added to cover applications to the Program. The Program is open only to individuals who reside in the United States and to businesses organized or registered there. Section 3.4 states that we do not obtain consumer reports from consumer reporting agencies, and that if we ourselves obtain public records about an applicant during verification, we will email the applicant a copy within seven days after we obtain them.
2. The description of how you subscribe is corrected, because subscribing no longer involves a separate confirmation step. Section 6(c) states that a signup that required a confirmation email and was never confirmed is not on the mailing list, receives no emails, does not reserve a Free Year and is deleted.
3. The description of the hashed value derived from your IP address is corrected.
4. Section 2.5 states that we add to the mailing list only addresses submitted through the signup form on the Site or at the request of the person to whom the address belongs.
5. Section 6 now describes the information kept after you unsubscribe, which includes your subscription status, the dates on which you subscribed and unsubscribed and any record of an undelivered email as well as your email address. If you subscribed while Version 1 of the Offer Terms was published, Section 6(b) provides that we keep only your email address, as those terms provide. Section 6(b) also states that unsubscribing does not end the Free Year reserved for your email address and that we use the address kept on the suppression list to apply it under the Offer Terms until the Offer lapses for that address, and Section 9.2 states that the Free Year can no longer be applied if we delete the address from the suppression list at your request. Sections 2.4 and 6 also describe application logs and the retention of application logs, correspondence and backups.
6. Section 5 now describes the browser storage used by the Site and the cookie used by the staff administration console. Version 1 stated that the Site sets no cookies at all.
7. Section 5.4 describes how we treat Global Privacy Control and Do Not Track signals. Version 1 stated that we treat either signal as an objection to any processing that you are entitled to object to. This Policy treats a Global Privacy Control signal as a valid request to opt out of any sale or sharing of personal information, and does not respond to a Do Not Track signal differently, because the Site does no tracking for that signal to stop.
8. Section 4.2 adds our business email hosting provider to the list of service providers, and Section 4.3 adds disclosures in response to legal process or an enforceable governmental request, or where reasonably necessary to protect the rights, property or safety of Mecavoy, our users or others, or to prevent fraud.
9. Section 7 states that personal information is encrypted at rest in the databases, document storage and log storage that we operate, and that we will notify you of a security incident as required by applicable law.
10. Section 9 extends the rights it describes to individuals wherever they live, adds rights for individuals in the European Economic Area and the United Kingdom, allows us to keep information that the law requires us to keep or that we need for legal claims when you ask us to delete your information, and describes authorized agents and appeals. Requests are answered within 30 days, which we may extend once by up to a further 30 days; Version 1 stated 30 days, or 45 days in California.
11. Section 11.2 is added. If you subscribed while Version 1 was published, a change made by Version 2 that reduces a commitment made to you in Version 1 takes effect for you 30 days after we email you notice of it, and until then the Version 1 commitment continues to apply. Section 11.2 describes those changes.

These changes describe our existing practices more accurately and add processing only for founding advisor applicants. They do not change the purposes for which we use the information we already hold about subscribers. Some of them reduce a commitment made in Version 1, and Section 11.2 sets out when those changes take effect for subscribers under Version 1.